Let's see, I used AVG Anti-Spyware, Combofix, Vunodfix, CCleaner, Cleaner, and smitfraudfix.
AVG and Smitfraud I used while in safe mode, while combofix and vundofix I used during normal mode.
SmitFraudFix v2.208
Scan done at 11:46:50.47, Mon 08/06/2007
Run from C:\Documents and Settings\X\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1E74E39C-2540-4840-B615-52A2EFF36CAD}: DhcpNameServer=68.87.77.130 68.87.72.130
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1E74E39C-2540-4840-B615-52A2EFF36CAD}: DhcpNameServer=68.87.77.130 68.87.72.130
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1E74E39C-2540-4840-B615-52A2EFF36CAD}: DhcpNameServer=68.87.77.130 68.87.72.130
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=68.87.77.130 68.87.72.130
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=68.87.77.130 68.87.72.130
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=68.87.77.130 68.87.72.130
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
ComboFix 07-08-06.5 - "X" 2007-08-06 15:00:55.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.490 [GMT -5:00]
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINNT\system32\drivers\sfsync02.sys
C:\WINNT\system32\gjllm.ini
C:\WINNT\system32\iifedbc.dll
C:\WINNT\system32\mlljg.dll
C:\WINNT\system32\qwerty12.exe
C:\WINNT\system32\scbywmiq.dll
C:\WINNT\system32\vqcxqdqe.dll
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_SFSYNC02
-------\sfsync02
((((((((((((((((((((((((( Files Created from 2007-07-06 to 2007-08-06 )))))))))))))))))))))))))))))))
2007-08-06 14:37 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-06 14:07 <DIR> d-------- C:\VundoFix Backups
2007-08-06 11:47 4,470 --a------ C:\WINNT\system32\tmp.reg
2007-08-06 11:46 53,248 --a------ C:\WINNT\system32\Process.exe
2007-08-06 11:46 51,200 --a------ C:\WINNT\system32\dumphive.exe
2007-08-06 11:46 288,417 --a------ C:\WINNT\system32\SrchSTS.exe
2007-08-06 11:31 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2d0.dat
2007-08-06 11:25 574,508 --a------ C:\WINNT\system32\ysrhfgfd.exe
2007-08-06 10:53 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-08-06 10:53 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-06 10:42 <DIR> d-------- C:\Program Files\CCleaner
2007-08-06 09:30 <DIR> d-------- C:\Deckard
2007-08-06 09:21 125,504 --a------ C:\WINNT\system32\blqnfcmi.dll
2007-08-03 15:06 <DIR> d-------- C:\Program Files\Pinnacle Systems
2007-08-03 13:58 <DIR> d-------- C:\Program Files\SmartSound Software
2007-08-03 13:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
2007-08-03 13:19 81,920 --a------ C:\WINNT\system32\vdrmux.dll
2007-08-03 13:19 76,800 --a------ C:\WINNT\system32\Lfwmf13n.dll
2007-08-03 13:19 73,728 --a------ C:\WINNT\system32\MMAviAx.dll
2007-08-03 13:19 73,728 --a------ C:\WINNT\system32\lffax13n.dll
2007-08-03 13:19 65,536 --a------ C:\WINNT\system32\Lfpct13n.dll
2007-08-03 13:19 46,592 --a------ C:\WINNT\system32\vdrcodec.dll
2007-08-03 13:19 453,120 --a------ C:\WINNT\system32\ltkrn13n.dll
2007-08-03 13:19 44,544 --a------ C:\WINNT\system32\msxml4a.dll
2007-08-03 13:19 40,960 --a------ C:\WINNT\system32\langserv.dll
