DDS (Ver_09-03-16.01) - NTFSx86
Run by HP_Administrator at 14:24:48.92 on Fri 04/17/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.300 [GMT -5:00]
AV: Norton Internet Security *On-access scanning enabled* (Outdated)
FW: Norton Internet Security *disabled*
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\system32\MAFWTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Documents and Settings\HP_Administrator\Application Data\pidle\pidle.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
svchost.exe C:\WINDOWS\TEMP\VRT23.tmp
C:\WINDOWS\System32\reader_s.exe
svchost.exe
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\427470414.exe
C:\WINDOWS\TEMP\792470414.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\program files\internet explorer\iexplore.exe
C:\Documents and Settings\HP_Administrator\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\ntos.exe,
BHO: {32b944ef-d821-44a3-9f3c-e8fa8b6c059c} - c:\windows\system32\vukajuse.dll
BHO: c:\windows\system32\yaubfh983ind.dll: {a5af42a3-94f3-42bd-f634-0604832c897d} - c:\windows\system32\yaubfh983ind.dll
BHO: c:\windows\system32\jh9fgo4ksdgf.dll: {d7bf4552-94f1-42bd-f434-3604812c856d} - c:\windows\system32\jh9fgo4ksdgf.dll
TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [klz08fcwlj5t5f] c:\docume~1\hp_adm~1\locals~1\temp\crasos.exe
uRun: [Windows Resurections] c:\docume~1\hp_adm~1\locals~1\temp\f8pu104.exe
uRun: [Diagnostic Manager] c:\docume~1\hp_adm~1\locals~1\temp\427470414.exe
uRun: [pidle] "c:\documents and settings\hp_administrator\application data\pidle\pidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
uRun: [<NO NAME>] c:\docume~1\hp_adm~1\locals~1\temp\f8pu104.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE
mRun: [DISCover] c:\program files\disc\DISCover.exe
mRun: [DiscUpdateManager] c:\program files\disc\DiscUpdateMgr.exe
mRun: [PCDrProfiler]
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [URLLSTCK.exe] c:\program files\norton internet security\UrlLstCk.exe
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [HP Software Update] c:\program files\hp\hp software update\HPwuSchd2.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNOTIFY.EXE
mRun: [H2O] c:\program files\syncrosoft\pos\h2o\cledx.exe
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [MAFWTaskbarApp] c:\windows\system32\MAFWTray.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [warapozewu] Rundll32.exe "c:\windows\system32\nupakeyo.dll",s
mRun: [CPM771682a8] Rundll32.exe "c:\windows\system32\soyafogi.dll",a
mRun: [reader_s] c:\windows\system32\reader_s.exe
dRun: [<NO NAME>] c:\windows\temp\n55fvdwp.exe
dRun: [Windows Resurections] c:\windows\temp\n55fvdwp.exe
dRun: [Diagnostic Manager] c:\windows\temp\792470414.exe
dRun: [reader_s] c:\documents and settings\hp_administrator\reader_s.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
dPolicies-explorer: NoFolderOptions = 1 (0x1)
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_05\bin\npjpi150_05.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
Trusted Zone: hotmail.com\www
Trusted Zone: live.com\login
Trusted Zone: msn.com\autoupdate
Trusted Zone: myspace.com\home
Trusted Zone: myspace.com\www
Trusted Zone: trymedia.com
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\soyafogi.dll
STS: c:\windows\system32\sdfgerfgf3f.dll: {e2ba40a2-74f3-42bd-f434-2604812c8953} - c:\windows\system32\sdfgerfgf3f.dll
STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\soyafogi.dll
STS: c:\windows\system32\yaubfh983ind.dll: {a5af42a3-94f3-42bd-f634-0604832c897d} - c:\windows\system32\yaubfh983ind.dll
STS: c:\windows\system32\jh9fgo4ksdgf.dll: {d7bf4552-94f1-42bd-f434-3604812c856d} - c:\windows\system32\jh9fgo4ksdgf.dll
LSA: Notification Packages = scecli c:\windows\system32\zatafigi.dll monb320.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\s60mcvsu.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPJPI150_05.dll
FF - plugin: c:\program files\java\jre1.5.0_05\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
