lacypu
Topic Starter
Today daughter used my PC and afterwards was getting an error my e:/ drive was corrupted and needed to run check disk,, I am a tech support rep and never seen this type of error, seemed out of place. Ran Avira scan and came up with several instances of JAVA/Agent.F.1 virus and it quarantined it. Wanted to show some log files to ensure it is gone.
Thanks in advance
- lacy
DDS Follow:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/7/2010 1:43:41 PM
System Uptime: 5/20/2010 8:15:15 PM (198 hours ago)
Motherboard: First International Computer, Inc. | | K7MNF-64
Processor: AMD Sempron™ 3000+ | Socket A | 1991/166mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 279 GiB total, 233.912 GiB free.
D: is CDROM (UDF)
E: is FIXED (NTFS) - 72 GiB total, 16.315 GiB free.
F: is FIXED (FAT32) - 5 GiB total, 5.091 GiB free.
G: is Removable
H: is Removable
I: is Removable
J: is Removable
==== Disabled Device Manager Items =============
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_10DE&DEV_0084&SUBSYS_927A1509&REV_A1\3&13C0B0C5&0&09
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_10DE&DEV_0084&SUBSYS_927A1509&REV_A1\3&13C0B0C5&0&09
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Other PCI Bridge Device
Device ID: PCI\VEN_10DE&DEV_008C&SUBSYS_927A1509&REV_A3\3&13C0B0C5&0&20
Manufacturer:
Name: Other PCI Bridge Device
PNP Device ID: PCI\VEN_10DE&DEV_008C&SUBSYS_927A1509&REV_A3\3&13C0B0C5&0&20
Service:
Class GUID:
Description:
Device ID: DISPLAY\NTATIVRV01\5&2EE438DA&0&80000008&01&00
Manufacturer:
Name:
PNP Device ID: DISPLAY\NTATIVRV01\5&2EE438DA&0&80000008&01&00
Service:
Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}
Description: Officejet 6500 E709n
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Officejet 6500 E709n
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
PNP Device ID: ROOT\NET\0000
Service: vpnva
Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}
Description: Officejet 6500 E709n
Device ID: ROOT\PRINTER\0000
Manufacturer: HP
Name: Officejet 6500 E709n
PNP Device ID: ROOT\PRINTER\0000
Service:
==== System Restore Points ===================
RP159: 2/27/2010 11:51:58 PM - Removed Ask Toolbar.
RP160: 2/28/2010 1:21:15 AM - Installed OpenOffice.org 3.2
RP161: 3/1/2010 1:54:56 AM - System Checkpoint
RP162: 3/2/2010 2:54:56 AM - System Checkpoint
RP163: 3/3/2010 3:54:56 AM - System Checkpoint
RP164: 3/4/2010 4:30:01 AM - System Checkpoint
RP165: 3/5/2010 5:30:01 AM - System Checkpoint
RP166: 3/6/2010 6:30:01 AM - System Checkpoint
RP167: 3/7/2010 7:30:03 AM - System Checkpoint
RP168: 3/8/2010 2:11:55 PM - System Checkpoint
RP169: 3/9/2010 2:29:53 PM - System Checkpoint
RP170: 3/10/2010 8:14:11 AM - Removed iTunes
RP171: 3/10/2010 4:24:26 PM - Software Distribution Service 3.0
RP172: 3/11/2010 4:29:53 PM - System Checkpoint
RP173: 3/12/2010 5:29:54 PM - System Checkpoint
RP174: 3/13/2010 6:52:12 PM - Installed iTunes
RP175: 3/14/2010 8:43:14 PM - System Checkpoint
RP176: 3/15/2010 9:43:14 PM - System Checkpoint
RP177: 3/16/2010 10:43:14 PM - System Checkpoint