2007-08-03 13:19 393,216 --a------ C:\WINNT\system32\LFCMP13n.DLL
2007-08-03 13:19 32,768 --a------ C:\WINNT\system32\MLPagAx.dll
2007-08-03 13:19 30,208 --a------ C:\WINNT\system32\lfbmp13n.dll
2007-08-03 13:19 294,912 --a------ C:\WINNT\system32\pvmjpg21.dll
2007-08-03 13:19 278,016 --a------ C:\WINNT\system32\LFJ2K13n.dll
2007-08-03 13:19 24,576 --a------ C:\WINNT\system32\lftga13n.dll
2007-08-03 13:19 204,881 --a------ C:\WINNT\system32\DiskIO.dll
2007-08-03 13:19 18,432 --a------ C:\WINNT\system32\Cachex.dll
2007-08-03 13:19 155,721 --a------ C:\WINNT\system32\RALMain.dll
2007-08-03 13:19 153,088 --a------ C:\WINNT\system32\ltfil13n.DLL
2007-08-03 13:19 143,360 --a------ C:\WINNT\system32\lftif13n.dll
2007-08-03 13:19 114,759 --a------ C:\WINNT\system32\Aviprax.dll
2007-08-03 13:19 1,693,696 --a------ C:\WINNT\system32\LTCLR13n.dll
2007-08-03 13:12 61,440 --a------ C:\WINNT\system32\pclepim1.dll
2007-08-03 13:12 49,152 --a------ C:\WINNT\system32\PCLEGetGuid.dll
2007-08-03 13:12 406,016 --a------ C:\WINNT\system32\PSDrvCheck.exe
2007-08-03 13:12 19,456 --a------ C:\WINNT\system32\asapi.dll
2007-08-03 13:12 11,264 --a------ C:\WINNT\system32\drivers\asapiW2k.sys
2007-08-03 10:49 125,504 --a------ C:\WINNT\system32\cdcuscnb.dll
2007-08-03 09:59 <DIR> d-------- C:\Program Files\SmartSound Software Inc
2007-08-03 08:58 <DIR> d--h-c--- C:\WINNT\$SQLUninstallMDAC28-KB927779-x86-ENU$
2007-08-02 11:18 1,110,528 --a------ C:\WINNT\system32\msxml3.dll
2007-08-02 11:16 33,340 --a------ C:\WINNT\system32\dbmsqlgc.dll
2007-08-02 11:15 <DIR> d-------- C:\Program Files\Microsoft SQL Server
2007-08-02 11:11 94,208 --a--c--- C:\WINNT\system32\dllcache\odbcint.dll
2007-08-02 11:11 94,208 --a------ C:\WINNT\system32\odbcint.dll
2007-08-02 11:11 90,112 --a--c--- C:\WINNT\system32\dllcache\msjro.dll
2007-08-02 11:11 73,728 --a--c--- C:\WINNT\system32\dllcache\msdaosp.dll
2007-08-02 11:11 73,728 --a------ C:\WINNT\system32\DBnetlib.dll
2007-08-02 11:11 73,728 --a------ C:\WINNT\system32\cliconfg.dll
2007-08-02 11:11 69,632 --a--c--- C:\WINNT\system32\dllcache\oledb32r.dll
2007-08-02 11:11 61,440 --a--c--- C:\WINNT\system32\dllcache\odbccu32.dll
2007-08-02 11:11 61,440 --a--c--- C:\WINNT\system32\dllcache\odbccr32.dll
2007-08-02 11:11 61,440 --a--c--- C:\WINNT\system32\dllcache\msadcf.dll
2007-08-02 11:11 61,440 --a------ C:\WINNT\system32\odbccu32.dll
2007-08-02 11:11 61,440 --a------ C:\WINNT\system32\odbccr32.dll
2007-08-02 11:11 53,248 --a--c--- C:\WINNT\system32\dllcache\msadrh15.dll
2007-08-02 11:11 53,248 --a--c--- C:\WINNT\system32\dllcache\msador15.dll
2007-08-02 11:11 507,904 --a--c--- C:\WINNT\system32\dllcache\msado15.dll
2007-08-02 11:11 49,152 --a--c--- C:\WINNT\system32\dllcache\msadcs.dll
2007-08-02 11:11 442,368 --a--c--- C:\WINNT\system32\dllcache\oledb32.dll
2007-08-02 11:11 44,032 --a--c--- C:\WINNT\system32\dllcache\msxml3r.dll
2007-08-02 11:11 44,032 --a------ C:\WINNT\system32\msxml3r.dll
2007-08-02 11:11 4,656 --a--c--- C:\WINNT\system32\dllcache\ds16gt.dll
2007-08-02 11:11 4,656 --a------ C:\WINNT\system32\ds16gt.dll
