baseline

Logfile of HijackThis v1.99.1
Scan saved at 7:03:28 AM, on 9/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal

Edition\mainserv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Norton SystemWorks\Norton

Utilities\NPROTECT.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Adobe\Photoshop Album Starter

Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software

Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Common Files\Microsoft Shared\Works

Shared\wkcalrem.exe
C:\Program Files\Microtek\ScanWizard

5\ScannerFinder.exe
C:\Program Files\SEC\Natural

Color\NaturalColorLoad.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\UPHClean\uphclean.exe
C:\OPLIMIT\ocrawr32.exe
C:\Program Files\APC\APC PowerChute Personal

Edition\apcsystray.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Norton SystemWorks\Norton

Utilities\SYSDOC32.EXE
C:\Program Files\Norton SystemWorks\Norton

Utilities\WDSCAN.EXE
C:\Program Files\Juno\exec.exe
C:\Program Files\Juno\exec.exe
C:\Program Files\Juno\qsacc\x1exec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis[1]\HijackThis.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet

Explorer,SearchURL = juno.com
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL = juno
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://my.juno.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://my.juno.com/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page = http://juno.com/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL = juno
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://my.juno.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://my.juno.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet

Explorer\Search,Default_Search_URL =

http://www.viplegal.com/search
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant =

http://my.juno.com/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,CustomizeSearch = juno.com
R1 - HKCU\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://my.juno.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://my.juno.com/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Local Page = juno
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Intern

et Settings,ProxyServer = http=127.0.0.1:7900
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Intern

et Settings,ProxyOverride =

64.136.29.30;64.136.21.30;64.136.29.34;searchap.untd.co

m;127.0.0.1;localhost;*microsoft.com;*windowsupdate.co

m;*wustat.windows.com;*.pogo.com;*.worldwinner.com;*te

st-speed.com;liveupdate.symantecliveupdate.com;*symant

ec.com;*.nai.com;*.networkassociates.com;*photosite.com

;*.dir.untd.com;*.prod.untd.com;
R3 - URLSearchHook: URLSearchHook Class -

{37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} -

C:\Program Files\JUSearch\SearchEnh1.dll
O2 - BHO: Yahoo! Toolbar Helper -

{02478D38-C3F9-4EFB-9B51-7695ECA05670} -

C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Popup-Blocker Class -

{52706EF7-D7A2-49AD-A615-E903858CF284} -

C:\Program Files\Juno\qsacc\X1IEBHO.dll
O2 - BHO: (no name) -

{53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Yahoo! IE Services Button -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

C:\Program Files\Yahoo!\common\yiesrvc.dll
O2 - BHO: PCTools Site Guard -

{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} -

C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\program files\google\googletoolbar2.dll
O2 - BHO: PCTools Browser Monitor -

{B56A7D7D-6927-48C8-A975-17DF180C71AC} -

C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O2 - BHO: (no name) -

{BB508A9B-9C2F-45A5-8200-C765CBCEE5C2} - (no file)
O3 - Toolbar: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google -

{2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\program files\google\googletoolbar2.dll
O3 - Toolbar: JunoBar -

{5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} -

C:\Program Files\Juno\Toolbar.dll
O4 - HKLM\..\Run: [PCDRealtime]

C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [Printing Storage]

C:\WINDOWS\System32\print.exe
O4 - HKLM\..\Run: [WinLsass]

C:\WINDOWS\System32\finger.exe
O4 - HKLM\..\Run: [USSShReg]

C:\PROGRA~1\ULEADS~1\ULEADP~1.2\SSaver\Ussshreg

.exe /r
O4 - HKLM\..\Run: [AVG7_CC]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader]

"C:\Program Files\Adobe\Photoshop Album Starter

Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program

Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HP Software Update] C:\Program

Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program

Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program

Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program

Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [spc_w] "C:\Program

Files\JUSearch\juspc.exe" -w
O4 - HKCU\..\RunOnce: [untd_recovery] "C:\Program

Files\Juno\qsacc\x1exec.exe"
O4 - Startup: OCRAWARE.lnk =

C:\OPLIMIT\OCRAWARE.EXE
O4 - Global Startup: Kodak EasyShare

software.lnk.disabled
O4 - Global Startup: Microtek Scanner Finder.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program

Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: OCRAWARE.lnk =

C:\OPLIMIT\OCRAWARE.EXE
O4 - Global Startup: Microsoft Works Calendar

Reminders.lnk = C:\Program Files\Common Files\Microsoft

Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Album Fast Start.lnk = C:\Program

Files\Ulead Systems\Ulead PhotoImpact

4.2\ABMTSR.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk =

C:\Program Files\Microtek\ScanWizard

5\ScannerFinder.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment

Check.lnk =

C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\E_SR

CV03.EXE
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk =

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk =

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk

= C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Download with &DAP -

C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search -

res://c:\program

files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -

res://c:\program

files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search -

file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links -

res://c:\program

files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -

res://c:\program

files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full

Quality - res://C:\Program Files\Juno\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full

Quality - res://C:\Program Files\Juno\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages -

res://c:\program

files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English

- res://c:\program

files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary -

file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps -

file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS -

file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Spyware Doctor -

{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -

C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Yahoo! Services -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

C:\Program Files\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet

Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet

Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpg: C:\Program Files\Internet

Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: Yahoo! Literati -

http://download.games.yahoo.com/games/clients/y/tt3_x.c

ab
O16 - DPF:

{17492023-C23A-453E-A040-C7C580BBF700} (Windows

Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF:

{2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo!

Audio Conferencing) -

http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/ya

cscom.cab
O16 - DPF:

{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}

(YInstStarter Class) -

http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yin

st20040510.cab
O16 - DPF:

{7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo!

Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF:

{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}

(ActiveScan Installer Class) -

http://acs.pandasoftware.com/activescan/as5free/asinst.c

ab
O16 - DPF:

{B942A249-D1E7-4C11-98AE-FCB76B08747F}

(RealArcadeRdxIE Class) -

http://games-dl.real.com/gameconsole/Bundler/CAB/Real

ArcadeRdxIE.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{30FCE126-7611-4

E1A-A155-00B7C3194DDD}: NameServer =

64.136.20.121 64.136.28.121
O18 - Protocol: msnim -

{828030A1-22C1-4009-854F-8E305202313F} -

"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ComPlusSetup -

C:\WINDOWS\System32\catsrvut.dll
O20 - Winlogon Notify: WgaLogon -

C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier -

C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: .NET Framework Service (.NET

Connection Service) - Unknown owner -

C:\WINDOWS\svchost.exe (file missing)
O23 - Service: APC UPS Service - American Power

Conversion Corporation - C:\Program Files\APC\APC

PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) -

GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) -

GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision -

C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company -

C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: NetDDEfipx - Unknown owner -

C:\WINDOWS\system32\meps.exe (file missing)
O23 - Service: Norton Unerase Protection

(NProtectService) - Symantec Corporation - C:\Program

Files\Norton SystemWorks\Norton

Utilities\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP -

C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC

Tools Research Pty Ltd - C:\Program Files\Spyware

Doctor\sdhelp.exe
O23 - Service: Speed Disk service - Symantec

Corporation -

C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\Security Center\SymWSC.exe
O23 - Service: wcdev - Unknown owner -

C:\WINDOWS\System32\wcdev.exe (file missing)