. DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 17:03:42.01 on Tue 04/19/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.993 [GMT -4:00] . AV: Spyware Doctor with AntiVirus *Disabled/Updated* {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33} AV: Panda Global Protection 2011 *Enabled/Updated* {8BF935E7-731F-4115-B7A5-789FF5087595} FW: Panda Personal Firewall 2011 *Enabled* . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\Program Files\Panda Security\Panda Global Protection 2011\TPSrv.exe C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe C:\PROGRAM FILES\PANDA SECURITY\PANDA GLOBAL PROTECTION 2011\WebProxy.exe C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe C:\Program Files\Panda Security\Panda Global Protection 2011\PsCtrls.exe C:\Program Files\Panda Security\Panda Global Protection 2011\PavFnSvr.exe C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe c:\program files\panda security\panda global protection 2011\firewall\PSHOST.EXE C:\Program Files\Panda Security\Panda Global Protection 2011\PsImSvc.exe C:\Program Files\Panda Security\Panda Global Protection 2011\PskSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\Installer\MSI72.tmp svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Panda Security\Panda Global Protection 2011\ApVxdWin.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe C:\Program Files\Panda Security\Panda Global Protection 2011\pavsrvx86.exe C:\Program Files\Panda Security\Panda Global Protection 2011\AVENGINE.EXE C:\Program Files\Panda Security\Panda Global Protection 2011\SRVLOAD.EXE C:\Program Files\Panda Security\Panda Global Protection 2011\PavBckPT.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Trusteer\Rapport\bin\RapportService.exe C:\Documents and Settings\GARY R DONLEY\Desktop\wmpfirefoxplugin.exe C:\Documents and Settings\GARY R DONLEY\Desktop\wmpfirefoxplugin.exe C:\WINDOWS\regedit.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugin-container.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\DOCUME~1\GARYRD~1\Desktop\dds.scr . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8 uSearch Page = uWindow Title = Windows Internet Explorer provided by Yahoo! uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8 uInternet Connection Wizard,ShellNext = hxxp://search.dell.com/index.asp uInternet Settings,ProxyOverride = *.local uSearchAssistant = mSearchAssistant = uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll uURLSearchHooks: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: 100% Free Toolbar Helper: {17df7d60-3575-497f-8d11-f8882e3e1ce9} - c:\program files\100% free toolbar\v3.3.0.3\100%_Free_Spades_Toolbar.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~2\SEARCH~1.DLL BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: gwprimawega: {64e012fc-80e7-67e7-b9f9-f8faaee32a3b} - blank BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll BHO: RoboForm BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Web Enhancements: {cc0f2900-8a5b-4d0d-9e44-10435bc40774} - c:\program files\webenhancements\WebEnhancements.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: TBSB05974 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - blank BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\speedb~1\toolbar\grabber.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll TB: Search Toolbar: {0c8413c1-fad1-446c-8584-be50576f863e} - blank TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll TB: Rightdown Software SearchBar: {d6f180cb-e683-41a3-8cd2-c53dbaa0530d} - c:\program files\rightdown software searchbar\rssb.dll TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: 100% Free Toolbar: {02f7a7eb-89f8-47ff-a75c-52c1060ec144} - c:\program files\100% free toolbar\v3.3.0.3\100%_Free_Spades_Toolbar.dll TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Creative Detector] "c:\program files\creative\mediasource\detector\CTDetect.exe" /R uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe" uRun: [Creative Live! Cam Manager] "c:\program files\creative\creative live! cam\live! cam manager\CTLCMgr.exe" uRun: [Update Service] c:\progra~1\common~1\teknum~1\update.exe /startup uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10o_Plugin.exe -update plugin mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking10\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking10\Ereg.ini mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r mRun: [MBMon] Rundll32 CTMBHA.DLL,MBMon mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe" mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [Nuance.ctfmngr] c:\program files\nuance\naturallyspeaking10\program\ctfmngr.exe /restore mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe" mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe mRun: [CTSVolFE.exe] "c:\program files\creative\mixer\CTSVolFE.exe" /r mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\12.0\sharedcom\RoxWatchTray12.exe" mRun: [V0400Mon.exe] c:\windows\V0400Mon.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [CPMonitor] "c:\program files\roxio 2010\5.0\CPMonitor.exe" mRun: [Desktop Disc Tool] "c:\program files\roxio 2010\roxio burn\RoxioBurnLauncher.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [APVXDWIN] "c:\program files\panda security\panda global protection 2011\APVXDWIN.EXE" /s mRun: [SCANINICIO] "c:\program files\panda security\panda global protection 2011\Inicio.exe" mRun: [PCTools FGuard] c:\program files\pc tools security\bdt\FGuard.exe dRun: [Samsung.PCSync] "c:\program files\samsung\samsung pc studio 7\PcSync2.exe" /NoDialog StartupFolder: c:\docume~1\garyrd~1\startm~1\programs\startup\stickies.lnk - c:\program files\stickies\stickies.