2007-08-02 11:11 4,096 --a--c--- C:\WINNT\system32\dllcache\msdaurl.dll
2007-08-02 11:11 4,096 --a--c--- C:\WINNT\system32\dllcache\msdasc.dll
2007-08-02 11:11 4,096 --a--c--- C:\WINNT\system32\dllcache\msdaer.dll
2007-08-02 11:11 4,096 --a--c--- C:\WINNT\system32\dllcache\msdaenum.dll
2007-08-02 11:11 4,096 --a--c--- C:\WINNT\system32\dllcache\msdadc.dll
2007-08-02 11:11 36,864 --a--c--- C:\WINNT\system32\dllcache\mscpxl32.dll
2007-08-02 11:11 36,864 --a------ C:\WINNT\system32\mscpxl32.dll
2007-08-02 11:11 32,768 --a--c--- C:\WINNT\system32\dllcache\odbcad32.exe
2007-08-02 11:11 32,768 --a--c--- C:\WINNT\system32\dllcache\msdfmap.dll
2007-08-02 11:11 32,768 --a------ C:\WINNT\system32\odbcad32.exe
2007-08-02 11:11 315,392 --a--c--- C:\WINNT\system32\dllcache\msadce.dll
2007-08-02 11:11 303,104 --a--c--- C:\WINNT\system32\dllcache\msdasql.dll
2007-08-02 11:11 28,672 --a------ C:\WINNT\system32\DBnmpntw.dll
2007-08-02 11:11 28,672 --a------ C:\WINNT\system32\dbmsgnet.dll
2007-08-02 11:11 26,224 --a--c--- C:\WINNT\system32\dllcache\odbc16gt.dll
2007-08-02 11:11 26,224 --a------ C:\WINNT\system32\odbc16gt.dll
2007-08-02 11:11 24,576 --a--c--- C:\WINNT\system32\dllcache\msxactps.dll
2007-08-02 11:11 24,576 --a--c--- C:\WINNT\system32\dllcache\msader15.dll
2007-08-02 11:11 24,576 --a--c--- C:\WINNT\system32\dllcache\msaddsr.dll
2007-08-02 11:11 24,576 --a------ C:\WINNT\system32\dbmsvinn.dll
2007-08-02 11:11 24,576 --a------ C:\WINNT\system32\dbmsrpcn.dll
2007-08-02 11:11 24,576 --a------ C:\WINNT\system32\dbmsadsn.dll
2007-08-02 11:11 225,280 --a--c--- C:\WINNT\system32\dllcache\msdaora.dll
2007-08-02 11:11 221,184 --a--c--- C:\WINNT\system32\dllcache\ODBC32.dll
2007-08-02 11:11 221,184 --a------ C:\WINNT\system32\ODBC32.dll
2007-08-02 11:11 20,480 --a--c--- C:\WINNT\system32\dllcache\msdatt.dll
2007-08-02 11:11 20,480 --a--c--- C:\WINNT\system32\dllcache\msadcer.dll
2007-08-02 11:11 20,480 --a------ C:\WINNT\system32\msorc32r.dll
2007-08-02 11:11 20,480 --a------ C:\WINNT\system32\cliconfg.exe
2007-08-02 11:11 192,512 --a--c--- C:\WINNT\system32\dllcache\msdaprst.dll
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
25-01-01 18:38 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Symantec
07-08-06 11:25 --------- d-------- C:\Program Files\Common Files\Symantec Shared
07-08-03 13:58 --------- d--h----- C:\Program Files\InstallShield Installation Information
07-08-03 12:19 --------- d-------- C:\Program Files\Pinnacle
07-08-02 21:05 --------- d-------- C:\Program Files\Bethesda Softworks
07-08-02 18:44 --------- d-------- C:\DOCUME~1\X\APPLIC~1\CoreFTP
07-08-01 18:48 17250 --a------ C:\WINNT\mozver.dat
07-07-23 20:30 --------- d-------- C:\Program Files\Canon
07-07-18 14:25 --------- d-------- C:\Program Files\EA GAMES
07-07-16 18:40 --------- d-------- C:\Program Files\Norton Internet Security
07-07-10 17:57 --------- d-------- C:\Program Files\WMV9_VCM
07-06-28 23:27 20898 --a------ C:\WINNT\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
07-06-28 23:27 164352 --a------ C:\WINNT\system32\SpoonUninstall.exe
07-06-28 23:27 --------- d-------- C:\Program Files\Illustrate
