Deckard's System Scanner v20071014.68 Run by [removed] on 2008-07-28 15:34:53 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 22: 2008-07-28 14:35:00 UTC - RP128 - Deckard's System Scanner Restore Point 21: 2008-07-28 10:07:58 UTC - RP127 - ComboFix created restore point 20: 2008-07-28 09:47:11 UTC - RP126 - Last known good configuration 19: 2008-07-28 09:47:07 UTC - RP125 - Software Distribution Service 3.0 18: 2008-07-28 09:47:07 UTC - RP124 - Installed Java(TM) 6 Update 7 -- First Restore Point -- 1: 2008-07-28 09:47:05 UTC - RP107 - Installed Ad-Aware Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-07-28 15:36:57 Platform: Windows XP Service Pack 3 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Webshots\Webshots.scr C:\WINDOWS\explorer.exe C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Common Files\Nero\Shared\NL3\NeroPatentActivation.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\UIKS3W08\dss[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{AE8A24C4-ABAA-4C16-8F79-EFF6A64CC5BE}: NameServer = 212.139.132.38 212.139.132.39 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FreezeScreenSaver - Unknown owner - C:\WINDOWS\system32\FreezeScreenSaver.exe O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: Nero BackItUp Scheduler 3 - Unknown owner - C:\Program Files\Nero\Nero8\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\system32\TuneUpDefragService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 8427 bytes -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] [COLOR=red].ini - inifile - DefaultIcon - C:\WINDOWS\Icons\Galaxy[1]\Galaxy.icl,42[/COLOR] [COLOR=red].js - JSFile - shell\open\command - NOTEPAD.EXE %1[/COLOR] [COLOR=red].txt - txtfile - DefaultIcon - C:\WINDOWS\Icons\Galaxy[1]\Galaxy.icl,40[/COLOR] [COLOR=red].vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R3 BDSelfPr - c:\program files\bitdefender\bitdefender 2008\bdselfpr.sys R3 Pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" R2 Nero BackItUp Scheduler 3 - c:\program files\nero\nero8\nero backitup\nbservice.exe R2 PLFlash DeviceIoControl Service - c:\windows\system32\ioctlsvc.exe S2 ioloFileInfoList (iolo FileInfoList Service) - c:\program files\iolo\common\lib\ioloservicemanager.exe (file missing) S2 ioloSystemService (iolo System Service) - c:\program files\iolo\common\lib\ioloservicemanager.exe (file missing) S3 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" S4 avg8emc (AVG8 E-mail Scanner) - c:\progra~1\avg\avg8\avgemc.exe (file missing) S4 avg8wd (AVG8 WatchDog) - c:\progra~1\avg\avg8\avgwdsvc.exe (file missing) S4 FreezeScreenSaver - c:\windows\system32\freezescreensaver.exe -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: NVIDIA nForce Networking Controller Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_23011565&REV_A1\3&13C0B0C5&0&20 Manufacturer: Nvidia Name: NVIDIA nForce Networking Controller PNP Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_23011565&REV_A1\3&13C0B0C5&0&20 Service: NVENET -- Scheduled Tasks ------------------------------------------------------------- 2008-07-28 15:00:02 484 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job 2008-07-28 11:27:52 446 --a------ C:\WINDOWS\Tasks\XoftSpySE 2.job 2008-07-27 08:54:09 312 --a------ C:\WINDOWS\Tasks\XoftSpySE.job 2008-07-24 17:09:03 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-06-28 and 2008-07-28 ----------------------------- 2008-07-28 15:31:11 0 d-------- C:\TEMP 2008-07-28 11:07:00 68096 --a------ C:\WINDOWS\zip.exe 2008-07-28 11:07:00 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-28 11:07:00 212480 --a------ C:\WINDOWS\swxcacls.exe 2008-07-28 11:07:00 136704 --a------ C:\WINDOWS\swsc.exe 2008-07-28 11:07:00 161792 --a------ C:\WINDOWS\swreg.exe 2008-07-28 11:07:00 98816 --a------ C:\WINDOWS\sed.exe 