I have a trojan that resides in my Temp Files and the Content.IE5 folder in Local Settings. I've done many different things from full scans in safe mode and online scans, and vundofix.exe. All of the scans seem to slow it down, but it returns. Heres the dss log. Thanks for any help in advance.
Deckard's System Scanner v20070807.62
Run by me on 2007-08-09 at 20:27:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
10: 2007-08-10 00:27:29 UTC - RP10 - Deckard's System Scanner Restore Point
9: 2007-08-07 02:39:38 UTC - RP9 - System Checkpoint
8: 2007-08-04 19:54:23 UTC - RP8 - Software Distribution Service 3.0
7: 2007-08-04 05:21:22 UTC - RP7 - Removed Command & Conquer 3 Tiberium Wars™ Demo.
6: 2007-08-04 05:13:29 UTC - RP6 - Installed Windows Internet Explorer 7.
-- First Restore Point --
1: 2007-08-04 04:07:23 UTC - RP1 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as me.exe) --------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 8:28:26 PM, on 8/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\me\My Documents\_Jake\Downloads & Apps\Programs\Spyware Tools\dss.exe
C:\DOCUME~1\me\MYDOCU~1\_Jake\DOWNLO~1\Programs\SPYWAR~1\HIJACK~1\me.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7} - (no file)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: (no name) - {3F17C32D-CE1B-452E-8830-F0E86E79AFEF} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - (no file)
O2 - BHO: (no name) - {CC23617D-6A1A-4F06-B96B-2F16CDA3C973} - C:\WINDOWS\system32\pmkhi.dll
O2 - BHO: (no name) - {FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F} - C:\WINDOWS\system32\efccbaa.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\litlvmdj.dll",forkonce
O4 - HKLM\..\RunServices: [WindXpUpdate32] WindXpUpdate
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -
http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: awvvv - C:\WINDOWS\system32\awvvv.dll (file missing)
O20 - Winlogon Notify: byxwv - C:\WINDOWS\system32\byxwv.dll (file missing)
O20 - Winlogon Notify: efccbaa - C:\WINDOWS\SYSTEM32\efccbaa.dll
O20 - Winlogon Notify: pmkhi - C:\WINDOWS\system32\pmkhi.dll
O20 - Winlogon Notify: wincsg32 - wincsg32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R0 giveio - c:\windows\system32\giveio.sys
R0 hotcore - c:\windows\system32\drivers\hotcore.sys <Not Verified; Paragon Software Group; HotBackup>
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
R1 Ext2fs - c:\windows\system32\drivers\ext2fs.sys
R1 fanio (FanIO driver) - c:\windows\system32\drivers\fanio.sys <Not Verified; Christian Diefer; fanio.sys>
R1 IfsDrives - c:\windows\system32\drivers\ifsdrives.sys
R1 OMCI (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.2.1.0) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.2>
R2 ousbehci (NEC PCI to USB Enhanced Host Controller) - c:\windows\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver>
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>
R3 ousb2hub (OrangeWare USB 2.0 Hub Support) - c:\windows\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver>
S0 gdxwdm - c:\windows\system32\drivers\gdxwdm.sys (file missing)
S3 CO_Mon - c:\windows\system32\drivers\co_mon.sys
S3 efipsk - c:\docume~1\me\locals~1\temp\efipsk.sys (file missing)
S3 NAL (Nal Service ) - c:\windows\system32\drivers\iqvw32.sys <Not Verified; Intel Corporation; Intel(R) iQVW32.SYS>
S3 SIWIO - c:\windows\temp\siwio.sys (file missing)
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 RegSrvc - c:\windows\system32\regsrvc.exe <Not Verified; Intel Corporation; RegSrvc Module>
R2 StarWindServiceAE (StarWind AE Service) - c:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom 570x Gigabit Integrated Controller
Device ID: PCI\VEN_14E4&DEV_165D&SUBSYS_865D1028&REV_01\4&39A85202&0&00F0
Manufacturer: Broadcom
Name: Broadcom 570x Gigabit Integrated Controller #2
PNP Device ID: PCI\VEN_14E4&DEV_165D&SUBSYS_865D1028&REV_01\4&39A85202&0&00F0
Service: b57w2k
-- Files created between 2007-07-09 and 2007-08-09 -----------------------------
2014-02-15 15:15:33 966656 --a------ C:\WINDOWS\system32\W70MLRES.DLL <Not Verified; Intel Corporation; Intel(R) PRO/Wireless 7100 Adapter>
