Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 10:19:41 AM, on 6/22/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Microsoft Hardware\Mouse\point32.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\SYSTEM32\WіnSxS\w?auclt.exe C:\Documents and Settings\Ron\Desktop\Unused Desktop\HiJackThis_v2.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/customize/sbcydsl/defaults/su/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1F13BF38-A4F2-4BD9-9108-8994C2125879} - C:\WINDOWS\System32\ddayy.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\System32\tsyqkiot.dll O2 - BHO: (no name) - {64184DA2-D31D-8099-1A61-898DB02482C2} - C:\WINDOWS\System32\lpsigf.dll O2 - BHO: CFG32S - {7564B020-44E8-4c9b-A887-C6EC41AC67DA} - C:\WINDOWS\cfg32r.dll (file missing) O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xmlhelper.dll (file missing) O2 - BHO: (no name) - {8E97A2C5-CF0C-4FA9-8DBE-95CD349952CF} - C:\Program Files\Windows Media Player\holenusa.dll (file missing) O2 - BHO: (no name) - {A7F247C8-2B06-4225-9878-277CC47466F3} - \ O2 - BHO: Scaggy Insert - {C68AE9C0-0909-4DDC-B661-C1AFB9F59898} - C:\WINDOWS\cfg32o.dll (file missing) O2 - BHO: (no name) - {F4002052-AB29-4B33-8C8D-0E99084564EC} - C:\WINDOWS\System32\rqrrono.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [j86759] C:\WINDOWS\j86759 O4 - HKLM\..\Run: [abynipkx.exe] C:\Documents and Settings\All Users\Application Data\abynipkx.exe O4 - HKLM\..\Run: [Configuration Manager] C:\WINDOWS\cfg32.exe O4 - HKLM\..\Run: [SC2] C:\WINDOWS\System32\scchk32.exe O4 - HKLM\..\Run: [SecureWeb] C:\WINDOWS\System32\6h4BecV3.exe O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\System32\eurwdloa.dll",realset O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt O4 - HKLM\..\RunServices: [IESet] IExplorer.dll .dbt O4 - HKLM\..\RunOnce: [wbun] C:\WINDOWS\wbun.exe -q O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~2.EXE" -quiet O4 - HKCU\..\Run: [slide.exe] c:\program files\slide\slide.exe O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Ron\MYDOCU~1\SCURIT~1\wowexec.exe" -vt ndrv O4 - HKCU\..\Run: [Huphuxcw] C:\WINDOWS\SYSTEM32\W?nSxS\w?auclt.exe O4 - HKCU\..\Run: [IESet] IExplorer.dll .dbt O4 - HKLM\..\Policies\Explorer\Run: [svchost.exe] C:\WINDOWS\svchost.exe O4 - HKUS\S-1-5-18\..\Run: [IESet] IExplorer.dll .dbt (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [IESet] IExplorer.dll .dbt (User 'Default user') O4 - Startup: TA_Start.lnk = C:\Documents and Settings\Ron\Desktop\TICHD001.exe O4 - Startup: Think-Adz.lnk = C:\WINDOWS\SYSTEM32\kwinondt.exe O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O15 - Trusted Zone: *.adgate.info O15 - Trusted Zone: *.elitemediagroup.net O15 - Trusted Zone: *.media-motor.com O15 - Trusted Zone: *.media-motor.net O15 - Trusted Zone: *.mediatickets.net O15 - Trusted Zone: *.snipernet.biz O15 - Trusted Zone: *.snipernet.us O15 - Trusted Zone: *.snipernet.us (HKLM) O16 - DPF: Video Poker - http://download2.games.yahoo.com/games/clients/y/vpt0_x.cab O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: Yahoo! Poker - http://download2.games.yahoo.com/games/clients/y/pt3_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1107183684510 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} - ms-its:mhtml:file://c:\\nores.mht!http://adxtend.net/code/chm/xpre.chm::/xpreload.ocx O20 - AppInit_DLLs: O20 - Winlogon Notify: ddayy - C:\WINDOWS\System32\ddayy.dll (file missing) O20 - Winlogon Notify: rqrrono - rqrrono.dll (file missing) O20 - Winlogon Notify: winkzs32 - winkzs32.dll (file missing) O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe -- End of file - 8370 bytes