RP178: 3/17/2010 11:43:14 PM - System Checkpoint
RP179: 3/19/2010 12:43:14 AM - System Checkpoint
RP180: 3/20/2010 1:43:14 AM - System Checkpoint
RP181: 3/21/2010 2:43:14 AM - System Checkpoint
RP182: 3/22/2010 3:43:14 AM - System Checkpoint
RP183: 3/23/2010 3:44:54 AM - System Checkpoint
RP184: 3/24/2010 4:44:53 AM - System Checkpoint
RP185: 3/25/2010 5:44:54 AM - System Checkpoint
RP186: 3/26/2010 6:44:53 AM - System Checkpoint
RP187: 3/27/2010 7:44:53 AM - System Checkpoint
RP188: 3/28/2010 8:44:53 AM - System Checkpoint
RP189: 3/29/2010 1:43:56 PM - System Checkpoint
RP190: 3/30/2010 2:43:19 PM - System Checkpoint
RP191: 3/31/2010 3:00:14 AM - Software Distribution Service 3.0
RP192: 4/1/2010 3:21:59 AM - System Checkpoint
RP193: 4/2/2010 4:21:57 AM - System Checkpoint
RP194: 4/3/2010 5:50:52 AM - System Checkpoint
RP195: 4/4/2010 6:21:57 AM - System Checkpoint
RP196: 4/5/2010 7:21:59 AM - System Checkpoint
RP197: 4/6/2010 9:34:52 AM - System Checkpoint
RP198: 4/7/2010 10:05:16 AM - System Checkpoint
RP199: 4/8/2010 11:05:16 AM - System Checkpoint
RP200: 4/9/2010 12:05:16 PM - System Checkpoint
RP201: 4/10/2010 12:24:08 PM - System Checkpoint
RP202: 4/11/2010 3:00:15 AM - Software Distribution Service 3.0
RP203: 4/12/2010 3:05:16 AM - System Checkpoint
RP204: 4/13/2010 3:53:56 AM - System Checkpoint
RP205: 4/14/2010 4:05:18 AM - System Checkpoint
RP206: 4/15/2010 3:00:16 AM - Software Distribution Service 3.0
RP207: 4/16/2010 3:24:22 AM - System Checkpoint
RP208: 4/17/2010 4:25:26 AM - System Checkpoint
RP209: 4/18/2010 4:56:29 AM - System Checkpoint
RP210: 4/19/2010 5:56:29 AM - System Checkpoint
RP211: 4/20/2010 6:56:31 AM - System Checkpoint
RP212: 4/21/2010 11:37:44 AM - System Checkpoint
RP213: 4/22/2010 11:50:48 AM - System Checkpoint
RP214: 4/23/2010 11:56:32 AM - System Checkpoint
RP215: 4/24/2010 12:32:26 PM - System Checkpoint
RP216: 4/24/2010 3:18:14 PM - Installed Sonic CinePlayer DVD Pack
RP217: 4/25/2010 5:31:12 PM - System Checkpoint
RP218: 4/26/2010 5:56:34 PM - System Checkpoint
RP219: 4/27/2010 7:15:56 PM - System Checkpoint
RP220: 4/28/2010 7:56:34 PM - System Checkpoint
RP221: 4/29/2010 8:11:37 PM - System Checkpoint
RP222: 4/30/2010 11:32:32 PM - System Checkpoint
RP223: 5/1/2010 11:56:34 PM - System Checkpoint
RP224: 5/3/2010 12:51:10 AM - System Checkpoint
RP225: 5/4/2010 2:39:51 AM - System Checkpoint
RP226: 5/5/2010 2:53:50 AM - System Checkpoint
RP227: 5/6/2010 3:53:48 AM - System Checkpoint
RP228: 5/7/2010 4:53:48 AM - System Checkpoint
RP229: 5/8/2010 5:53:49 AM - System Checkpoint
RP230: 5/9/2010 6:53:49 AM - System Checkpoint
RP231: 5/10/2010 11:20:29 AM - System Checkpoint
RP232: 5/11/2010 12:03:41 PM - System Checkpoint
RP233: 5/12/2010 3:00:14 AM - Software Distribution Service 3.0
RP234: 5/13/2010 3:31:24 AM - System Checkpoint
RP235: 5/14/2010 3:54:58 AM - System Checkpoint
RP236: 5/15/2010 4:49:40 AM - System Checkpoint
RP237: 5/16/2010 4:53:52 AM - System Checkpoint
RP238: 5/17/2010 5:53:52 AM - System Checkpoint
RP239: 5/18/2010 6:53:53 AM - System Checkpoint
RP240: 5/18/2010 11:06:25 PM - Installed Windows XP KB942288-v3.