2014-02-15 15:15:33 983040 --a------ C:\WINDOWS\system32\W20MLRES.DLL <Not Verified; Intel Corporation; Intel(R) PRO/Wireless 2100 Adapter>
2014-02-15 15:10:07 0 d-------- C:\Program Files\Apoint
2014-02-15 15:08:36 0 d-------- C:\Program Files\CONEXANT
2014-02-15 15
26 0 d-------- C:\Program Files\Intel
2014-02-15 15:05:57 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2014-02-15 14:57:14 0 d-------- C:\Program Files\SigmaTel
2014-02-15 14:57:02 0 d-------- C:\dell
2014-02-15 14:55:02 176128 --a------ C:\WINDOWS\system32\RcdScan.dll <Not Verified; Dell Computer Corporation; RcdScan Module>
2014-02-15 14:55:02 446464 -ra------ C:\WINDOWS\system32\hhactivex.dll <Not Verified; Blue Sky Software Corporation.; RoboHELP HTML 2000>
2014-02-15 14:54:57 0 d--h----- C:\Program Files\InstallShield Installation Information
2014-02-15 14:54:40 0 d-------- C:\Program Files\Common Files\InstallShield
2014-02-15 14:24:31 51 --a------ C:\WINDOWS\WFXDEL.BAT
2014-02-15 14:23:20 0 d-------- C:\Documents and Settings\me\WINDOWS
2014-02-15 14:21:53 24848 --a------ C:\WINDOWS\system32\msjter35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2014-02-15 14:21:53 123664 --a------ C:\WINDOWS\system32\Msjint35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2014-02-15 14:21:52 252176 --a------ C:\WINDOWS\system32\msrd2x35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2014-02-15 14:21:51 1046288 --a------ C:\WINDOWS\system32\msjet35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet>
2014-02-15 14:21:50 368912 --a------ C:\WINDOWS\system32\vbar332.dll <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Applications>
2014-02-15 14:20:23 0 d---s---- C:\WINDOWS\system32\Microsoft
2014-02-15 14:19:55 0 d-------- C:\Documents and Settings\me\Application Data\Symantec
2014-02-15 14:19:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2014-02-15 14:19:46 0 d-------- C:\Program Files\Symantec
2014-02-15 14:19:35 0 d-------- C:\Program Files\Common Files\Symantec Shared
2014-02-15 14:19:31 94208 --a------ C:\WINDOWS\system32\msstkprp.dll <Not Verified; Microsoft Corporation; msprop32>
2014-02-15 14:19:27 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2007-08-09 20:19:31 125504 --a------ C:\WINDOWS\system32\litlvmdj.dll
2007-08-08 00:56:42 0 dr-h----- C:\Documents and Settings\me\Recent
2007-08-07 08:18:39 125504 -----n--- C:\WINDOWS\system32\bgkugaew.dll
2007-08-06 20:00:32 231520 -----n--- C:\WINDOWS\system32\pmkhi.dll
2007-08-04 17:39:13 0 d-------- C:\Program Files\Megaman - X Rush to Battle
2007-08-04 16:45:19 0 d-------- C:\Program Files\Common Files\Viewpoint
2007-08-04 00:51:57 0 d-------- C:\WINDOWS\network diagnostic
2007-08-03 11:51:13 1757899 --ahs---- C:\WINDOWS\system32\vvvwa.bak2
2007-08-02 18:40:40 6467 --ahs---- C:\WINDOWS\system32\vvvwa.bak1
2007-07-16 00:21:55 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2007-07-16 00:20:53 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2007-07-15 22:36:37 1764627 --ahs---- C:\WINDOWS\system32\vwxyb.bak2
2007-07-15 02:23:09 0 d-------- C:\Documents and Settings\Administrator\Application Data\Simply Super Software
2007-07-15 02:22:13 0 d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-07-15 02:20:28 0 d-------- C:\WINDOWS\CSC
2007-07-14 22:58:15 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-07-14 22:54:58 0 d-------- C:\Documents and Settings\me\Application Data\Simply Super Software
2007-07-10 21:59:13 0 d-------- C:\Documents and Settings\me\Application Data\Grisoft
2007-07-10 21:09:45 0 d-------- C:\Program Files\DHShutdown
2007-07-10 20:49:23 28672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-07-10 20:07:16 0 d-------- C:\WINDOWS\system32\Panda Software
2007-07-10 01:02:44 0 d-------- C:\Program Files\FrostWire
-- Find3M Report ---------------------------------------------------------------
2007-08-09 20:16:18 0 d-------- C:\Program Files\Mozilla Thunderbird
2007-08-08 00:57:48 0 d-------- C:\Documents and Settings\me\Application Data\AVG7
