Logfile of HijackThis v1.99.1 Scan saved at 11:15:50 AM, on 7/17/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe C:\Program Files\One-VA VPN Client\cvpnd.exe C:\WINDOWS\system32\gearsec.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Dantz\Retrospect\retrorun.exe C:\Program Files\Network Associates\VirusScan\VsStat.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\yditsvc.exe C:\Program Files\Network Associates\VirusScan\Vshwin32.exe C:\Program Files\Network Associates\VirusScan\Avconsol.exe C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe C:\WINDOWS\Explorer.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\System32\S3apphk.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe C:\WINDOWS\System32\RUNDLL32.exe C:\WINDOWS\System32\jnbara.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\Cas\Client\casclient.exe C:\WINDOWS\DvzCommon\DvzMsgr.exe C:\Program Files\hp center\137903\Shadow\ShadowBar.exe C:\Program Files\hp center\137903\Program\BackWeb-137903.exe C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe C:\Palm\HOTSYNC.EXE C:\Program Files\ewido\security suite\ewidoctrl.exe c:\windows\system32\rtxuee.exe C:\Hijack this virus scanner\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us5.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us5.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us5.hpwis.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file) R3 - URLSearchHook: (no name) - _{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file) R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O1 - Hosts: 66.180.173.39 www.google.ae O1 - Hosts: 66.180.173.39 www.google.am O1 - Hosts: 66.180.173.39 www.google.as O1 - Hosts: 66.180.173.39 www.google.at O1 - Hosts: 66.180.173.39 www.google.az O1 - Hosts: 66.180.173.39 www.google.be O1 - Hosts: 66.180.173.39 www.google.bi O1 - Hosts: 66.180.173.39 www.google.ca O1 - Hosts: 66.180.173.39 www.google.cd O1 - Hosts: 66.180.173.39 www.google.cg O1 - Hosts: 66.180.173.39 www.google.ch O1 - Hosts: 66.180.173.39 www.google.ci O1 - Hosts: 66.180.173.39 www.google.cl O1 - Hosts: 66.180.173.39 www.google.co.cr O1 - Hosts: 66.180.173.39 www.google.co.hu O1 - Hosts: 66.180.173.39 www.google.co.il O1 - Hosts: 66.180.173.39 www.google.co.in O1 - Hosts: 66.180.173.39 www.google.co.je O1 - Hosts: 66.180.173.39 www.google.co.jp O1 - Hosts: 66.180.173.39 www.google.co.ke O1 - Hosts: 66.180.173.39 www.google.co.kr O1 - Hosts: 66.180.173.39 www.google.co.ls O1 - Hosts: 66.180.173.39 www.google.co.nz O1 - Hosts: 66.180.173.39 www.google.co.th O1 - Hosts: 66.180.173.39 www.google.co.ug O1 - Hosts: 66.180.173.39 www.google.co.uk O1 - Hosts: 66.180.173.39 www.google.co.ve O1 - Hosts: 66.180.173.39 www.google.com O1 - Hosts: 66.180.173.39 www.google.com.ag O1 - Hosts: 66.180.173.39 www.google.com.ar O1 - Hosts: 66.180.173.39 www.google.com.au O1 - Hosts: 66.180.173.39 www.google.com.br O1 - Hosts: 66.180.173.39 www.google.com.co O1 - Hosts: 66.180.173.39 www.google.com.cu O1 - Hosts: 66.180.173.39 www.google.com.do O1 - Hosts: 66.180.173.39 www.google.com.ec O1 - Hosts: 66.180.173.39 www.google.com.fj O1 - Hosts: 66.180.173.39 www.google.com.gi O1 - Hosts: 66.180.173.39 www.google.com.gr O1 - Hosts: 66.180.173.39 www.google.com.gt O1 - Hosts: 66.180.173.39 www.google.com.hk O1 - Hosts: 66.180.173.39 www.google.com.ly O1 - Hosts: 66.180.173.39 www.google.com.mt O1 - Hosts: 66.180.173.39 www.google.com.mx O1 - Hosts: 66.180.173.39 www.google.com.my O1 - Hosts: 66.180.173.39 www.google.com.na O1 - Hosts: 66.180.173.39 www.google.com.nf O1 - Hosts: 66.180.173.39 www.google.com.ni O1 - Hosts: 66.180.173.39 www.google.com.np O1 - Hosts: 66.180.173.39 www.google.com.pa O1 - Hosts: 66.180.173.39 www.google.com.pe O1 - Hosts: 66.180.173.39 www.google.com.ph O1 - Hosts: 66.180.173.39 www.google.com.pk O1 - Hosts: 66.180.173.39 www.google.com.pr O1 - Hosts: 66.180.173.39 www.google.com.py O1 - Hosts: 66.180.173.39 www.google.com.sa O1 - Hosts: 66.180.173.39 www.google.com.sg O1 - Hosts: 66.180.173.39 www.google.com.sv O1 - Hosts: 66.180.173.39 www.google.com.tr O1 - Hosts: 66.180.173.39 www.google.com.tw O1 - Hosts: 66.180.173.39 www.google.com.ua O1 - Hosts: 66.180.173.39 www.google.com.uy O1 - Hosts: 66.180.173.39 www.google.com.vc O1 - Hosts: 66.180.173.39 www.google.com.vn O1 - Hosts: 66.180.173.39 www.google.de O1 - Hosts: 66.180.173.39 www.google.dj O1 - Hosts: 66.180.173.39 www.google.dk O1 - Hosts: 66.180.173.39 www.google.es O1 - Hosts: 66.180.173.39 www.google.fi O1 - Hosts: 66.180.173.39 www.google.fm O1 - Hosts: 66.180.173.39 www.google.fr O1 - Hosts: 66.180.173.39 www.google.gg O1 - Hosts: 66.180.173.39 www.google.gl O1 - Hosts: 66.180.173.39 www.google.gm O1 - Hosts: 66.180.173.39 www.google.hn O1 - Hosts: 66.180.173.39 www.google.ie O1 - Hosts: 66.180.173.39 www.google.it O1 - Hosts: 66.180.173.39 www.google.kz O1 - Hosts: 66.180.173.39 