Deckard's System Scanner v20071014.68 Run by [removed] on 2008-07-27 22:42:30 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-07-27 22:42:33 Platform: Windows XP Service Pack 3 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Webroot\Washer\WasherSvc.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\dependent\HSChkProxyExe.exe C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe C:\Program Files\Trend Micro\BM\TMBMSRV.exe C:\Program Files\Trend Micro\Internet Security\TmPfw.exe C:\Program Files\Trend Micro\Internet Security\TmProxy.exe C:\Documents and Settings\Richard J. Olszewski\Desktop\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\Program Files\TextAloud\TAForIE.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.kaspersky.com (HKCU) O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197490479546 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} () - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197509017749 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15034/CTPID.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O20 - Winlogon Notify: cfccbff - C:\WINDOWS\system32\cfccbff.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\BRSVC01A.EXE O23 - Service: Capture Device Service - Unknown owner - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\Ctsvccda.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: Nero BackItUp Scheduler 3 - Unknown owner - C:\Program Files\Nero\Nero8\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\RAXCO\PerfectDisk\PD91Agent.exe O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\RAXCO\PerfectDisk\PD91Engine.exe O23 - Service: PD91VMDefrag - Raxco Software, Inc. - C:\Program Files\RAXCO\PerfectDisk\PD91VMDefrag.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII.SP1\Win32\RpcDataSrv.exe O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XII.SP1\RpcSandraSrv.exe O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\Program Files\Common Files\SnapStream\Common\X10nets.exe -- End of file - 11492 bytes -- Files created between 2008-06-27 and 2008-07-27 ----------------------------- 2008-07-27 22:37:28 192512 --a------ C:\windows\system32\kdfvmgr.exe 2008-07-27 22:37:28 53248 --a------ C:\windows\system32\Kdfhok.dll 2008-07-27 22:37:28 77824 --a------ C:\windows\system32\kdfapi.dll 2008-07-27 22:19:47 68096 --a------ C:\windows\zip.exe 2008-07-27 22:19:47 49152 --a------ C:\windows\VFind.exe 2008-07-27 22:19:47 212480 --a------ C:\windows\swxcacls.exe 2008-07-27 22:19:47 136704 --a------ C:\windows\swsc.exe 2008-07-27 22:19:47 161792 --a------ C:\windows\swreg.exe 2008-07-27 22:19:47 98816 --a------ C:\windows\sed.exe 2008-07-27 22:19:47 80412 --a------ C:\windows\grep.exe 2008-07-27 22:19:47 89504 --a------ C:\windows\fdsv.exe 2008-07-27 21:02:25 0 dr-h----- C:\Documents and Settings\Richard J. Olszewski\Recent 2008-07-27 03:51:08 0 d-------- C:\!KillBox 2008-07-27 01:39:17 0 d-------- C:\Program Files\Microsoft IntelliPoint 2008-07-26 12:16:45 0 d-------- C:\Temp 2008-07-26 10:03:28 0 d-------- C:\windows\ERUNT 2008-07-26 09:11:31 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-07-26 09:11:25 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-07-26 09:11:25 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\SUPERAntiSpyware.com 2008-07-26 09:10:04 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\X10 Commander 2008-07-26 07:26:01 0 d-------- C:\windows\kdefense 2008-07-26 07:25:59 846336 --a------ C:\windows\system32\kdfinj.dll 2008-07-26 00:36:15 1848 --a------ C:\windows\system32\tmp.reg 2008-07-25 22:55:56 0 d-------- C:\SmartSound Software 2008-07-25 20:15:11 0 d-------- C:\windows\LocalSSL 2008-07-25 20:12:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-07-25 