RP241: 5/19/2010 8:16:39 AM - Installed DirectX
RP242: 5/19/2010 7:20:26 PM - Software Distribution Service 3.0
RP243: 5/20/2010 8:50:57 PM - System Checkpoint
RP244: 5/21/2010 9:20:17 PM - System Checkpoint
RP245: 5/22/2010 10:20:15 PM - System Checkpoint
RP246: 5/23/2010 11:20:15 PM - System Checkpoint
RP247: 5/25/2010 12:47:17 AM - System Checkpoint
RP248: 5/26/2010 2:01:32 AM - System Checkpoint
RP249: 5/26/2010 3:00:16 AM - Software Distribution Service 3.0
RP250: 5/27/2010 3:20:20 AM - System Checkpoint
RP251: 5/28/2010 4:20:21 AM - System Checkpoint
==== Installed Programs ======================
32 Bit HP CIO Components Installer
6500_E709_eDocs
6500_E709_Help
6500_E709n
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2
Adobe Shockwave Player 11.5
Akamai NetSession Interface
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Autodesk Design Review 2010
Autodesk Inventor 2010
Autodesk Inventor 2010 English Language Pack
Autodesk Inventor Content Center Libraries 2010 (Desktop Content)
Autodesk Inventor Professional 2010
Avira AntiVir Personal - Free Antivirus
Bonjour
bpd_scan
BPDSoftware
BPDSoftware_Ini
BufferChm
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center HydraVision Full
Catalyst Control Center Localization All
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Cisco AnyConnect VPN Client
Customer Center pin101
D-Link DWA-125
Destination Component
DeviceDiscovery
DocMgr
DocProc
Fax
Google Chrome
Google Earth Plug-in
Google Update Helper
GPBaseService2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 12.0
HP Document Manager 2.0
HP Imaging Device Functions 12.0
HP Officejet 6500 E709 Series
HP Smart Web Printing 4.60
HP Solution Center 13.0
HP Update
HPProductAssistant
iTunes
J Walk Windows ActiveX Client
Java 2 Runtime Environment, SE v1.4.2_19
Java Auto Updater
Java™ 6 Update 18
LDraw
LDraw Parts Library 2010-01
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft WSE 3.0 Runtime
MobileMe Control Panel
Mozilla Firefox (3.6.3)
MSVCSetup
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Network
NVIDIA Drivers
OCR Software by I.R.I.S. 12.0
OpenOffice.org 3.2
POV-Ray for Windows v3.1
POV-Ray for Windows v3.5
ProductContext
QuickTime
Safari
Scan
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Skins
SmartWebPrinting
Soft Data Fax Modem with SmartCP
SolutionCenter
Sonic CinePlayer DVD Pack
Spybot - Search & Destroy
Status
Toolbox
TrayApp
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VBA (2627.01)
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows XP Service Pack 3
==== Event Viewer Messages From Past Week ========
5/28/2010 9:44:45 AM, error: PlugPlayManager [12] - The device 'HDS728080PLAT20' (IDE\DiskHDS728080PLAT20_________________________PF2OA21B\5&35ad820c&0&0.1.0) disappeared from the system without first being prepared for removal.
5/28/2010 9:44:45 AM, error: atapi [25] - The driver has detected a device with old or out-of-date firmware. The device will not be used.
5/28/2010 4:59:30 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume E:.
5/25/2010 1:20:12 AM, error: atapi [5] - A parity error was detected on \Device\Ide\IdePort0.
5/24/2010 9:54:02 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.
