Deckard's System Scanner v20071014.68 Run by [removed] on 2008-02-18 10:31:32 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 75: 2008-02-18 15:32:13 UTC - RP1023 - Deckard's System Scanner Restore Point 74: 2008-02-18 15:17:35 UTC - RP1022 - Made by Registry Mechanic 73: 2008-02-18 14:06:32 UTC - RP1021 - Made by Registry Mechanic 72: 2008-02-17 23:18:39 UTC - RP1020 - Made by Registry Mechanic 71: 2008-02-17 23:01:25 UTC - RP1019 - ComboFix created restore point -- First Restore Point -- 1: 2008-01-17 05:01:51 UTC - RP949 - Made by Registry Mechanic Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Bill Duke.exe) ------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:35:09 AM, on 2008-02-18 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\brss01a.exe C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\cisvc.exe C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\Program Files\mcafee.com\personal firewall\MPFService.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Seagate\Sync\SeaSyncServices.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\YPCSER~1.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Registry Mechanic\RegMech.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\AOL Companion\companion.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\Bill Duke\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Bill Duke.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nytimes.com//?oref=login R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /S O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O15 - Trusted Zone: http://*.aim.com O15 - Trusted Zone: http://www.youtube.com O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8044A104-E4A8-440A-A9FF-FC4ABD011D74}: NameServer = 68.237.161.12 71.243.0.12 O17 - HKLM\System\CCS\Services\Tcpip\..\{9768ACCE-6912-4E25-A5EA-9B06A348A818}: NameServer = 207.69.188.185,207.69.188.186 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe O23 - Service: McAfee McShield (McShield) - Unknown owner - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe (file missing) O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Seagate Sync Service - Seagate Technology LLC - C:\Program Files\Seagate\Sync\SeaSyncServices.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE -- End of file - 8393 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080207-235515-615 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235515-703 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235527-527 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235527-806 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235532-266 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235532-510 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235536-479 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235536-707 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235541-577 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235541-651 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235546-153 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235546-971 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235549-846 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235549-860 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235553-158 O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080207-235553-241 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20080215-080126-213 R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) backup-20080215-080126-245 F1 - win.ini: run=C:\WINDOWS\system32\mouse_configurator.win backup-20080215-080126-423 F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\system32\winmgd.win backup-20080215-080126-508 O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - (no file) backup-20080215-080126-512 O2 - BHO: (no name) - {2f3a22c2-3af0-4797-ac0f-eac7176984a0} - (no file) backup-20080215-080126-521 O15 - Trusted Zone: http://*.aim.com backup-20080215-080126-608 R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) backup-20080215-080126-715 O20 - AppInit_DLLs: backup-20080215-080126-784 O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat backup-20080218-100743-128 R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) backup-20080218-100743-217 O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - (no file) backup-20080218-100743-227 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html backup-20080218-100743-282 R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll backup-20080218-100743-416 O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat backup-20080218-100743-502 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com backup-20080218-100743-570 O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing) backup-20080218-100743-753 R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) backup-20080218-100743-833 O20 - AppInit_DLLs: backup-20080218-100743-950 O2 - BHO: (no name) - {2f3a22c2-3af0-4797-ac0f-eac7176984a0} - (no file) -- File Associations ----------------------------------------------------------- [COLOR=red].reg - regfile - DefaultIcon - unable to read value[/COLOR] [COLOR=red].reg - regfile - shell\open\command - GEDZAC[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Teefer (Teefer for NT) - c:\windows\system32\drivers\teefer.sys R1 MPFIREWL - c:\windows\system32\drivers\mpfirewall.sys R1 SbcpHid - c:\windows\system32\drivers\sbcphid.sys R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys S0 szkg - c:\windows\system32\drivers\szkg.sys (file missing) S3 AdfuUd (USB 2.0 (FS) ADFU Device) - c:\windows\system32\drivers\adfuud.sys S3 BW2NDIS5 - c:\windows\system32\drivers\bw2ndis5.sys S3 PCAMPR5 (PCAMPR5 NDIS Protocol Driver) - c:\windows\system32\pcampr5.sys (file missing) S3 Profos - c:\program files\common files\bitdefender\bitdefender threat scanner\profos.sys (file missing) S3 Trufos - c:\program files\common files\bitdefender\bitdefender threat scanner\trufos.