2007-08-05 10:22:36 0 d-------- C:\Program Files\Winamp
2007-08-04 18:35:08 0 d-------- C:\Program Files\Viewpoint
2007-08-04 18:31:11 0 d-------- C:\Program Files\SpeedFan
2007-08-04 16:45:19 0 d-------- C:\Program Files\Common Files
2007-08-04 16:12:22 0 d-------- C:\Documents and Settings\me\Application Data\FrostWire
2007-08-04 00:21:36 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll <Not Verified; BitComet; BitComet BCTP Helper>
2007-08-04 00:21:07 0 d-------- C:\Program Files\BitComet
2007-08-03 20:09:54 0 d-------- C:\Documents and Settings\me\Application Data\OpenOffice.org2
2007-07-24 01:34:32 0 d-------- C:\Program Files\Common Files\Adobe
2007-07-15 09:58:33 0 d-------- C:\Program Files\Common Files\WhenU
2007-07-10 20:07:20 0 d-------- C:\Program Files\System Shock 2
2007-07-10 18:56:25 14506 --a------ C:\WINDOWS\mozver.dat
2007-07-10 01:05:23 0 d-------- C:\Program Files\Java
2007-07-07 19:29:41 0 d-------- C:\Documents and Settings\me\Application Data\uTorrent
2007-07-07 19:21:09 0 d-------- C:\Program Files\LucasArts
2007-07-07 11:34:38 31254 -----n--- C:\WINDOWS\system32\efccbaa.dll
2007-07-05 13:08:54 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2007-07-01 01:01:40 0 d-------- C:\Program Files\Combined Community Codec Pack
2007-06-30 02:39:41 285 --a------ C:\WINDOWS\EReg072.dat
2007-06-05 21:56:04 335 --a----c- C:\WINDOWS\nsreg.dat
2007-06-05 21:55:30 118784 --a------ C:\WINDOWS\GREUninstall.exe
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F17C32D-CE1B-452E-8830-F0E86E79AFEF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC23617D-6A1A-4F06-B96B-2F16CDA3C973}]
08/06/2007 08:00 PM 231520 --------- C:\WINDOWS\system32\pmkhi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F}]
07/07/2007 11:34 AM 31254 --------- C:\WINDOWS\system32\efccbaa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [03/14/2007 03:43 AM]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [05/28/2003 05:32 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [05/25/2007 12:43 AM]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [07/29/2003 02:30 PM]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [06/11/2003 12:07 AM]
"Comodo Firewall"="C:\Program Files\Comodo\Firewall\CPF.exe" [02/06/2007 07:16 PM]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [01/02/2006 05:41 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM]
"SystemOptimizer"="C:\WINDOWS\system32\litlvmdj.dll" [08/09/2007 08:19 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [07/02/2007 06:29 AM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"WindXpUpdate32"=WindXpUpdate
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsHistory"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F}"= C:\WINDOWS\system32\efccbaa.dll [07/07/2007 11:34 AM 31254]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awvvv]
C:\WINDOWS\system32\awvvv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxwv]
C:\WINDOWS\system32\byxwv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efccbaa]
efccbaa.dll 07/07/2007 11:34 AM 31254 C:\WINDOWS\system32\efccbaa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhi]
C:\WINDOWS\system32\pmkhi.dll 08/06/2007 08:00 PM 231520 C:\WINDOWS\system32\pmkhi.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wincsg32]
wincsg32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^me^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\me\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"J:\Program Files\Steam\Steam.exe" -silent
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
"C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindXpUpdate32]
WindXpUpdate
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e6379e0-942c-11db-a45e-000cf149f678}]
AutoRun\command- F:\wd_windows_tools\setup.exe
-- Hosts -----------------------------------------------------------------------
127.0.0.1 serial.alcohol-soft.com
127.0.0.1
www.alcohol-soft.com
127.0.0.1 images.alcohol-soft.com
127.0.0.1 trial.alcohol-soft.com
127.0.0.1 alcohol-soft.com
-- End of Deckard's System Scanner: finished at 2007-08-09 at 20:29:34 ---------