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: Password Generator - file://c:\program files\siber systems\ai roboform\RoboFormComPasswordGenerator.html IE: RoboForm Editor - file://c:\program files\siber systems\ai roboform\RoboFormComEditIdent.html IE: RoboForm Options - file://c:\program files\siber systems\ai roboform\RoboFormComOptions.html IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html IE: Sync RoboForm Data - file://c:\program files\siber systems\ai roboform\RoboFormComSync.html IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {45DB34C3-955C-11D3-ABEF-444553540001} - c:\program files\siber systems\ai roboform\RoboFormComEditIdent.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll Trusted Zone: cinemanow.com Trusted Zone: intuit.com\ttlc Trusted Zone: qflix.com Trusted Zone: roxio.com Trusted Zone: sonic.com\redirect Trusted Zone: sonic.com\redirect2 DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1247772839467 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {8CFCF42C-1C64-47D6-AEEC-F9D001832ED3} - hxxp://xserv.dell.com/DellDriverScanner/DellSystem.CAB DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: avldr - avldr.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll LSA: Authentication Packages = msv1_0 nwprovau mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12 . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\garyrd~1\applic~1\mozilla\firefox\profiles\rf874622.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/search?q= FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p= FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll . ---- FIREFOX POLICIES ---- FF - user.js: google.toolbar.linkdoctor.enabled - false FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01); user_pref(general.useragent.extra.zencast, Creative ZENcast v2.01.01);user_pref(yahoo.ytff.general.dontshowhpoffer, true . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-12-2 64288] R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2011-3-27 26696] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-4-15 239168] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-4-15 338880] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2011-4-15 656320] R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2010-11-10 58472] R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2010-8-13 21488] R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2010-8-13 15856] R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-4-12 13496] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2011-3-27 76296] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2011-3-27 53256] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2011-3-27 22024] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2011-3-27 193800] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2011-3-27 159112] R1 RapportCerberus_25973;RapportCerberus_25973;c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportcerberus\25973\RapportCerberus_25973.sys [2011-4-13 57144] R1 RapportEI;RapportEI;c:\program files\trusteer\rapport\bin\RapportEI.sys [2010-11-10 62568] R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2010-11-10 156776] R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2010-8-13 25584] R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2011-3-27 37896] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2011-3-27 46856] R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\roxio\backontrack\disaster recovery\SaibSVC.exe [2009-6-2 457200] R2 AmFSM;AmFSM;c:\windows\system32\drivers\amm8651.sys [2011-3-27 59080] R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools security\bdt\BDTUpdateService.exe [2011-4-15 247760] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-9-13 54760] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 Panda Software Controller;Panda Software Controller;c:\program files\panda security\panda global protection 2011\PsCtrlS.exe [2011-3-27 173312] R2 PAVFNSVR;Panda Function Service;c:\program files\panda security\panda global protection 2011\PavFnSvr.exe [2011-3-27 202048] R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2011-3-27 163336] R2 PavPrSrv;Panda Process Protection Service;c:\program files\common files\panda security\pavshld\PavPrSrv.exe [2011-3-27 62768] R2 PAVSRV;Panda On-Access Anti-Malware Service;c:\program files\panda security\panda global protection 2011\pavsrvx86.exe [2011-3-27 314176] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2010-8-29 583640] R2 PskSvcRetail;Panda PSK service;c:\program files\panda security\panda global protection 2011\psksvc.exe [2011-3-27 28992] R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2010-11-10 763112] R2 SPDFToolsReadSpool;SolidPDFToolsCreatorReadSpool;c:\windows\installer\MSI72.tmp [2009-8-4 189696] R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] R3 ComFiltr;Panda Anti-Dialer;c:\windows\system32\drivers\COMFiltr.sys [2011-3-27 13880] R3 NETIMFLT01060042;PANDA NDIS IM Filter Miniport v1.6.0.42;c:\windows\system32\drivers\neti1642.sys [2011-3-27 199688] R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\pavsrk.sys --> c:\windows\system32\PavSRK.sys [?] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\pavtpk.sys --> c:\windows\system32\PavTPK.sys [?] S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\common files\roxio shared\12.0\sharedcom\RoxWatch12.exe [2009-7-24 219632] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-6 1753048] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-11 15232] S3 RoxMediaDB12;RoxMediaDB12;c:\program files\common files\roxio shared\12.0\sharedcom\RoxMediaDB12.exe [2009-7-24 1116656] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-4-15 366840] S3 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-4-15 1150936] S3 VF0400Afx;VF0400 Audio FX;c:\windows\system32\drivers\V0400Afx.sys [2010-6-29 142656] S3 VF0400Vfx;VF0400 Video FX;c:\windows\system32\drivers\V0400Vfx.sys [2010-6-29 7424] S3 VF0400Vid;Live! Cam Notebook Pro (VF0400);c:\windows\system32\drivers\V0400Vid.sys [2010-6-29 166720] . =============== File Associations =============== . JSEFile=c:\progra~1\pandas~1\pandag~1\PavScrip.exe "%1" %* VBEFile=c:\progra~1\pandas~1\pandag~1\PavScrip.exe "%1" %* VBSFile=c:\progra~1\pandas~1\pandag~1\PavScrip.exe "%1" %* . =============== Created Last 30 ================ . 2011-04-19 18:05:11 376832 ----a-w- c:\temp\qremove\PSSCAN.DLL 2011-04-19 18:05:11 26624 ----a-w- c:\temp\qremove\PUTIL32.dll 2011-04-19 18:05:11 18432 ----a-w- c:\temp\qremove\PVER32.dll 2011-04-19 18:05:10 843776 ----a-w- c:\temp\qremove\PQREMOVE_PSSCAN.EXE 2011-04-19 18:05:10 33792 ----a-w- c:\temp\qremove\PFILE32.dll 2011-04-19 18:05:10 29696 ----a-w- c:\temp\qremove\PPROCS32.dll 2011-04-19 18:05:10 172032 ----a-w- c:\temp\qremove\PQDLL.dll 2011-04-16 23:02:30 388096 ----a-r- c:\docume~1\garyrd~1\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2011-04-16 23:02:30 -------- d-----w- c:\program files\Trend Micro 2011-04-16 03:56:17 -------- d-----w- c:\windows\New Folder 2011-04-16 03:21:34 -------- d-----w- c:\docume~1\garyrd~1\locals~1\applic~1\Threat Expert 2011-04-15 20:36:47 767952 ----a-w- c:\windows\BDTSupport.dll 2011-04-15 20:36:47 149456 ----a-w- c:\windows\SGDetectionTool.dll 2011-04-15 20:36:46 2000848 ----a-w- c:\windows\PCTBDCore.dll 2011-04-15 20:36:46 1533904 ----a-w- c:\windows\PCTBDRes.dll 2011-04-15 20:34:30 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys 2011-04-15 20:34:30 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys 2011-04-15 20:34:29 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2011-04-15 20:34:19 239168 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2011-04-15 20:34:19 160448 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2011-04-15 20:33:59 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2011-04-15 20:33:43 -------- d-----w- c:\program files\PC Tools Security 2011-04-15 20:33:43 -------- d-----w- c:\docume~1\garyrd~1\applic~1\PC Tools 2011-04-15 20:32:05 -------- d-----w- c:\docume~1\alluse~1\applic~1\PC Tools 2011-04-12 17:50:42 29520 ----a-w- c:\windows\system32\SmartDefragBootTime.exe 2011-04-12 17:50:41 13496 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys 2011-04-07 19:44:52 -------- d-----w- c:\program files\Nova Development 2011-04-07 04:12:25 77824 ----a-w- c:\windows\system32\xvid.ax 2011-04-07 04:12:24 -------- d-----w- c:\program files\Xvid 2011-04-07 03:46:13 -------- d-----w- c:\program files\WebEnhancements 2011-03-31 21:08:28 -------- d-----w- c:\docume~1\garyrd~1\locals~1\applic~1\Wide Angle Software 2011-03-27 15:41:21 13880 ----a-w- c:\windows\system32\drivers\COMFiltr.sys 2011-03-27 15:39:02 -------- d-----w- c:\docume~1\garyrd~1\locals~1\applic~1\Panda Security 2011-03-27 15:36:18 291968 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT 2011-03-27 15:36:12 53256 ----a-w- c:\windows\system32\drivers\dsaflt.sys 2011-03-27 15:36:12 46856 ----a-w- c:\windows\system32\drivers\wnmflt.sys 2011-03-27 15:36:12 193800 ----a-w- c:\windows\system32\drivers\idsflt.sys 2011-03-27 15:34:35 753664 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iKernel.dll 2011-03-27 15:34:35 69714 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\ctor.dll 2011-03-27 15:34:35 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\DotNetInstaller.exe 2011-03-27 15:34:35 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iscript.dll 2011-03-27 15:34:35 184320 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iuser.dll 2011-03-27 15:34:08 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\setup.dll 2011-03-27 15:34:08 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\00\intel32\iGdi.dll 2011-03-27 15:34:05 37896 ----a-w- c:\windows\system32\drivers\ShlDrv51.sys 2011-03-27 15:34:05 163336 ----a-w- c:\windows\system32\drivers\PavProc.sys 2011-03-27 15:34:04 -------- d-----w- c:\program files\common files\Panda Security 2011-03-22 14:01:25 -------- d-----w- C:\3DP 2011-03-21 13:27:09 -------- d-----w- c:\docume~1\alluse~1\applic~1\FreeApp 2011-03-21 13:26:51 -------- d-----w- c:\docume~1\alluse~1\applic~1\IObit . ==================== Find3M ==================== . 2011-04-07 07:59:03 16432 ----a-w- c:\windows\system32\lsdelete.exe 2011-02-04 22:48:32 456192 ----a-w- c:\windows\system32\encdec.dll 2011-02-04 22:48:30 291840 ----a-w- c:\windows\system32\sbe.dll 2011-02-03 02:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-02-03 00:19:39 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll 2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe 2011-01-23 05:04:40 237780 ----a-w- c:\windows\100%_Free_Spades_Toolbar_Uninstaller_9234.exe 2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll . ============= FINISH: 17:30:06.71 ===============