2008-07-28 11:07:00 80412 --a------ C:\WINDOWS\grep.exe 2008-07-28 11:07:00 89504 --a------ C:\WINDOWS\fdsv.exe 2008-07-28 10:45:07 94208 --a------ C:\WINDOWS\grswptdl.exe 2008-07-28 10:24:53 0 d-------- C:\Program Files\DVDFab 5 2008-07-28 09:03:49 0 d-------- C:\Program Files\Oberon Media 2008-07-28 09:03:49 0 d-------- C:\Program Files\Common Files\Oberon Media 2008-07-28 08:38:53 0 d-------- C:\Program Files\Sun 2008-07-28 08:36:07 0 d-------- C:\Program Files\Common Files\Java 2008-07-26 20:59:58 0 d-------- C:\Program Files\Mystery PI The Vegas Heist 2008-07-26 17:42:38 0 d-------- C:\Program Files\XoftSpySE 2008-07-26 17:00:02 0 d-------- C:\Documents and Settings\User\Application Data\Google 2008-07-26 16:58:35 0 d-------- C:\Program Files\Google 2008-07-26 14:15:00 0 d-------- C:\GAMES 2008-07-26 14:07:17 0 d-------- C:\Program Files\Mystery Case Files Prime Suspects 2008-07-26 13:36:26 0 d-------- C:\Program Files\Tradewinds Legends 2008-07-26 13:27:39 0 d-------- C:\Documents and Settings\All Users\Application Data\GameHouse 2008-07-26 13:04:32 106496 --a------ C:\WINDOWS\SysF7.exe 2008-07-26 13:04:26 30720 --a------ C:\WINDOWS\SysF6.exe 2008-07-26 13:04:21 30208 --a------ C:\WINDOWS\SysF5.exe 2008-07-26 13:04:20 31744 --a------ C:\WINDOWS\SysF4.exe 2008-07-26 13:04:17 32256 --a------ C:\WINDOWS\SysF3.exe 2008-07-26 13:02:48 0 d-------- C:\Program Files\Gold Rush Treasure Hunt 2008-07-26 09:17:57 0 dr-h----- C:\Documents and Settings\User\Recent 2008-07-25 18:50:19 0 d-------- C:\WINDOWS\Tradewinds Caravans 2008-07-25 18:50:19 0 d-------- C:\Program Files\Tradewinds Caravans 2008-07-24 19:52:22 0 d-------- C:\Program Files\Lavasoft 2008-07-24 19:04:28 0 d-------- C:\Documents and Settings\All Users\Application Data\MumboJumbo 2008-07-24 19:04:00 0 d-------- C:\WINDOWS\Discovery A Seek And Find Adventure 2008-07-24 18:51:50 0 d-------- C:\Program Files\PopCap Games 2008-07-24 18:49:36 0 d-------- C:\Program Files\Bricks of Camelot 2008-07-24 18:46:24 0 d-------- C:\Program Files\Bricks of Atlantis 2008-07-24 18:08:08 0 d-------- C:\Documents and Settings\User\Application Data\Malwarebytes 2008-07-24 18:08:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-24 16:31:09 0 d-------- C:\Documents and Settings\User\Saved Games 2008-07-24 16:31:09 0 d-------- C:\Documents and Settings\User\Application Data\Flood Light Games 2008-07-24 16:31:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Flood Light Games 2008-07-24 16:30:56 0 d-------- C:\WINDOWS\Women's Murder Club - Death in Scarlet 2008-07-23 23:11:05 0 d-------- C:\Documents and Settings\User\Application Data\TweakNow PowerPack 2008-07-23 19:58:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Hot Lava Games 2008-07-23 19:57:33 0 d-------- C:\WINDOWS\Little Farm 2008-07-23 19:57:33 0 d-------- C:\Program Files\Little Farm 2008-07-23 11:00:39 0 d-------- C:\Documents and Settings\User\Application Data\Registry Booster 2008-07-23 09:38:03 0 d-------- C:\Documents and Settings\User\Application Data\Desktop Mechanic 2008-07-22 16:24:27 0 d-------- C:\Documents and Settings\User\Application Data\Nero 2008-07-22 16:19:00 0 d-------- C:\Program Files\Common Files\Nero 2008-07-22 15:10:03 0 d-------- C:\WINDOWS\Build in Time 2008-07-21 16:48:45 0 d-------- C:\Documents and Settings\User\Application Data\Canneverbe_Limited 2008-07-21 16:31:51 0 d-------- C:\Documents and Settings\User\Application Data\AudioMoves 2008-07-21 13:21:31 0 d-------- C:\Documents and Settings\User\Application Data\Bitdefender 2008-07-21 13:21:01 0 d-------- C:\Program Files\BitDefender 2008-07-21 13:21:01 0 d-------- C:\Documents and Settings\All Users\Application Data\BitDefender 2008-07-21 13:19:44 0 d-------- C:\Program Files\Common Files\BitDefender 2008-07-21 12:42:11 0 d-------- C:\Documents and Settings\User\Desktop 