www.google.li O1 - Hosts: 66.180.173.39 www.google.lt O1 - Hosts: 66.180.173.39 www.google.lu O1 - Hosts: 66.180.173.39 www.google.lv O1 - Hosts: 66.180.173.39 www.google.mn O1 - Hosts: 66.180.173.39 www.google.ms O1 - Hosts: 66.180.173.39 www.google.mu O1 - Hosts: 66.180.173.39 www.google.mw O1 - Hosts: 66.180.173.39 www.google.nl O1 - Hosts: 66.180.173.39 www.google.no O1 - Hosts: 66.180.173.39 www.google.off.ai O1 - Hosts: 66.180.173.39 www.google.pl O1 - Hosts: 66.180.173.39 www.google.pn O1 - Hosts: 66.180.173.39 www.google.pt O1 - Hosts: 66.180.173.39 www.google.ro O1 - Hosts: 66.180.173.39 www.google.ru O1 - Hosts: 66.180.173.39 www.google.rw O1 - Hosts: 66.180.173.39 www.google.se O1 - Hosts: 66.180.173.39 www.google.sh O1 - Hosts: 66.180.173.39 www.google.sk O1 - Hosts: 66.180.173.39 www.google.sm O1 - Hosts: 66.180.173.39 www.google.td O1 - Hosts: 66.180.173.39 www.google.tm O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} - C:\WINDOWS\AuroraHandler.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\Owner\LOCALS~1\Temp\wpmvojkrezg.dll (file missing) O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file) O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [S3apphk] S3apphk.exe O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe O4 - HKLM\..\Run: [t77i3tP] phomine.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [stb] C:\WINDOWS\System32\stb.exe O4 - HKLM\..\Run: [ovzjdll] C:\WINDOWS\ovzjdll.EXE O4 - HKLM\..\Run: [ogkvenc] C:\WINDOWS\ogkvenc.EXE O4 - HKLM\..\Run: [qssadll] C:\WINDOWS\qssadll.EXE O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKLM\..\Run: [apisvc.exe] C:\WINDOWS\System32\apisvc.exe O4 - HKLM\..\Run: [secserv.exe] C:\Program Files\Common Files\System\secserv.exe O4 - HKLM\..\Run: [SetupExeDll] hyandex.exe O4 - HKLM\..\Run: [Preliminary] pizda.exe O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe O4 - HKLM\..\Run: [xzoldll] C:\WINDOWS\xzoldll.EXE O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\jnbara.exe reg_run O4 - HKLM\..\Run: [lbbwygd] c:\windows\system32\rtxuee.exe r O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [cwosRjj3V] paqntz.exe O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe" O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe" O4 - HKCU\..\Run: [cmon14] ATLIEHELPER.exe O4 - HKCU\..\Run: [prgsys0984] PasswdMon.exe O4 - HKCU\..\Run: [init32] ActionScr.exe O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE O4 - Startup: PowerReg SchedulerV2.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe O4 - Global Startup: Microsoft Broadband Networking.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: One-VA VPN Client.lnk = C:\Program Files\One-VA VPN Client\vpngui.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {01118D00-3E00-11D2-8470-0060089874ED} - http://help.bellsouth.net/sdccommon/download/tgctlpw.cab O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://195.95.218.83/users/sale/web/axe/x.chm::/update.exe O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://scf021.shands.ufl.edu/citrix/nfuse161/clients/wficat.cab O16 - DPF: {4025F9BF-E95A-4F42-87A3-D74ABCC520D9} (ISiteNonVisual Control 3.0) - https://159.178.60.179/iSite3_0.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {5A66E13A-311D-488B-828D-DDDF52EFB636} (strprint.trprints) - https://partnering.one.microsoft.com/MCP/tools/MCPTranscriptPrint.CAB O16 - DPF: {5F3B3060-09E0-44C6-86F7-BC7B02B57BEE} - http://downloads.shopathomeselect.com/budsinc/grinstall_budsinc1001.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121228485889 O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://vaww.north-florida.med.va.gov/tsweb/msrdp.cab O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0009.exe O16 - DPF: {9FA45D9C-1412-4949-B735-0D73A3D20E51} (CFND Control) - http://www.gloopers.com/VFX.CAB O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4529/mcfscan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32184114-09D9-46A0-A850-C063AE84537E}: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CCS\Services\Tcpip\..\{D79AF272-7FA4-41C8-861A-B303F26A29F2}: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CCS\Services\Tcpip\..\{DD39DFD8-78F5-4431-B17A-164BA1BFD866}: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CS1\Services\Tcpip\..\{32184114-09D9-46A0-A850-C063AE84537E}: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CS2\Services\Tcpip\..\{32184114-09D9-46A0-A850-C063AE84537E}: NameServer = 69.50.188.180,85.255.112.5 O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.188.180,85.255.112.5 O20 - Winlogon Notify: Welcome - C:\WINDOWS\system32\QBENCLIB.DLL (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\One-VA VPN Client\cvpnd.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing) O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing) O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\yditsvc.exe (file missing)