07-06-28 23:21 --------- d-------- C:\Program Files\Audacity
07-06-28 23:21 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Audacity
07-06-28 12:15 --------- d-------- C:\DOCUME~1\X\APPLIC~1\IBP
07-06-28 10:45 --------- d-------- C:\Program Files\CamStudio
07-06-27 21:08 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Viewpoint
07-06-26 22:24 --------- d-------- C:\Program Files\POP Peeper
07-06-25 12:27 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Azureus
07-06-25 09:05 --------- d-------- C:\Program Files\Real
07-06-22 11:59 --------- d-------- C:\DOCUME~1\X\APPLIC~1\MSNInstaller
07-06-20 09:04 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Reno 911 Paintball
07-06-18 13:46 --------- d-------- C:\DOCUME~1\X\APPLIC~1\fretsonfire
07-06-14 11:19 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Atari
07-06-14 09:10 --------- d-------- C:\Program Files\AIM6
07-06-12 21:23 --------- d-------- C:\DOCUME~1\X\APPLIC~1\Netscape
07-06-12 21:22 --------- d-------- C:\Program Files\Netscape
07-06-12 10:37 --------- d-------- C:\DOCUME~1\X\APPLIC~1\POP Peeper
07-06-06 19:31 --------- d-------- C:\DOCUME~1\X\APPLIC~1\OpenOffice.org2
07-05-20 09:58 65536 --a------ C:\WINNT\IFinst27.exe
07-05-12 21:22 169 --a------ C:\WINNT\system32\EUSOFT.SYS
07-05-07 18:21 737280 --a------ C:\WINNT\iun6002.exe
06-12-10 22:01 271 ---h----- C:\Program Files\desktop.ini
06-12-10 22:01 21952 ---h----- C:\Program Files\folder.htt
2007-03-16 15:16:46 56 --sha-r C:\WINNT\system32\E8D8992D70.sys
2007-03-20 01:23:33 1,890 --sha-w C:\WINNT\system32\KGyGaAvL.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 14:05 C:\WINNT\system32\mobsync.exe]
"Cmaudio"="cmicnfg.cpl" []
"NvCplDaemon"="C:\WINNT\System32\NvCpl.dll" [06-08-11 20:43 ]
"nwiz"="nwiz.exe" [06-08-11 20:43 C:\WINNT\system32\nwiz.exe]
"NvMediaCenter"="C:\WINNT\System32\NvMcTray.dll" [06-08-11 20:43 ]
"Logitech Utility"="Logi_MwX.Exe" [03-11-07 04:50 C:\WINNT\LOGI_MWX.EXE]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [01-07-09 12:50 ]
"projselector"="C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [03-10-16 17:25 ]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [03-05-01 19:44 ]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [03-10-16 21:15 ]
"RoxioAudioCentral"="C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [03-07-15 13:38 ]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [01-07-03 10:11 ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [07-01-08 18:03 ]
"SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [04-11-02 12:59 ]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [04-01-28 10:19 ]
"SaiSmart"="C:\Program Files\Saitek\Software\SaiSmart.exe" [04-01-28 10:19 ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [07-02-16 11:54 ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [07-07-12 04:00 ]
"PPHIDPAD"="C:\WINPENJR\Win32\pphidpad.exe" [01-10-02 11:23 ]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [03-12-01 11:38 ]
"PinnacleDriverCheck"="C:\WINNT\system32\PSDrvCheck.exe" [04-03-10 16:26 ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [07-08-06 11:07 ]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [05-06-02 17:03 ]
