I have a white desktop, when I try to change it i get that "privacy_danger" error. Being rather new to this level of my PC, I hope I have done what I need to allow someone to help. My apologies if I have not, and thanks to all that offer a hand! Below is my log. Please help. . . . .:4-dontkno
Deckard's System Scanner v20071014.68
Run by Jake on 2008-03-04 21:32:35
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis (run as Jake.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:34:33 PM, on 3/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Webshots\Webshots.scr
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jake\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jake.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ekvgsnw - {BA3FAEA0-987D-4921-BD8D-847EBAE453D0} - (no file)
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XoftSpySE] C:\Program Files\XoftSpySE\xoftspy.exe -s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ParetoLogic Anti-Spyware] "C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" -NM -hidesplash
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.gamehouse.com/realarcade-webgames/zuma/popcaploader.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
--
End of file - 8197 bytes
-- Files created between 2008-02-04 and 2008-03-04 -----------------------------
2008-03-04 20:45:10 0 d-------- C:\ie-spyad_zo
2008-03-04 20:17:48 0 d-------- C:\Program Files\SpywareBlaster
2008-03-04 17:46:29 0 d-------- C:\Program Files\Microsoft Silverlight
2008-03-03 18:30:16 0 d-------- C:\Documents and Settings\Jake\.housecall6.6
2008-03-01 14:02:18 0 d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
2008-03-01 14:02:14 0 d-------- C:\Program Files\ParetoLogic
2008-03-01 14:02:13 0 d-------- C:\Program Files\Common Files\ParetoLogic
2008-02-28 19:35:29 0 d-------- C:\Program Files\Trend Micro
2008-02-26 21:25:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 20:11:37 0 d-------- C:\Program Files\iPod
2008-02-26 20:11:30 0 d-------- C:\Program Files\iTunes
2008-02-26 20:09:52 0 d-------- C:\Program Files\QuickTime
2008-02-26 05:52:59 0 d-------- C:\WINDOWS\network diagnostic
2008-02-25 22:12:32 0 d-------- C:\Program Files\RegCure
2008-02-25 21:44:33 0 d-------- C:\Program Files\XoftSpySE
2008-02-25 10:43:39 0 d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2008-02-25 10:20:01 0 d-------- C:\My Games
2008-02-25 10:19:59 0 d-------- C:\My Download Files
2008-02-25 10:17:18 774144 --a------ C:\Program Files\RngInterstitial.dll <Not Verified; RealNetworks, Inc.; RealNetworks, Inc. RngInterstitial>
2008-02-25 10:17:12 0 d-------- C:\Program Files\Real
2008-02-25 10:03:36 81920 --a------ C:\WINDOWS\fkxvkns.exe
2008-02-17 09:09:33 242 --a------ C:\WINDOWS\bbbconfig.dat
2008-02-16 21:23:42 0 d-------- C:\Documents and Settings\Jake\Application Data\PlayFirst
2008-02-16 21:23:42 0 d-------- C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-02-16 16:20:01 0 d-------- C:\Program Files\TryMedia
2008-02-16 09:58:56 0 d-------- C:\Program Files\AWS
2008-02-15 23:46:50 0 d-------- C:\Program Files\Yahoo! Games
2008-02-15 23:39:36 0 d--hs---- C:\WINDOWS\ftpcache
2008-02-13 15:23:54 4096 --a------ C:\WINDOWS\d3dx.dat
2008-02-13 14:18:25 0 d-------- C:\Program Files\Yahoo!