2008-07-21 12:41:52 0 d-------- C:\Documents and Settings\User\WINDOWS 2008-07-21 12:41:52 0 d-------- C:\Documents and Settings\User\Application Data\Vso 2008-07-21 12:41:52 0 d-------- C:\Documents and Settings\User\Application Data\Uniblue 2008-07-21 12:41:52 0 d-------- C:\Documents and Settings\User\Application Data\Lavasoft 2008-07-21 12:41:52 0 d-------- C:\Documents and Settings\User\Application Data\DMCache 2008-07-21 12:39:37 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-21 12:39:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-21 12:25:33 0 d-------- C:\Documents and Settings\User\My Documents 2008-07-21 11:26:04 0 dr------- C:\Documents and Settings\User\Favorites 2008-07-21 08:47:14 0 d-------- C:\Documents and Settings\User\Application Data\MagicDVDCreator 2008-07-20 19:12:53 5242880 --a------ C:\Documents and Settings\User\ntuser.dat 2008-07-20 10:45:47 0 --a------ C:\Program Files\temp01 2008-07-19 13:59:24 262144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll 2008-07-19 13:59:24 395776 --a------ C:\WINDOWS\system32\libmplayer.dll 2008-07-19 13:59:24 112640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll 2008-07-19 13:59:24 2255360 --a------ C:\WINDOWS\system32\libavcodec.dll 2008-07-19 12:31:37 81920 --a------ C:\Documents and Settings\User\Application Data\ezpinst.exe 2008-07-19 11:23:07 0 d-------- C:\Documents and Settings\All Users\Local Settings 2008-07-19 10:42:35 0 d-------- C:\Documents and Settings\User\Application Data\Desktopicon 2008-07-18 09:52:34 0 d--h----- C:\WINDOWS\Icons 2008-07-17 19:59:31 0 d-------- C:\Documents and Settings\User\Application Data\CyberLink 2008-07-17 19:41:51 81984 --a------ C:\WINDOWS\system32\bdod.bin 2008-07-17 18:24:15 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-17 18:24:02 0 d-------- C:\Documents and Settings\User\Application Data\Mozilla 2008-07-17 18:24:01 0 d-------- C:\Documents and Settings\User\Application Data\Thunderbird 2008-07-17 17:26:55 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2008-07-17 17:26:55 47360 --a------ C:\Documents and Settings\User\Application Data\pcouffin.sys 2008-07-17 14:59:51 0 d-------- C:\Documents and Settings\User\Application Data\URSoft 2008-07-17 14:59:33 0 d-------- C:\Program Files\Your Uninstaller 2008 2008-07-17 13:44:06 0 d-------- C:\Program Files\Yahoo! 2008-07-16 17:59:43 0 d-------- C:\Program Files\uTorrent 2008-07-16 17:59:37 0 d-------- C:\Documents and Settings\User\Application Data\uTorrent 2008-07-16 17:35:39 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-07-16 17:35:39 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-07-16 17:35:39 86528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-07-16 17:35:39 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-07-16 17:35:39 53248 --a------ C:\WINDOWS\system32\Process.exe 2008-07-16 17:35:39 82944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-07-16 17:35:39 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-07-16 17:35:39 81920 --a------ C:\WINDOWS\system32\404Fix.exe 2008-07-16 16:35:38 10752 --a------ C:\WINDOWS\system32\md5.dll 2008-07-16 13:14:57 0 d-------- C:\Webshots Data 2008-07-15 23:02:15 63 --a------ C:\WINDOWS\system\SysSD.dll 2008-07-15 15:24:50 0 d-------- C:\WINDOWS\pss 2008-07-15 15:07:14 0 d-------- C:\Documents and Settings\User\Application Data\TmpRecentIcons 2008-07-14 20:03:38 58594 --a------ C:\WINDOWS\system32\mpt.exe 2008-07-14 12:23:05 0 d-------- C:\WINDOWS\Sun 2008-07-14 12:19:51 0 d-------- C:\Garmin 2008-07-12 19:44:54 18944 --a------ C:\WINDOWS\system32\mpxa.exe 2008-07-12 13:09:37 0 d-------- C:\Program Files\Virtual Villagers - The Secret City 2008-07-12 13:09:32 0 d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache 2008-07-12 13:09:31 0 d-------- C:\Program Files\bfgclient 