"POP Peeper"="C:\Program Files\POP Peeper\POPPeeper.exe" [06-11-15 23:02 ]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
R1 cdudf;cdudf;C:\WINNT\system32\drivers\cdudf.sys
R1 DVDVRRdr;DVDVRRdr;C:\WINNT\system32\drivers\DVDVRRdr.sys
R1 ppmoucls;ppmoucls;C:\WINNT\system32\DRIVERS\ppmoucls.sys
R1 pptchpad;PenPower Touchpad;C:\WINNT\system32\DRIVERS\pptchpd5.sys
R1 pwd_2k;pwd_2k;C:\WINNT\system32\drivers\pwd_2k.sys
R1 UdfReadr;UdfReadr;C:\WINNT\system32\drivers\UdfReadr.sys
R2 enodpl;enodpl;C:\WINNT\system32\drivers\enodpl.sys
R2 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Bethesda Softworks\SV\PI\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
R2 tandpl;tandpl;C:\WINNT\system32\drivers\tandpl.sys
R3 Cap7134;TVFM 503 WDM Video Capture;C:\WINNT\system32\DRIVERS\Cap7134.sys
R3 cmuda;C-Media WDM Audio Interface;C:\WINNT\system32\drivers\cmuda.sys
R3 dvd_2K;dvd_2K;C:\WINNT\system32\drivers\dvd_2K.sys
R3 Icam4USB;Intel PC Camera Pro;C:\WINNT\system32\Drivers\Icam4USB.sys
R3 itchfltr;iTouch Keyboard Filter;C:\WINNT\system32\DRIVERS\itchfltr.sys
R3 LCcfltr;Logitech USB Filter Driver;C:\WINNT\system32\Drivers\LCcFltr.Sys
R3 mmc_2K;mmc_2K;C:\WINNT\system32\drivers\mmc_2K.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINNT\system32\drivers\msmpu401.sys
R3 openhci;Microsoft USB Open Host Controller Driver;C:\WINNT\system32\DRIVERS\openhci.sys
R3 SaiClass;SaiClass;C:\WINNT\system32\drivers\SaiNtBus.sys
R3 SaiMini;SaiMini;C:\WINNT\system32\drivers\SaiMini.sys
S3 EagleNT;EagleNT;\??\C:\WINNT\system32\drivers\EagleNT.sys
S3 MPE;BDA MPE Filter;C:\WINNT\system32\DRIVERS\MPE.sys
S3 NCHSSVAD;SoundTap Recorder;C:\WINNT\system32\drivers\nchssvad.sys
S3 SaiNtHid;SaiNtHid;C:\WINNT\system32\DRIVERS\SaiNtHid.sys
S3 SaiNtSub;SaiNtSub;C:\WINNT\system32\DRIVERS\SaiNtSub.sys
S3 scrcap;scrcap;C:\WINNT\system32\DRIVERS\scrcap.sys
S3 SiS630;SiS630;C:\WINNT\system32\DRIVERS\sis630p.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Bethesda Softworks\SV\PI\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR
S3 StillCam;Still Serial Digital Camera Driver;C:\WINNT\system32\DRIVERS\serscan.sys
Contents of the 'Scheduled Tasks' folder
2006-12-17 12:07:14 C:\WINNT\Tasks\Norton AntiVirus - Scan my computer - Stan Siu.job - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-08-06 15:11:01
Windows 5.0.2195 Service Pack 4 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSSYCLM]
"Start"=dword:d00e0325
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-06 15:13:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-08-06 15:12
--- E O F ---
VundoFix V6.5.6
Checking Java version...
Java version is 1.5.0.10
Java version is 1.5.0.11
Scan started at 3:22:24 PM 8/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.6
Checking Java version...
Java version is 1.5.0.10
Java version is 1.5.0.11
Scan started at 3:23:26 PM 8/6/2007
Listing files found while scanning....
No infected files were found.
I can't seem to find the AVG, CCleaner, or Cleaner log. Maybe it didn't record it. I'm assuming you want my new log for DSS so...