2008-02-06 20:34:15 0 d-------- C:\Program Files\Common Files\HP
-- Find3M Report ---------------------------------------------------------------
2008-03-04 21:20:05 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-04 19:30:27 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-03-01 14:02:13 0 d-------- C:\Program Files\Common Files
2008-02-25 10:17:11 0 d-------- C:\Program Files\Common Files\Real
2008-02-25 08:10:31 0 d-------- C:\Program Files\MSN Games
2008-02-25 08:09:11 0 d-------- C:\Program Files\Coupons
2008-02-17 09:27:07 0 d-------- C:\Documents and Settings\Jake\Application Data\Adobe
2008-02-05 19:32:16 0 d-------- C:\Program Files\Common Files\Adobe
2008-02-01 11:55:08 0 d-------- C:\Documents and Settings\Jake\Application Data\Apple Computer
2008-01-31 17:34:36 0 d-------- C:\Program Files\Bonjour
2008-01-31 17:33:27 0 d-------- C:\Program Files\Apple Software Update
2008-01-31 17:33:01 0 d-------- C:\Program Files\Common Files\Apple
2008-01-31 17:23:19 0 d-------- C:\Program Files\Rhapsody
2008-01-30 18:43:58 4 --a------ C:\WINDOWS\system32\A8FD35
2008-01-29 20:52:43 0 d-------- C:\Documents and Settings\Jake\Application Data\Sun
2008-01-29 20:52:23 0 d-------- C:\Program Files\Java
2008-01-29 20:51:11 0 d-------- C:\Program Files\Common Files\Java
2008-01-28 06:18:11 0 d-------- C:\Program Files\Messenger
2008-01-26 08:50:40 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-26 08:49:05 0 d-------- C:\Program Files\Windows Live
2008-01-25 21:35:36 0 d-------- C:\Program Files\Movie Maker
2008-01-25 21:33:18 0 d-------- C:\Program Files\Windows NT
2008-01-19 22:07:25 0 d-------- C:\Program Files\Webshots
2008-01-19 22:07:22 0 d-------- C:\Documents and Settings\Jake\Application Data\Webshots
2008-01-19 21:49:12 0 d-------- C:\Documents and Settings\Jake\Application Data\System Tweaker
2008-01-19 20:44:28 0 d-------- C:\Documents and Settings\Jake\Application Data\Uniblue
2008-01-12 21:53:29 0 d-------- C:\Documents and Settings\Jake\Application Data\Google
2008-01-12 18:54:40 0 d-------- C:\Program Files\Google
2008-01-12 18:52:20 0 d-------- C:\Documents and Settings\Jake\Application Data\Real
2008-01-10 10:58:14 0 d-------- C:\Program Files\Norton 360
2008-01-10 10:16:26 0 d-------- C:\Program Files\Symantec
2008-01-09 22:26:17 0 d-------- C:\Documents and Settings\Jake\Application Data\Symantec
2008-01-09 20:55:24 0 d--h----- C:\Program Files\WindowsUpdate
2008-01-09 19:04:39 0 d-------- C:\Documents and Settings\Jake\Application Data\Yahoo!
2008-01-09 18:49:17 0 d-------- C:\Documents and Settings\Jake\Application Data\MSN6
2008-01-09 09:35:14 0 d-------- C:\Documents and Settings\Jake\Application Data\Macromedia
2008-01-08 21:25:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-01-08 21:25:05 0 d-------- C:\Documents and Settings\Jake\Application Data\U3
2008-01-08 20:29:43 0 d-------- C:\Program Files\Lavalys
2008-01-08 17:00:58 44 --a------ C:\WINDOWS\system32\msssc.dll
2008-01-08 17:00:58 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-08 17:00:58 0 d-------- C:\Program Files\Analog Devices
2008-01-05 14:49:53 105291 --a------ C:\WINDOWS\HPFins09.dat
2008-01-05 14:47:36 0 d-------- C:\Program Files\Hewlett-Packard
2008-01-05 14:47:24 0 d-------- C:\Program Files\HP
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [09/24/2005 12:08 AM]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [10/11/2002 05:26 PM]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [05/08/2003 12:34 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [07/17/2007 08:54 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"MP10_EnsureFileVer"="C:\WINDOWS\inf\unregmp2.exe" [08/04/2004 02:56 AM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/31/2008 11:13 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
"XoftSpySE"="C:\Program Files\XoftSpySE\xoftspy.exe" [10/24/2007 01:59 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [07/28/2003 02:19 PM]