16:16:01 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Application Data\AVG7 2008-07-25 16:02:45 0 dr-h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\SendTo 2008-07-25 16:02:45 0 d--h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Recent 2008-07-25 16:02:45 0 d--h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\PrintHood 2008-07-25 16:02:45 0 d--h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\NetHood 2008-07-25 16:02:45 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\My Documents 2008-07-25 16:02:45 0 d--h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Local Settings 2008-07-25 16:02:45 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Favorites 2008-07-25 16:02:45 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Desktop 2008-07-25 16:02:45 0 d--hs---- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Cookies 2008-07-25 16:02:45 0 dr-h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Application Data 2008-07-25 16:02:45 0 d---s---- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Application Data\Microsoft 2008-07-25 16:02:44 0 d--h----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Templates 2008-07-25 16:02:44 0 dr------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\Start Menu 2008-07-25 16:02:44 786432 --ah----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8.000\NTUSER.DAT 2008-07-25 16:02:09 0 d--hs---- C:\windows\CSC 2008-07-25 12:55:08 0 d-------- C:\windows\system32\1647 2008-07-25 10:53:28 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8\Templates 2008-07-25 10:53:28 524288 --ah----- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8\NTUSER.DAT 2008-07-25 10:53:28 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8\Local Settings 2008-07-25 10:53:28 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8\Cookies 2008-07-25 10:53:28 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8\Application Data 2008-07-25 10:53:28 0 d-------- C:\Documents and Settings\Administrator.NONE-Q4GMQ5RWY8\Application Data\Microsoft 2008-07-25 10:42:57 11546624 --a------ C:\Documents and Settings\Richard J. Olszewski\ntuser.dat 2008-07-25 10:42:56 1421312 --a------ C:\Documents and Settings\LocalService\ntuser.dat 2008-07-25 10:38:07 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia 2008-07-25 10:38:05 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe 2008-07-25 10:37:58 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google 2008-07-25 10:37:57 0 dr------- C:\Documents and Settings\LocalService\Favorites 2008-07-25 08:27:55 0 d-------- C:\Documents and Settings\All Users\Application Data\RoboForm 2008-07-23 08:54:10 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\AVS4YOU 2008-07-21 19:56:20 0 d-------- C:\Program Files\Parbatch 2008-07-21 19:30:14 0 d-------- C:\Program Files\NewsBin 2008-07-21 19:30:14 0 d-------- C:\Documents and Settings\All Users\Application Data\NewsBin 2008-07-19 02:19:59 0 d-------- C:\windows\Replay Media Catcher 2008-07-19 02:19:43 0 d-------- C:\Program Files\Replay Media Catcher 2008-07-18 15:58:42 784 --a------ C:\Documents and Settings\Richard J. Olszewski\Application Data\mpauth.dat 2008-07-17 03:59:15 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\Dr. DivX 2.0 OSS 2008-07-17 03:34:05 0 d-------- C:\Program Files\DVDFab 5 2008-07-17 03:19:47 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\DVDFab 2008-07-10 13:54:54 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\Real -- Find3M Report --------------------------------------------------------------- 2008-07-27 22:22:44 0 d-------- C:\Program Files\Common Files 2008-07-27 22:15:40 0 --a------ C:\windows\TempFile 2008-07-25 20:14:42 0 d-------- C:\Program