Deckard's System Scanner v20070804.61
Run by Kenneth on 2007-08-07 at 14:46:04
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis (run as Kenneth.exe) ---------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:46:14 PM, on 8/7/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Bethesda Softworks\SV\PI\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\RunDll32.exe
C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINPENJR\Win32\pphidpad.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\POP Peeper\POPPeeper.exe
C:\Program Files\Netscape\Navigator 9\navigator.exe
C:\Internet download\Other\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Kenneth.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about
:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [PPHIDPAD] C:\WINPENJR\Win32\pphidpad.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [POP Peeper] "C:\Program Files\POP Peeper\POPPeeper.exe" -min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} -
http://plug-in.reallusion.com/CrazyTalk4.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1176860841987
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) -
http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) -
http://gamedownload.ijjimax.com/game...lugin10USA.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 9437 bytes
-- Files created between 2007-07-07 and 2007-08-07 -----------------------------
2025-01-01 18:38:16 0 d-------- C:\Documents and Settings\Kenneth\Application Data\Symantec
2007-08-07 14:36:31 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_2d0.dat
2007-08-07 08:30:33 0 d-------- C:\Documents and Settings\Kenneth\Application Data\fretsonfire
2007-08-06 11:47:00 4470 --a------ C:\WINNT\system32\tmp.reg
2007-08-06 11:46:34 288417 --a------ C:\WINNT\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-08-06 11:46:34 53248 --a------ C:\WINNT\system32\Process.exe <Not Verified;
http://www.beyondlogic.org; Command Line Process Utility>
2007-08-06 11:46:34 51200 --a------ C:\WINNT\system32\dumphive.exe
2007-08-06 11:25:02 574508 --a------ C:\WINNT\system32\ysrhfgfd.exe
2007-08-06 11:22:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-08-06 10:53:37 0 d-------- C:\Program Files\Trend Micro
2007-08-06 09:21:05 125504 --a------ C:\WINNT\system32\blqnfcmi.dll
2007-08-03 15
14 0 d-------- C:\Program Files\Pinnacle Systems
2007-08-03 13:58:10 0 d-------- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2007-08-03 13:58:09 0 d-------- C:\Program Files\SmartSound Software
2007-08-03 13:19:36 155721 --a------ C:\WINNT\system32\RALMain.dll <Not Verified; Pinnacle Systems GmbH; Register Abstraction Layer>
2007-08-03 13:19:36 204881 --a------ C:\WINNT\system32\DiskIO.dll <Not Verified; Pinnacle Systems GmbH; Media File Sequencer>
2007-08-03 13:19:35 81920 --a------ C:\WINNT\system32\vdrmux.dll <Not Verified; Pinnacle Systems; Pinnacle Systems vdrmux>
2007-08-03 13:19:35 46592 --a------ C:\WINNT\system32\vdrcodec.dll <Not Verified; Pinnacle Systems; Studio 600>
2007-08-03 13:19:35 294912 --a------ C:\WINNT\system32\pvmjpg21.dll <Not Verified; Pegasus Imaging Corporation; PICVideo>
2007-08-03 13:19:34 44544 --a------ C:\WINNT\system32\msxml4a.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1>
2007-08-03 13:19:34 73728 --a------ C:\WINNT\system32\MMAviAx.dll <Not Verified; Pinnacle Systems GmbH; miroVIDEO MFP>
2007-08-03 13:19:34 32768 --a------ C:\WINNT\system32\MLPagAx.dll <Not Verified; Pinnacle Systems GmbH; MLPag DLL>
2007-08-03 13:19:34 40960 --a------ C:\WINNT\system32\langserv.dll <Not Verified; Pinnacle Systems GmbH; miroVIDEO LangServ>
2007-08-03 13:19:34 18432 --a------ C:\WINNT\system32\Cachex.dll <Not Verified; Pinnacle Systems GmbH; Cache DLL>
2007-08-03 13:19:34 114759 --a------ C:\WINNT\system32\Aviprax.dll <Not Verified; Pinnacle Systems GmbH; miroVIDEO AFP>
2007-08-03 13:12:56 11264 --a------ C:\WINNT\system32\drivers\asapiW2k.sys <Not Verified; Pinnacle Systems GmbH; asapi>
2007-08-03 13:12:54 406016 --a------ C:\WINNT\system32\PSDrvCheck.exe
2007-08-03 13:12:53 19456 --a------ C:\WINNT\system32\asapi.dll <Not Verified; VoB Computersysteme GmbH; >
2007-08-03 13:12:12 61440 --a------ C:\WINNT\system32\pclepim1.dll <Not Verified; Pinnacle Systems; Microsoft Windows>
2007-08-03 13:12:09 49152 --a------ C:\WINNT\system32\PCLEGetGuid.dll <Not Verified; Pinnacle Systems; Guid_dll>
2007-08-03 10:49:09 125504 --a------ C:\WINNT\system32\cdcuscnb.dll
2007-08-03 09:59:13 0 d-------- C:\Program Files\SmartSound Software Inc
2007-08-03 08:58:47 0 d--h---c- C:\WINNT\$SQLUninstallMDAC28-KB927779-x86-ENU$
2007-08-02 11:45:41 0 --a------ C:\WINNT\2
2007-08-02 11:42:16 18 --a------ C:\WINNT\?
