My hijacked log...

Susan McDermott · July 12, 2010

I hope I'm following forum guidelines.

I had the AntiMalware Doctor infect me last week. MBAM got rid of most of it, but several files are hanging on. Any assistance will be immensely appreciated. Thanks in advance. (I'm still flabbergasted that infection happened in the first place. I can't believe that my work computer has NO antivirus. Go figure.) My log reads as follows:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4292

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/12/2010 11:55:52 AM

mbam-log-2010-07-12 (11-55-52).txt

Scan type: Quick scan

Objects scanned: 166822

Time elapsed: 15 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> No action taken.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\FrontDesk\Local Settings\Temp\iexplorer.exe (Malware.Packer.Gen) -> No action taken.

Maniac · July 12, 2010

Hello Susan! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

I can't believe that my work computer has NO antivirus.

Me too.

Please follow these instructions and post all logs if you can:

http://forums.malwarebytes.org/index.php?showtopic=9573

Susan McDermott · July 13, 2010

Borislav,

1. I love you.

2. I'm so lucky that volunteers like you help people like me.

3. It took a while to get everything done. GMER froze one yesterday after about 30 minutes. I started it again and my whole system powered down completely after about 1 hour. I think I had another process running at the same time and it was just too much. GMER took 4 hours 50 minutes to scan today. But it finished!

4. I love you.

Following are the various items you requested:

DDS (copy-and-paste below)

Attach (zipped file attached)

Ark (zipped file attached)

Thanks in advance. Did I mention that I love you?

-Susan

DDS (Ver_10-03-17.01) - NTFSx86

Run by FrontDesk at 14:42:46.31 on Mon 07/12/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2021.1315 [GMT -4:00]

AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\csasvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\McAfee\Common Framework\FrameworkService.exe

C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe

C:\Program Files\PDF Complete\pdfsvc.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\SMINST\Scheduler.exe

C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Program Files\ACT\ACT for Windows\Act.Outlook.Service.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Lacerte Shared\Update Scheduler\UpdSched.EXE

C:\Program Files\AWS\WeatherBug\Weather.exe

C:\DOCUME~1\FRONTD~1\LOCALS~1\Temp\avp.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\FrontDesk\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:5577

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [updates Scheduler] c:\program files\common files\lacerte shared\update scheduler\UpdSched.EXE

uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1

uRun: [Pmajobojebuqag] rundll32.exe "c:\windows\wuias2.dll",Startup

uRun: [hsehf98u34i9tjioaugy987iuegdsg] c:\docume~1\frontd~1\locals~1\temp\avp.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [soundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray

mRun: [PDF Complete] c:\program files\pdf complete\pdfsty.exe

mRun: [setRefresh] c:\program files\compaq\setrefresh\SetRefresh.exe

mRun: [Recguard] c:\windows\sminst\Recguard.exe

mRun: [Reminder] c:\windows\creator\Remind_XP.exe

mRun: [scheduler] c:\windows\sminst\Scheduler.exe

mRun: [shStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE

mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey

mRun: [Act.Outlook.Service] "c:\program files\act\act for windows\Act.Outlook.Service.exe"

mRun: [Act! Preloader] "c:\program files\act\act for windows\ActSage.exe" -preload

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Qhukeridubayavej] rundll32.exe "c:\windows\uqocoyusiku.dll",Startup

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

uPolicies-explorer: NoFolderOptions = 1 (0x1)

uPolicies-system: DisableRegistryTools = 1 (0x1)

mPolicies-explorer: NoWelcomeScreen = 1 (0x1)

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\npjpi160_02.dll

IE: {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} - hxxp://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB

DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab

DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} - hxxp://webgames.d.tmsrv.com/c=337f4cc5da5daaacf96672d508888602/aff=t_03cm_wg/p/release/playfirst/wg_zenerchi/zenerchi/ZenerchiWeb.1.0.0.10.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://webgames.d.tmsrv.com/c=55b69e59303d4bc3da09368b79b1d8cd/aff=t_03cm_wg/p/release/gamehouse/wg_lotus/lotus/zylomplayer.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} - hxxp://webgames.d.tmsrv.com/c=55b69e59303d4bc3da09368b79b1d8cd/aff=t_03cm_wg/p/release/playfirst/wg_sweetopia/sweetopia/Sweetopia.1.0.0.20.cab

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R2 CSAPrintService;Creative Solutions Accounting Print Service;c:\windows\csasvc.exe [2008-11-19 118784]

R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2008-10-31 104000]

R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2006-11-30 144960]

R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2006-11-30 54872]

R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.2\mssql\binn\sqlservr.exe [2006-6-28 28952920]