"nwiz"="nwiz.exe" [07/28/2003 02:19 PM C:\WINDOWS\system32\nwiz.exe]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [01/12/2008 06:54 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
"ParetoLogic Anti-Spyware"="C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" [10/24/2007 01:59 PM]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
C:\Documents and Settings\Jake\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [1/19/2008 10:07:22 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{51C55F9E-C308-4c95-89AB-8858D8AFD819}"= C:\Program Files\ParetoLogic\Anti-Spyware\PASShlExt.dll [10/24/2007 01:59 PM 98304]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jake^Start Menu^Programs^Startup^Webshots.lnk]
backup=C:\WINDOWS\pss\Webshots.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
*Newly Created Service* - COMHOST
-- End of Deckard's System Scanner: finished at 2008-03-04 21:34:53 ------------
Deckard's System Scanner v20071014.68
Run by Jake on 2008-03-04 21:32:35
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis (run as Jake.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:34:33 PM, on 3/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Webshots\Webshots.scr
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jake\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jake.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ekvgsnw - {BA3FAEA0-987D-4921-BD8D-847EBAE453D0} - (no file)
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XoftSpySE] C:\Program Files\XoftSpySE\xoftspy.exe -s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ParetoLogic Anti-Spyware] "C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" -NM -hidesplash
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.gamehouse.com/realarcade-webgames/zuma/popcaploader.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
--
End of file - 8197 bytes
-- Files created between 2008-02-04 and 2008-03-04 -----------------------------
2008-03-04 20:45:10 0 d-------- C:\ie-spyad_zo
2008-03-04 20:17:48 0 d-------- C:\Program Files\SpywareBlaster
2008-03-04 17:46:29 0 d-------- C:\Program Files\Microsoft Silverlight
2008-03-03 18:30:16 0 d-------- C:\Documents and Settings\Jake\.housecall6.6
2008-03-01 14:02:18 0 d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
2008-03-01 14:02:14 0 d-------- C:\Program Files\ParetoLogic
2008-03-01 14:02:13 0 d-------- C:\Program Files\Common Files\ParetoLogic
2008-02-28 19:35:29 0 d-------- C:\Program Files\Trend Micro
2008-02-26 21:25:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 20:11:37 0 d-------- C:\Program Files\iPod
2008-02-26 20:11:30 0 d-------- C:\Program Files\iTunes
2008-02-26 20:09:52 0 d-------- C:\Program Files\QuickTime
2008-02-26 05:52:59 0 d-------- C:\WINDOWS\network diagnostic
2008-02-25 22:12:32 0 d-------- C:\Program Files\RegCure
2008-02-25 21:44:33 0 d-------- C:\Program Files\XoftSpySE
2008-02-25 10:43:39 0 d-------- C:\Documents and Settings\All Users\Application Data\PopCap
2008-02-25 10:20:01 0 d-------- C:\My Games
2008-02-25 10:19:59 0 d-------- C:\My Download Files
2008-02-25 10:17:18 774144 --a------ C:\Program Files\RngInterstitial.dll <Not Verified; RealNetworks, Inc.; RealNetworks, Inc. RngInterstitial>
2008-02-25 10:17:12 0 d-------- C:\Program Files\Real
2008-02-25 10:03:36 81920 --a------ C:\WINDOWS\fkxvkns.exe
2008-02-17 09:09:33 242 --a------ C:\WINDOWS\bbbconfig.dat
2008-02-16 21:23:42 0 d-------- C:\Documents and Settings\Jake\Application Data\PlayFirst
2008-02-16 21:23:42 0 d-------- C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-02-16 16:20:01 0 d-------- C:\Program Files\TryMedia
2008-02-16 09:58:56 0 d-------- C:\Program Files\AWS
2008-02-15 23:46:50 0 d-------- C:\Program Files\Yahoo! Games
2008-02-15 23:39:36 0 d--hs---- C:\WINDOWS\ftpcache
2008-02-13 15:23:54 4096 --a------ C:\WINDOWS\d3dx.dat
2008-02-13 14:18:25 0 d-------- C:\Program Files\Yahoo!