2007-08-02 11:15:29 0 d-------- C:\Program Files\Microsoft SQL Server
2007-07-27 09:35:33 0 d-------- C:\Program Files\notepad2
2007-07-24 16:26:17 0 d-------- C:\Program Files\Qualcomm
2007-07-22 16:57:47 0 d-------- C:\Program Files\Virtools
2007-07-21 22:17:38 0 d-------- C:\WINNT\Simpson Backround
2007-07-18 18:38:16 0 d-------- C:\Program Files\Mozilla Thunderbird
2007-07-18 14:36:00 595 --a------ C:\WINNT\eReg.dat
2007-07-15 23
24 0 d-------- C:\Program Files\Three Rings Design
2007-07-15 23:00:02 0 d-------- C:\Documents and Settings\Kenneth\Application Data\yoclient
2007-07-13 20:22:13 0 d-------- C:\Program Files\DivX
2007-07-12 10:01:55 83968 --a------ C:\WINNT\UnGins.exe
2007-07-11 09:19:22 0 d-------- C:\Program Files\Toolkit3
2007-07-11 08:38:47 283862 --a------ C:\WINNT\system32\smpeg.dll
2007-07-11 08:38:47 310849 --a------ C:\WINNT\system32\SDL_ttf.dll
2007-07-11 08:38:47 396903 --a------ C:\WINNT\system32\SDL_mixer.dll
2007-07-11 08:38:47 211033 --a------ C:\WINNT\system32\SDL_image.dll
2007-07-11 08:38:47 335629 --a------ C:\WINNT\system32\SDL.dll
2007-07-10 17:51:18 53248 --a------ C:\WINNT\system32\zlib.dll <Not Verified; ; ZLib.DLL>
2007-07-10 17:51:18 356352 --a------ C:\WINNT\system32\SciLexer.dll <Not Verified; Neil Hodgson
neilh@scintilla.org; Scintilla>
2007-07-10 17:51:18 352256 --a------ C:\WINNT\system32\libmng.dll
2007-07-10 17:51:18 368640 --a------ C:\WINNT\system32\js32.dll
2007-07-10 17:51:18 233472 --a------ C:\WINNT\system32\corona.dll
2007-07-10 17:51:18 618496 --a------ C:\WINNT\system32\audiere.dll <Not Verified;
http://aegisknight.org/; audiere>
2007-07-10 17:17:43 0 --a------ C:\WINNT\a
2007-07-10 17:17:23 317952 -ra------ C:\WINNT\system32\Roboex32.dll <Not Verified; Blue Sky Software Corporation.; RoboHELP Classic>
2007-07-10 17:17:23 48640 -ra------ C:\WINNT\system32\INETWH32.DLL <Not Verified; Blue Sky Software; Blue Sky Software - INETWH32>
-- Find3M Report ---------------------------------------------------------------
2007-08-07 14:46:23 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-08-07 10:26:24 1099632 ---h----- C:\WINNT\ShellIconCache
2007-08-06 18:31:32 504551 --a------ C:\WINNT\system32\Line Rider Theater.scr <Not Verified; Axialis Software; Axialis Screen Saver Producer>
2007-08-03 13:58:22 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-08-03 12:19:17 0 d-------- C:\Program Files\Pinnacle
2007-08-02 22:28:47 18 --a------ C:\WINNT\?