==== End Of File ===========================
DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 2:54:51.37 on Sat 05/29/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.368 [GMT -5:00]
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\D-Link\DWA-125 revA\ANIWConnService.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\D-Link\DWA-125 revA\AirGCFG.exe
C:\Program Files\D-Link\DWA-125 revA\WZCSLDR2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\Documents and Settings\Lacy Pugh\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lacy Pugh\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lacy Pugh\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lacy Pugh\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lacy Pugh\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Lacy Pugh\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://atom.x25.net/kbase2/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\MSMSGS.EXE" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\lacy pugh\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [D-Link D-Link DWA-125] c:\program files\d-link\dwa-125 reva\AirGCFG.exe
mRun: [WZCSLDR2] c:\program files\d-link\dwa-125 reva\WZCSLDR2.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRunOnce: [Malwarebytes' Anti-Malware] c:\documents and settings\lacy pugh\desktop\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\lacypu~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sonicc~1.lnk - c:\program files\common files\sonic shared\CineTray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
DPF: {556F788E-BDE9-4DE9-8BEA-CADCF4B531C9} - hxxp://endeavor.czncorp.com/JWALK41/JWalkX/jwalk41.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265582769214
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
Notify: AtiExtEvent - Ati2evxx.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\lacypu~1\applic~1\mozilla\firefox\profiles\bjluyprd.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\lacy pugh\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-2-20 11608]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2003-3-31 14336]
R2 ANPD;ANPD Service;c:\windows\system32\ANPD.SYS [2010-2-26 29411]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-2-20 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-2-20 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-2-20 56816]
R2 D_Link_DWA-125_WPS;D_Link_DWA-125_WPS Service;c:\program files\d-link\dwa-125 reva\ANIWConnService.exe [2010-2-26 40960]
R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\cisco\cisco anyconnect vpn client\vpnagent.exe [2009-12-17 497856]
R3 rt2870;D-Link dnetr28u USB Extensible Wireless LAN Card Driver;c:\windows\system32\drivers\Drt2870.sys [2010-2-26 779136]
S2 D_Link_DWA-125;D_Link_DWA-125 Service;c:\program files\d-link\dwa-125 reva\ANIWZCSdS.exe [2010-2-26 126976]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-24 136176]
=============== Created Last 30 ================
2010-05-29 07:53:15 0 d—–w- c:\docume~1\lacypu~1\applic~1\Malwarebytes
2010-05-29 07:53:06 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-29 07:53:04 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-05-29 07:53:03 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-05-22 04:57:17 0 d—–w- c:\docume~1\lacypu~1\applic~1\W Photo Studio Viewer
2010-05-19 13:27:15 0 d—–w- c:\program files\common files\Macrovision Shared
2010-05-19 13:17:41 0 d—–w- c:\program files\Microsoft WSE
2010-05-19 13:16:59 462864 —-a-w- c:\windows\system32\d3dx10_37.dll
2010-05-19 13:16:59 1420824 —-a-w- c:\windows\system32\D3DCompiler_37.dll
2010-05-19 13:16:54 3786760 —-a-w- c:\windows\system32\D3DX9_37.dll
2010-05-19 13:15:25 0 d—–w- c:\program files\common files\Autodesk Shared
2010-05-19 13:15:25 0 d—–w- c:\program files\Autodesk
2010-05-19 03:45:12 0 dc—-w- C:\Autodesk
2010-05-19 00:08:00 0 d—–w- c:\program files\common files\Akamai
2010-05-17 22:12:59 0 d—–w- c:\docume~1\lacypu~1\applic~1\uTorrent
2010-05-15 03:54:28 0 d—–w- c:\docume~1\alluse~1\applic~1\CA
2010-05-03 05:05:56 0 d—–w- c:\program files\POV-Ray for Windows v3.5
2010-05-03 05:04:35 0 d—–w- c:\program files\POV-Ray for Windows v3.1
2010-05-03 05:04:25 270848 —-a-w- c:\windows\UNWISE32.EXE
2010-05-03 05:03:17 720896 —-a-w- c:\windows\iun6002.exe
2010-05-03 04:56:17 0 d—–w- C:\LDraw
==================== Find3M ====================
2010-04-08 18:20:02 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-04-08 18:20:02 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-03-28 05:06:10 23113 —-a-w- c:\windows\hpqins15.dat
2010-03-11 12:38:54 832512 —-a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38:52 78336 ——w- c:\windows\system32\ieencode.dll
2010-03-11 12:38:51 17408 ——w- c:\windows\system32\corpol.dll
2010-03-09 11:09:18 430080 —-a-w- c:\windows\system32\vbscript.dll
============= FINISH: 2:55:34.42 ===============