Files\Trend Micro 2008-07-25 14:31:26 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-07-25 10:29:33 0 d-------- C:\Program Files\SnapStream Media 2008-07-25 09:54:01 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-25 08:20:10 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\UseNeXT 2008-07-23 18:01:09 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\Vso 2008-07-23 16:27:36 0 d-------- C:\Program Files\Common Files\AVSMedia 2008-07-20 05:49:49 0 d-------- C:\Program Files\WinTV 2008-07-19 02:11:55 0 d-------- C:\Program Files\WMR11 2008-07-18 14:39:43 0 d-------- C:\Program Files\MSECache 2008-07-18 00:45:55 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\dvdcss 2008-07-17 05:20:11 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\DivX 2008-07-17 04:50:46 0 d-------- C:\Program Files\DivX 2008-07-17 03:33:52 47360 --a------ C:\Documents and Settings\Richard J. Olszewski\Application Data\pcouffin.sys 2008-07-17 03:33:52 33 --a------ C:\Documents and Settings\Richard J. Olszewski\Application Data\pcouffin.log 2008-07-17 03:33:52 1144 --a------ C:\Documents and Settings\Richard J. Olszewski\Application Data\pcouffin.inf 2008-07-17 03:33:52 7887 --a------ C:\Documents and Settings\Richard J. Olszewski\Application Data\pcouffin.cat 2008-07-17 03:31:05 0 d-------- C:\Program Files\DVDFab Platinum 4 2008-07-17 03:23:25 0 d-------- C:\Program Files\FILERECOVERY PRO 2008-07-14 02:43:12 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\Mozilla 2008-07-14 02:40:36 0 d-------- C:\Program Files\TextAloud 2008-07-13 04:09:54 0 d-------- C:\Program Files\Steam 2008-07-11 04:01:40 0 d-------- C:\Program Files\Common Files\Real 2008-07-10 13:55:57 3030 --a------ C:\windows\mozver.dat 2008-06-15 11:19:29 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\vlc 2008-06-05 07:28:26 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\Google 2008-06-05 07:27:49 0 d-------- C:\Program Files\Google 2008-06-05 04:12:01 0 d-------- C:\Program Files\Garmin 2008-06-03 22:57:07 0 d-------- C:\Program Files\Microsoft Games 2008-05-30 19:22:48 802816 --a------ C:\windows\system32\divx_xx11.dll 2008-05-30 19:22:48 823296 --a------ C:\windows\system32\divx_xx0c.dll 2008-05-30 19:22:48 823296 --a------ C:\windows\system32\divx_xx07.dll 2008-05-30 19:22:46 815104 --a------ C:\windows\system32\divx_xx0a.dll 2008-05-30 19:22:46 683520 --a------ C:\windows\system32\DivX.dll 2008-05-30 16:49:44 0 d-------- C:\Documents and Settings\Richard J. Olszewski\Application Data\Creative 2008-05-30 16:42:01 0 d-------- C:\Program Files\Creative 2008-05-30 15:23:06 0 d-------- C:\Program Files\UseNeXT 2008-05-30 11:41:15 0 d-------- C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster 2008-05-30 11:34:08 0 d--h----- C:\Program Files\Creative Installation Information 2008-05-30 11:33:15 0 d-------- C:\Program Files\Common Files\Creative 2008-05-22 18:22:18 3596288 --a------ C:\windows\system32\qt-dx331.dll 2008-05-22 18:19:46 196608 --a------ C:\windows\system32\dtu100.dll 2008-05-22 18:19:46 81920 --a------ C:\windows\system32\dpl100.dll 2008-05-22 18:18:54 12288 --a------ C:\windows\system32\DivXWMPExtType.dll 2008-05-09 00:02:06 33136 --a------ C:\Documents and Settings\Richard J. Olszewski\Application Data\GDIPFONTCACHEV1.DAT 2008-05-03 18:23:49 2337865 --a------ C:\windows\system32\pbsvc.exe 2008-05-02 23:46:00 1630208 --a------ C:\windows\system32\nwiz.exe 2008-05-02 23:46:00 1019904 --a------ C:\windows\system32\nvwimg.dll 2008-05-02 23:46:00 1703936 --a------ C:\windows\system32\nvwdmcpl.dll 2008-05-02 23:46:00 466944 --a------ C:\windows\system32\nvshell.dll 2008-05-02 23:46:00 1486848 --a------ C:\windows\system32\nview.dll 2008-05-02 23:46:00 1339392 --a------ C:\windows\system32\nvdspsch.exe 2008-05-02 23:46:00 442368 --a------ C:\windows\system32\nvappbar.exe 2008-05-02 23:46:00 425984 --a------ C:\windows\system32\keystone.exe 2008-04-30 21:49:45 409600 --a------ C:\windows\system32\wrap_oal.dll 2008-04-30 21:49:45 86016 --a------ C:\windows\system32\OpenAL32.dll -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C1656CCA-D2EA-4A32-94AE-AE0B180E6449}] 02/15/2008 07:38 103760 --a------ C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [07/23/2007 12:06] "UpdReg"="C:\WINDOWS\Updreg.exe" [05/11/2000 02:00] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [09/14/2001 21:10] "UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [02/16/2008 00:56] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [08/31/2007 12:01] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\windows\system32\ctfmon.exe" [04/13/2008 20:12] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= C:\Program Files\Qualcomm\Eudora\EuShlExt.dll [08/17/2006 15:57 86016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cfccbff] C:\WINDOWS\system32\cfccbff.dll 08/14/2002 03:25 302096 C:\WINDOWS\system32\cfccbff.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\windows\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^APC UPS Status.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk backup=C:\WINDOWS\pss\APC UPS Status.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Richard J. Olszewski^Start Menu^Programs^Startup^Registration Brothers In Arms EiB.LNK] path=C:\Documents and Settings\Richard J. Olszewski\Start Menu\Programs\Startup\Registration Brothers In Arms EiB.LNK backup=C:\WINDOWS\pss\Registration Brothers In Arms EiB.LNKStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Richard J. Olszewski^Start Menu^Programs^Startup^Registration Silent Hunter III.LNK] path=C:\Documents and Settings\Richard J. Olszewski\Start Menu\Programs\Startup\Registration Silent Hunter III.LNK backup=C:\WINDOWS\pss\Registration Silent Hunter III.LNKStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion] "C:\Program Files\Cyberlink\Shared Files\brs.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp] CTXFIHLP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CtxfiReg] CTXFIREG.exe /FAIL1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firefly] C:\Program Files\SnapStream Media\Firefly\Firefly.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gStart] C:\Garmin\gStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_9 -reboot 1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "aawservice"=3 (0x3) "Nero BackItUp Scheduler 3"=2 (0x2) "AVGEMS"=2 (0x2) "RichVideo"=2 (0x2) "Avg7UpdSvc"=2 (0x2) "Avg7Alrt"=2 (0x2) "Adobe LM Service"=3 (0x3) "WebrootSpySweeperService"=2 (0x2) "nTuneService"=2 (0x2) "gusvc"=2 (0x2) "SCardSvr"=3 (0x3) "SandraTheSrv"=3 (0x3) "SandraDataSrv"=3 (0x3) "RDSessMgr"=3 (0x3) "LVSrvLauncher"=2 (0x2) "idsvc"=3 (0x3) "RasMan"=3 (0x3) "RasAuto"=3 (0x3) "Capture Device Service"=2 (0x2) "rpcapd"=3 (0x3) "avg8emc"=3 (0x3) "avg8wd"=3 (0x3) "WMPNetworkSvc"=3 (0x3) "UleadBurningHelper"=2 (0x2) "StarWindServiceAE"=2 (0x2) "PnkBstrA"=2 (0x2) "NVSvc"=2 (0x2) "LVCOMSer"=2 (0x2) "Brother XP spl Service"=2 (0x2) "LVPrcSrv"=2 (0x2) "Creative Service for CDROM Access"=2 (0x2) "PD91VMDefrag"=2 (0x2) "PD91Engine"=3 (0x3) "PD91Agent"=2 (0x2) "NMIndexingService"=3 (0x3) "APC UPS Service"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5eec8b57-a8d2-11dc-84a6-978bf9a661d9}] AutoRun\command- LinksysConnectPC.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1EB883E9-FE16-924C-A8C5-C35B608BE382}] C:\WINDOWS\system32\updating\update.exe s -- End of Deckard's System Scanner: finished at 2008-07-27 22:42:53 ------------