R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2008-8-22 576024]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-1-23 36608]

R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2008-10-31 72264]

R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2008-10-31 34152]

R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2008-10-31 168776]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-15 135664]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2006-2-27 14336]

=============== Created Last 30 ================

2010-07-12 18:11:07 0 ----a-w- c:\documents and settings\frontdesk\defogger_reenable

2010-07-08 16:48:36 0 d-----w- c:\docume~1\frontd~1\applic~1\Malwarebytes

2010-07-08 16:48:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-08 16:48:10 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-08 16:48:10 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-07-08 16:48:09 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-08 14:57:40 0 ----a-w- c:\windows\Xtemoquq.bin

2010-07-08 14:57:40 0 ----a-w- c:\windows\Qyotadajakucuraq.dat

2010-07-08 14:56:36 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-08 14:55:53 767488 ----a-w- c:\windows\system32\drivers\igncrqza.sys

2010-07-08 14:55:42 0 d-----w- c:\docume~1\alluse~1\applic~1\Update

2010-07-08 14:55:25 0 d-----w- c:\docume~1\frontd~1\applic~1\27B19CB17B50869726058A4BC60C2D8D

2010-07-08 14:34:58 175104 ----a-w- c:\windows\Gpemua.exe

2010-07-08 14:34:47 126976 --sha-r- c:\windows\system32\WudfHost7.dll

2010-06-30 20:15:19 0 d-----w- c:\docume~1\frontd~1\applic~1\Barnes & Noble

2010-06-30 20:15:16 0 d-----w- c:\program files\Barnes & Noble

==================== Find3M ====================

2010-07-12 18:21:11 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys

2010-05-05 13:30:57 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-05-02 05:22:50 1851264 ------w- c:\windows\system32\dllcache\win32k.sys

2010-04-20 05:30:08 285696 ----a-w- c:\windows\system32\atmfd.dll

2010-04-20 05:30:08 285696 ------w- c:\windows\system32\dllcache\atmfd.dll

2010-04-16 11:43:30 41984 ------w- c:\windows\system32\dllcache\iecompat.dll

2008-10-31 19:50:13 88 --sh--r- c:\windows\system32\56EFD5A8A5.sys

============= FINISH: 14:43:53.95 ===============

Attach.zip

ark.zip

Maniac · July 13, 2010

Don't worry! Everything will be okay.

Step 1

Please, uninstall the following applications:

Adobe Reader 9.3.2

You can read, how to do this here:

Step 2

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 3

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

JavaRa log
MalwareBytes' Anti-Malware log
a new fresh DDS log only

Susan McDermott · July 14, 2010

Borislav,

I should also mention that I now have the following error message pop up when rebooting:

"Error loading c:WINDOWS\WUIAS2.DLL

The specified module could not be found."

Below is the information you requested:

JavaRa Log

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Tue Jul 13 16:31:58 2010

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_02\

------------------------------------

Finished reporting.

New MBAM Log

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4310

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/13/2010 4:52:54 PM

mbam-log-2010-07-13 (16-52-54).txt

Scan type: Quick scan

Objects scanned: 169033

Time elapsed: 15 minute(s), 17 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 2

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 9

Memory Processes Infected:

C:\Documents and Settings\FrontDesk\Local Settings\Temp\avp.exe (Trojan.Dropper) -> Unloaded process successfully.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\MS Essentials (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsehf98u34i9tjioaugy987iuegdsg (Trojan.Dropper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\FrontDesk\Local Settings\Temp\avp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\dfmcd21.dll (Malware.Packer.Gen) -> Delete on reboot.

C:\Documents and Settings\FrontDesk\Local Settings\Temp\iexplorer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\FrontDesk\Local Settings\Temp\install.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\FrontDesk\Local Settings\Temp\gdi32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\FrontDesk\Local Settings\Temp\smss.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\FrontDesk\Local Settings\Temp\sysedit.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\FrontDesk\Local Settings\Temp\mdm.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\WINDOWS\Gpemua.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

New DDS Log

DDS (Ver_10-03-17.01) - NTFSx86

Run by FrontDesk at 9:54:19.25 on Wed 07/14/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2021.1207 [GMT -4:00]

AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\csasvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\McAfee\Common Framework\FrameworkService.exe

C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe

C:\Program Files\PDF Complete\pdfsvc.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\SMINST\Scheduler.exe

C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Program Files\ACT\ACT for Windows\Act.Outlook.Service.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Lacerte Shared\Update Scheduler\UpdSched.EXE

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\FrontDesk\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:5577

BHO: Internet Explorer Plugin: {0098efcc-12d6-4b0c-b566-e133f6b4941b} - dfmcd21.dll