2008-07-12 12:06:27 0 d-------- C:\Documents and Settings\User\Application Data\Printparade 2008-07-12 12:06:10 143360 --a------ C:\WINDOWS\system32\leon3_32.dll 2008-07-12 12:06:10 374272 --a------ C:\WINDOWS\system32\Dav3_32.dll 2008-07-12 12:06:09 0 d-------- C:\Program Files\PrintParade Studio 2008-07-11 11:20:14 0 d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-07-10 17:40:52 0 d-------- C:\Downloads 2008-07-10 13:13:41 0 d-------- C:\Program Files\Mario Worlds 2008-07-07 13:24:53 0 d-------- C:\Documents and Settings\User\Application Data\Sun 2008-07-06 13:15:00 0 d-------- C:\Documents and Settings\User\Application Data\PlanetPlayMore 2008-07-06 13:14:17 0 d-------- C:\Program Files\Tropicabana 2008-07-04 12:11:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Ahead 2008-07-04 12:07:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-07-04 08:48:53 0 d-------- C:\Program Files\Flash Slideshow Maker Professional 2008-07-03 09:47:27 0 d-------- C:\Documents and Settings\User\Application Data\TuxPaint 2008-07-03 09:16:55 0 d-------- C:\Program Files\TuxPaint 2008-07-03 08:47:05 0 d-------- C:\Program Files\TuneUp Utilities 2008 2008-07-01 11:51:24 0 d-------- C:\Program Files\Microsoft Plus! 2008-07-01 11:33:44 0 d-------- C:\Documents and Settings\User\Application Data\TuneUp Software 2008-07-01 11:32:47 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-06-30 12:28:35 69632 --a------ C:\WINDOWS\system32\FreezeScreenSaver.exe 2008-06-30 12:28:34 761856 --a------ C:\WINDOWS\Lightning Storm.scr 2008-06-29 11:29:46 0 d-------- C:\Program Files\Build in Time -- Find3M Report --------------------------------------------------------------- 2008-07-28 13:42:48 64 --a------ C:\Documents and Settings\User\Application Data\default.pls 2008-07-28 11:12:30 0 d-------- C:\Program Files\Common Files 2008-07-28 10:25:08 34 --a------ C:\Documents and Settings\User\Application Data\pcouffin.log 2008-07-28 10:25:02 7887 --a------ C:\Documents and Settings\User\Application Data\pcouffin.cat 2008-07-28 10:25:01 1144 --a------ C:\Documents and Settings\User\Application Data\pcouffin.inf 2008-07-28 08:38:42 0 d-------- C:\Program Files\Java 2008-07-24 19:51:54 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-24 19:01:08 109 --a------ C:\WINDOWS\popcinfo.dat 2008-07-23 11:39:06 0 d-------- C:\Program Files\LimeWire 2008-07-23 11:39:05 0 d-------- C:\Program Files\Bejeweled 2 Deluxe 2008-07-22 16:19:00 0 d-------- C:\Program Files\Nero 2008-07-22 16:10:41 0 d-------- C:\Program Files\Common Files\Ahead 2008-07-18 10:31:54 0 d-------- C:\Program Files\Common Files\Adobe 2008-07-16 16:49:53 0 d-------- C:\Program Files\Ricochet Xtreme 2008-07-16 16:49:53 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-07-16 16:49:53 0 d-------- C:\Program Files\Insaniquarium Deluxe 2008-07-16 16:49:53 0 d-------- C:\Program Files\Bejeweled 2008-07-16 16:49:53 0 d-------- C:\Program Files\Alchemy 2008-07-15 16:17:55 0 d-------- C:\Documents and Settings\User\Application Data\LimeWire 2008-07-12 11:21:33 0 d-------- C:\Documents and Settings\User\Application Data\Adobe 2008-07-09 11:11:32 38 --a------ C:\Documents and Settings\User\Application Data\burnaware.ini 2008-07-04 12:28:19 0 d-------- C:\Program Files\Tradewinds Full Game 2008-07-04 09:07:18 0 d-------- C:\Documents and Settings\User\Application Data\Ahead 2008-06-30 12:35:16 0 d-------- C:\Program Files\Bonjour 2008-06-27 13:48:43 74703 --a------ C:\WINDOWS\system32\mfc45.dll 2008-06-27 10:25:01 0 d-------- C:\Program Files\Apple Software Update 2008-06-27 10:18:42 0 d-------- C:\Documents and Settings\User\Application Data\Apple Computer 2008-06-27 10:16:16 0 d-------- C:\Program Files\iTunes 2008-06-27 10:16:08 0 d-------- C:\Program Files\iPod 2008-06-27 10:15:47 0 d-------- C:\Program Files\QuickTime 