============= SERVICES / DRIVERS ===============
R1 SAVRTPEL;SAVRTPEL;c:\program files\norton internet security\norton antivirus\Savrtpel.sys [2005-2-4 53896]
R2 BRC_Services;BlackHole Remote Control Services;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 34304]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2005-3-4 185968]
R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2005-3-4 239216]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2005-3-4 161392]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2007-4-8 33792]
S1 tsn819b;tsn819b;c:\windows\system32\drivers\tsn819b.sys [2009-4-17 17376]
S2 ΞΆΘν2007;ΞΆΘν;c:\windows\inter.exe [2004-5-19 388096]
S2 navapsvc;Norton AntiVirus Auto-Protect Service;c:\program files\norton internet security\norton antivirus\navapsvc.exe [2005-3-24 127088]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2005-3-4 83568]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20060426.019\NAVENG.Sys [2006-4-26 77864]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20060426.019\NavEx15.Sys [2006-4-26 799208]
S3 SAVRT;SAVRT;c:\program files\norton internet security\norton antivirus\savrt.sys [2005-2-4 324232]
S3 SAVScan;SAVScan;c:\program files\norton internet security\norton antivirus\SAVScan.exe [2005-2-17 198368]
=============== Created Last 30 ================
2009-04-17 14:12 408,576 a------- c:\windows\system32\CF30905.exe
2009-04-17 14:12 <DIR> --d----- C:\ComboFix
2009-04-17 14:12 408,576 a------- c:\windows\system32\CF30827.exe
2009-04-17 13:54 408,576 a------- c:\windows\system32\CF27388.exe
2009-04-17 13:45 36,352 a------- c:\windows\system32\reader_s.exe
2009-04-17 13:45 36,352 a------- c:\documents and settings\hp_administrator\reader_s.exe
2009-04-17 13:45 0 a------- c:\windows\system32\29.tmp
2009-04-17 13:45 17,376 a------- c:\windows\system32\drivers\tsn819b.sys
2009-04-17 13:44 84 a------- c:\windows\system32\24.tmp
2009-04-17 12:14 2,098 ---sh--- c:\windows\system32\bewiseru.exe
2009-04-17 03:36 408,576 a------- c:\windows\system32\CF4513.exe
2009-04-17 02:53 408,576 a------- c:\windows\system32\CF27282.exe
2009-04-17 02:12 38 a------- C:\1A.tmp
2009-04-17 01:42 <DIR> --d----- c:\windows\ERUNT
2009-04-17 01:21 0 a------- C:\7.tmp
2009-04-17 01:21 0 a------- C:\6.tmp
2009-04-17 01:21 38 a------- C:\5.tmp
2009-04-17 01:21 52,736 a------- C:\4.tmp
2009-04-17 01:15 <DIR> --d----- C:\SDFix
2009-04-16 22:24 0 a------- C:\F.tmp
2009-04-16 22:24 0 a------- C:\E.tmp
2009-04-16 22:24 0 a------- C:\D.tmp
2009-04-16 22:24 0 a------- C:\C.tmp
2009-04-16 22:24 0 a------- C:\B.tmp
2009-04-16 22:23 38 a------- C:\9.tmp
2009-04-16 22:23 52,736 a------- C:\8.tmp
2009-04-16 18:38 155 a------- c:\windows\system32\SelfDel.bat
2009-04-16 18:38 106,496 a------- c:\windows\system32\ftp_non_crp.exe
2009-04-16 18:23 15,000 a------- c:\windows\system32\jh9fgo4ksdgf.dll
2009-04-16 18:23 57,856 a------- c:\windows\system32\ak1.exe
2009-04-16 18:22 <DIR> --d----- c:\docume~1\hp_adm~1\applic~1\pidle
2009-04-16 18:13 102,126 a------- c:\windows\system32\drivers\a6a28ef1.sys
2009-04-16 18:13 55,296 a------- C:\ptrf.exe
2009-04-16 18:13 30,208 a------- C:\cpjopaid.exe
2009-04-16 18:13 15,000 a------- c:\windows\system32\sdfgerfgf3f.dll
2009-04-16 18:13 68,096 a------- C:\tqpxlyy.exe
==================== Find3M ====================
2009-04-17 02:12 15,000 a------- c:\windows\system32\yaubfh983ind.dll
2009-04-16 18:13 182,912 a------- c:\windows\system32\drivers\ndis.sys
2009-04-16 18:13 182,912 a------- c:\windows\system32\dllcache\ndis.sys
2009-04-16 18:13 34,304 a------- c:\windows\system32\svchost.exe
2009-04-16 18:13 14,336 a------- c:\windows\system32\dllcache\svchost.exe
2009-04-16 18:13 87,552 a--sh--- c:\windows\system32\soyafogi.dll
2009-04-16 18:13 79,872 a--sh--- c:\windows\system32\dafazudu.dll
2009-04-12 13:58 591,360 a------- c:\windows\inter.DLL
2006-07-06 19:54 772 a------- c:\docume~1\hp_adm~1\applic~1\wklnhst.dat
============= FINISH: 14:25:09.56 ===============