2007-08-02 21:05:24 0 d-------- C:\Program Files\Bethesda Softworks
2007-08-02 18:44:57 0 d-------- C:\Documents and Settings\Kenneth\Application Data\CoreFTP
2007-08-01 18:48:23 17250 --a------ C:\WINNT\mozver.dat
2007-07-25 13:34:21 0 d-------- C:\Program Files\Java
2007-07-23 20:30:27 0 d-------- C:\Program Files\Canon
2007-07-18 14:25:48 0 d-------- C:\Program Files\EA GAMES
2007-07-16 18:40:24 0 d-------- C:\Program Files\Norton Internet Security
2007-07-10 17:57:12 0 d-------- C:\Program Files\WMV9_VCM
2007-06-28 23:27:59 20898 --a------ C:\WINNT\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
2007-06-28 23:27:59 164352 --a------ C:\WINNT\system32\SpoonUninstall.exe
2007-06-28 23:27:51 0 d-------- C:\Program Files\Illustrate
2007-06-28 23:21:15 0 d-------- C:\Program Files\Audacity
2007-06-28 23:21:15 0 d-------- C:\Documents and Settings\Kenneth\Application Data\Audacity
2007-06-28 12:15:32 0 d-------- C:\Documents and Settings\Kenneth\Application Data\IBP
2007-06-28 10:45:24 0 d-------- C:\Program Files\CamStudio
2007-06-26 22:24:59 0 d-------- C:\Program Files\POP Peeper
2007-06-25 09:05:58 0 d-------- C:\Program Files\Real
2007-06-22 11:59:16 0 d-------- C:\Documents and Settings\Kenneth\Application Data\MSNInstaller
2007-06-14 11:19:15 0 d-------- C:\Documents and Settings\Kenneth\Application Data\Atari
2007-06-14 09:10:52 0 d-------- C:\Program Files\AIM6
2007-06-12 21:23:26 0 d-a------ C:\Program Files\Common Files
2007-06-12 21:23:26 0 d-------- C:\Documents and Settings\Kenneth\Application Data\Netscape
2007-06-12 21:22:17 0 d-------- C:\Program Files\Netscape
2007-06-12 10:37:57 0 d-------- C:\Documents and Settings\Kenneth\Application Data\POP Peeper
2007-05-20 09:58:30 65536 --a------ C:\WINNT\IFinst27.exe
2007-05-12 21:22:33 169 --a------ C:\WINNT\system32\EUSOFT.SYS
2007-05-07 18:21:42 737280 --a------ C:\WINNT\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [06/19/03 02:05p C:\WINNT\system32\mobsync.exe]
"Cmaudio"="cmicnfg.cpl" []
"NvCplDaemon"="C:\WINNT\System32\NvCpl.dll" [08/11/06 08:43p]
"nwiz"="nwiz.exe" [08/11/06 08:43p C:\WINNT\system32\nwiz.exe]
"NvMediaCenter"="C:\WINNT\System32\NvMcTray.dll" [08/11/06 08:43p]
"Logitech Utility"="Logi_MwX.Exe" [11/07/03 04:50a C:\WINNT\LOGI_MWX.EXE]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [07/09/01 12:50p]
"projselector"="C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" [10/16/03 05:25p]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/03 07:44p]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [10/16/03 09:15p]
"RoxioAudioCentral"="C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [07/15/03 01:38p]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [07/03/01 10:11a]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/08/07 06:03p]
"SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [11/02/04 12:59p]
"Profiler"="C:\Program Files\Saitek\Software\Profiler.exe" [01/28/04 10:19a]
"SaiSmart"="C:\Program Files\Saitek\Software\SaiSmart.exe" [01/28/04 10:19a]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/07 11:54a]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [07/12/07 04:00a]
"PPHIDPAD"="C:\WINPENJR\Win32\pphidpad.exe" [10/02/01 11:23a]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [12/01/03 11:38a]
"PinnacleDriverCheck"="C:\WINNT\system32\PSDrvCheck.exe" [03/10/04 04:26p]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [06/02/05 05:03p]
"POP Peeper"="C:\Program Files\POP Peeper\POPPeeper.exe" [11/15/06 11:02p]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
-- End of Deckard's System Scanner: finished at 2007-08-07 at 14:47:03 ---------