2008-06-27 10:14:53 0 d-------- C:\Program Files\Common Files\Apple 2008-06-26 18:54:32 0 d-------- C:\Program Files\Kontiki 2008-06-26 16:23:52 0 d-------- C:\Program Files\Windows Live 2008-06-26 16:22:55 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-25 14:42:32 0 d-------- C:\Program Files\Webshots 2008-06-25 14:42:29 0 d-------- C:\Documents and Settings\User\Application Data\Webshots 2008-06-25 14:19:16 0 d-------- C:\Documents and Settings\User\Application Data\IObit 2008-06-25 14:19:15 0 d-------- C:\Program Files\IObit 2008-06-25 14:04:39 0 d-------- C:\Program Files\Common Files\xing shared 2008-06-25 14:03:37 0 d-------- C:\Program Files\Common Files\Real 2008-06-25 13:54:58 0 d-------- C:\Documents and Settings\User\Application Data\Real 2008-06-25 13:51:00 0 d-------- C:\Program Files\Real 2008-06-25 13:07:11 0 d-------- C:\Program Files\Cake Mania 2008-06-25 12:59:34 737280 --a------ C:\WINDOWS\iun6002.exe 2008-06-25 12:56:38 720896 --a------ C:\WINDOWS\iun6002ev.exe 2008-06-25 12:40:19 0 d-------- C:\Documents and Settings\User\Application Data\Macromedia 2008-06-25 12:02:15 0 d-------- C:\Program Files\ToniArts 2008-06-25 12:02:15 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-25 12:02:03 0 d-------- C:\Program Files\Common Files\InstallShield 2008-06-25 12:01:21 0 d-------- C:\Program Files\ReflexiveArcade 2008-06-25 10:59:05 0 d-------- C:\Program Files\Thomson 2008-06-25 10:55:43 0 d-------- C:\Program Files\Canon 2008-06-25 10:52:39 0 d-------- C:\Program Files\hp deskjet 845c series 2008-06-25 10:51:22 376 --a------ C:\WINDOWS\mozregistry.dat 2008-06-25 10:51:02 0 d-------- C:\Program Files\Hewlett-Packard 2008-06-24 14:54:27 0 d-------- C:\Program Files\Microsoft Works 2008-06-24 14:54:02 0 d-------- C:\Program Files\MSBuild 2008-06-24 14:52:26 0 d-------- C:\Program Files\Microsoft.NET 2008-06-24 14:50:17 0 d-------- C:\Program Files\Microsoft Visual Studio 8 2008-06-24 13:26:21 0 d-------- C:\Program Files\CyberLink 2008-06-24 12:42:05 0 d-------- C:\Program Files\Common Files\ODBC 2008-06-24 12:42:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-06-24 12:41:38 62 --ahs---- C:\Documents and Settings\User\Application Data\desktop.ini 2008-06-24 12:40:00 0 d-------- C:\Program Files\Windows Media Connect 2 2008-06-24 12:23:25 507904 --a------ C:\WINDOWS\system32\winlogon.exe 2008-06-24 12:02:51 0 d-------- C:\Documents and Settings\User\Application Data\Identities 2008-06-24 11:54:37 0 d-------- C:\Program Files\microsoft frontpage 2008-06-24 11:54:27 0 -rahs---- C:\MSDOS.SYS 2008-06-24 11:54:27 0 -rahs---- C:\IO.SYS 2008-06-24 11:54:27 0 --a------ C:\CONFIG.SYS 2008-06-24 11:54:27 0 --a------ C:\AUTOEXEC.BAT 2008-06-24 11:52:28 0 d-------- C:\Program Files\Common Files\MSSoap 2008-06-24 11:52:20 0 d-------- C:\Program Files\Movie Maker 2008-06-24 11:51:43 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-06-24 11:50:52 0 d-------- C:\Program Files\Online Services 2008-06-24 11:50:46 0 d-------- C:\Program Files\Messenger 2008-06-24 11:50:41 0 d-------- C:\Program Files\MSN Gaming Zone 2008-06-24 11:50:34 0 d-------- C:\Program Files\Windows NT -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-25 14:02] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 09:53] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 09:31] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-07-16 17:59] C:\Documents and Settings\User\Start Menu\Programs\Startup\ Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2008-06-25 14:42:29] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) "NoResolveSearch"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "LinkResolveIgnoreLinkInfo"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc bdx scan HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-07-28 15:38:04 ------------