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" R2 EarthLinkMonitor (EarthLink Monitor Service) - "c:\program files\earthlink totalaccess\wengine\wmonitor.exe" R2 YPCService - c:\windows\system32\ypcser~1.exe S2 AOLService (AOL Spyware Protection Service) - c:\progra~1\common~1\aol\aolspy~1\\aolserv.exe (file missing) S2 McShield (McAfee McShield) - c:\progra~1\mcafee.com\antivi~1\mcshield.exe (file missing) S4 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-02-08 10:33:05 284 --a----c- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-01-18 and 2008-02-18 ----------------------------- 2008-02-17 18:09:54 60416 --a----c- C:\WINDOWS\system32\drivers\Combo-Fix.sys 2008-02-17 10:14:09 0 d------c- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-02-15 08:07:26 0 d------c- C:\WINDOWS\system32\Kaspersky Lab 2008-02-15 02:07:47 53248 --a----c- C:\WINDOWS\PSEXESVC.EXE 2008-02-14 12:17:17 68096 --a----c- C:\WINDOWS\system32\zip.exe 2008-02-14 12:17:17 98816 --a----c- C:\WINDOWS\system32\sed.exe 2008-02-14 12:17:17 80412 --a----c- C:\WINDOWS\system32\grep.exe 2008-02-14 12:17:17 73728 --a----c- C:\WINDOWS\system32\fdsv.exe 2008-02-13 23:12:30 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Malwarebytes 2008-02-13 23:11:45 0 d------c- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-02-13 23:11:43 0 d------c- C:\Program Files\Malwarebytes' Anti-Malware 2008-02-11 13:27:08 0 d------c- C:\Program Files\Enigma Software Group 2008-02-11 13:09:11 0 d------c- C:\Program Files\Safari 2008-02-11 09:23:00 0 dr-h---c- C:\Documents and Settings\Bill Duke\Recent 2008-02-08 23:40:42 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Opera 2008-02-08 23:40:02 0 d------c- C:\Program Files\Opera 2008-02-08 07:50:36 0 d------c- C:\WINDOWS\F34D9A5F484A4E31A9D3908CB265B289.TMP 2008-02-07 23:20:23 0 d------c- C:\Program Files\Trend Micro 2008-02-07 12:41:12 0 --a----c- C:\WINDOWS\system32\SBRC.dat 2008-02-07 12:41:12 0 --a----c- C:\WINDOWS\system32\SBFC.dat 2008-02-07 09:58:24 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Sunbelt Software 2008-02-07 08:24:30 0 d------c- C:\Program Files\Common Files\BitDefender 2008-02-07 07:51:33 0 d------c- C:\Documents and Settings\Bill Duke\.housecall6.6 2008-02-07 02:12:53 0 d------c- C:\Documents and Settings\Administrator\Application Data\Viewpoint 2008-02-05 15:49:09 0 d------c- C:\Program Files\ewido anti-malware -- Find3M Report --------------------------------------------------------------- 2008-02-14 12:21:56 0 d------c- C:\Program Files\Common Files 2008-02-13 01:37:50 0 d------c- C:\Program Files\EarthLink TotalAccess 2008-02-11 13:10:05 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Apple Computer 2008-02-11 13:07:41 0 d------c- C:\Program Files\Apple Software Update 2008-02-07 08:13:14 0 d------c- C:\Program Files\America Online 9.0 2008-01-22 12:35:59 1744 --a----c- C:\WINDOWS\system32\d3d9caps.dat 2008-01-14 02:21:03 0 d------c- C:\Program Files\Common Files\AOL 2008-01-12 02:31:35 0 d------c- C:\Program Files\Sygate 2008-01-12 00:25:36 2560 --a----c- C:\WINDOWS\_MSRSTRT.EXE 2008-01-12 00:24:49 0 d------c- C:\Program Files\Common Files\Agnitum Shared 2008-01-08 11:39:35 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Adobe 2008-01-08 11:39:11 1158 --a----c- C:\WINDOWS\mozver.dat 2008-01-08 03:15:59 0 d------c- C:\Program Files\Java 2008-01-07 03:14:08 0 d------c- C:\Program Files\COMODO 2008-01-07 02:34:42 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Comodo 2008-01-07 01:07:50 0 d------c- C:\Program Files\Common Files\Java 2008-01-07 01:07:38 0 d------c- C:\Program Files\Common Files\Java(2) 2008-01-07 00:49:35 0 d------c- C:\Program Files\Java(2) 2008-01-04 21:34:34 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Spyware Terminator 2008-01-04 20:55:14 0 d------c- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-04 20:42:34 0 d------c- C:\Program Files\Agnitum 2008-01-04 16:01:09 0 d------c- C:\Program Files\Blaze Media Pro2 2008-01-03 20:03:20 0 d------c- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-01-02 16:47:00 0 d------c- C:\Program Files\McAfee 2008-01-02 16:46:58 0 d------c- C:\Program Files\Common Files\McAfee 2008-01-02 15:01:04 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\AOL 2008-01-01 14:25:58 0 d------c- C:\Program Files\Lavasoft 2007-12-19 22:09:08 0 d------c- C:\Documents and Settings\Bill Duke\Application Data\Sibelius Software 2007-12-19 22:07:34 0 d------c- C:\Program Files\Sibelius Software -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 11:14 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 11:41 AM] "RegistryMechanic"="C:\Program Files\Registry Mechanic\RegMech.exe" [2006-10-30 03:12 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 AM] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 AM] "E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 02:24 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-06-12 9:37:56 PM] America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-01-26 9:35:24 PM] AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2005-01-26 9:42:51 PM] HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-29 2:06:36 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 3:05:56 PM] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00c27897-3fe5-11dc-a9fd-00038a000015}] AutoRun\command- F:\Autorun.exe /run Shell00\Command- F:\Autorun.exe /run Shell01\Command- F:\Autorun.exe /action Shell02\Command- F:\Autorun.exe /uninstall -- End of Deckard's System Scanner: finished at 2008-02-18 10:41:37 ------------