2008-02-06 20:34:15 0 d-------- C:\Program Files\Common Files\HP
-- Find3M Report ---------------------------------------------------------------
2008-03-04 21:20:05 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-04 19:30:27 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-03-01 14:02:13 0 d-------- C:\Program Files\Common Files
2008-02-25 10:17:11 0 d-------- C:\Program Files\Common Files\Real
2008-02-25 08:10:31 0 d-------- C:\Program Files\MSN Games
2008-02-25 08:09:11 0 d-------- C:\Program Files\Coupons
2008-02-17 09:27:07 0 d-------- C:\Documents and Settings\Jake\Application Data\Adobe
2008-02-05 19:32:16 0 d-------- C:\Program Files\Common Files\Adobe
2008-02-01 11:55:08 0 d-------- C:\Documents and Settings\Jake\Application Data\Apple Computer
2008-01-31 17:34:36 0 d-------- C:\Program Files\Bonjour
2008-01-31 17:33:27 0 d-------- C:\Program Files\Apple Software Update
2008-01-31 17:33:01 0 d-------- C:\Program Files\Common Files\Apple
2008-01-31 17:23:19 0 d-------- C:\Program Files\Rhapsody
2008-01-30 18:43:58 4 --a------ C:\WINDOWS\system32\A8FD35
2008-01-29 20:52:43 0 d-------- C:\Documents and Settings\Jake\Application Data\Sun
2008-01-29 20:52:23 0 d-------- C:\Program Files\Java
2008-01-29 20:51:11 0 d-------- C:\Program Files\Common Files\Java
2008-01-28 06:18:11 0 d-------- C:\Program Files\Messenger
2008-01-26 08:50:40 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-26 08:49:05 0 d-------- C:\Program Files\Windows Live
2008-01-25 21:35:36 0 d-------- C:\Program Files\Movie Maker
2008-01-25 21:33:18 0 d-------- C:\Program Files\Windows NT
2008-01-19 22:07:25 0 d-------- C:\Program Files\Webshots
2008-01-19 22:07:22 0 d-------- C:\Documents and Settings\Jake\Application Data\Webshots
2008-01-19 21:49:12 0 d-------- C:\Documents and Settings\Jake\Application Data\System Tweaker
2008-01-19 20:44:28 0 d-------- C:\Documents and Settings\Jake\Application Data\Uniblue
2008-01-12 21:53:29 0 d-------- C:\Documents and Settings\Jake\Application Data\Google
2008-01-12 18:54:40 0 d-------- C:\Program Files\Google
2008-01-12 18:52:20 0 d-------- C:\Documents and Settings\Jake\Application Data\Real
2008-01-10 10:58:14 0 d-------- C:\Program Files\Norton 360
2008-01-10 10:16:26 0 d-------- C:\Program Files\Symantec
2008-01-09 22:26:17 0 d-------- C:\Documents and Settings\Jake\Application Data\Symantec
2008-01-09 20:55:24 0 d--h----- C:\Program Files\WindowsUpdate
2008-01-09 19:04:39 0 d-------- C:\Documents and Settings\Jake\Application Data\Yahoo!
2008-01-09 18:49:17 0 d-------- C:\Documents and Settings\Jake\Application Data\MSN6
2008-01-09 09:35:14 0 d-------- C:\Documents and Settings\Jake\Application Data\Macromedia
2008-01-08 21:25:47 0 d-------- C:\Program Files\Common Files\InstallShield
2008-01-08 21:25:05 0 d-------- C:\Documents and Settings\Jake\Application Data\U3
2008-01-08 20:29:43 0 d-------- C:\Program Files\Lavalys
2008-01-08 17:00:58 44 --a------ C:\WINDOWS\system32\msssc.dll
2008-01-08 17:00:58 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-08 17:00:58 0 d-------- C:\Program Files\Analog Devices
2008-01-05 14:49:53 105291 --a------ C:\WINDOWS\HPFins09.dat
2008-01-05 14:47:36 0 d-------- C:\Program Files\Hewlett-Packard
2008-01-05 14:47:24 0 d-------- C:\Program Files\HP
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [09/24/2005 12:08 AM]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [10/11/2002 05:26 PM]
"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [05/08/2003 12:34 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [07/17/2007 08:54 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"MP10_EnsureFileVer"="C:\WINDOWS\inf\unregmp2.exe" [08/04/2004 02:56 AM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/31/2008 11:13 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
"XoftSpySE"="C:\Program Files\XoftSpySE\xoftspy.exe" [10/24/2007 01:59 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [07/28/2003 02:19 PM]
"nwiz"="nwiz.exe" [07/28/2003 02:19 PM C:\WINDOWS\system32\nwiz.exe]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [01/12/2008 06:54 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
"ParetoLogic Anti-Spyware"="C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" [10/24/2007 01:59 PM]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"NVIEW"="nview.dll,nViewLoadHook" []
C:\Documents and Settings\Jake\Start Menu\Programs\Startup\
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [1/19/2008 10:07:22 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{51C55F9E-C308-4c95-89AB-8858D8AFD819}"= C:\Program Files\ParetoLogic\Anti-Spyware\PASShlExt.dll [10/24/2007 01:59 PM 98304]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jake^Start Menu^Programs^Startup^Webshots.lnk]
backup=C:\WINDOWS\pss\Webshots.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
*Newly Created Service* - COMHOST
-- End of Deckard's System Scanner: finished at 2008-03-04 21:34:53 ------------
