Deckard's System Scanner v20070905.67
Run by all users on 2007-10-05 16:21:41
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
System Restore is disabled; attempting to re-enable...success.
-- Last 1 Restore Point(s) --
1: 2007-10-05 15:21:45 UTC - RP1 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
Percentage of Memory in Use: 76% (more than 75%).
Total Physical Memory: 495 MiB (512 MiB recommended).
-- HijackThis (run as all users.exe) -------------------------------------------
Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-10-05 16:23:09
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16512)
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Media Center Diagnostic Kit\Tests\Bin\ehMonitor.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
C:\Documents and Settings\all users.silver\Desktop\dss.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {733E9132-53CA-4C97-9AC9-145C4502FA20} - C:\WINDOWS\system32\yaywxwv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\oqqsqcyj.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {EF51CC67-7E7A-4989-A2A7-01D7BAACB0A5} - C:\WINDOWS\system32\sstts.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKEY_LOCAL_MACHINE\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Alienware Dock.lnk = C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - ?p=ZJfox000
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) -
http://courses.learndirect.co.uk/pro...er/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{57E675E6-1867-49DB-B52E-79071F46A97D}: NameServer = 192.168.1.1,212.159.11.150
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{DBED8F7B-7929-47CC-9E4D-A0F9673FAFE1}: NameServer = 192.168.1.1,212.159.11.150
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O20 - AppInit_DLLs: wbsys.dll
O20 - Winlogon Notify: sstts - C:\WINDOWS\system32\sstts.dll
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O20 - Winlogon Notify: yaywxwv - C:\WINDOWS\system32\yaywxwv.dll
O22 - SharedTaskScheduler: blippers - {f2efa195-4785-4db1-9316-b48c64bb71da} - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
-- HijackThis Fixed Entries (C:\DOCUME~1\ALLUSE~1.SIL\Desktop\~D_KRY~1\HIJACK~1\backups\) --------------------------------------------------------------------------------
backup-20070114-131913-357 O4 - HKLM\..\Run: [chicsaveinterbook] C:\Documents and Settings\All Users\Application Data\64ShimChicSave\bashloud.exe
backup-20070114-132054-918 O21 - SSODL: blippers - {f2efa195-4785-4db1-9316-b48c64bb71da} - (no file)
-- File Associations -----------------------------------------------------------
.bat - batfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,71
.inf - inffile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
.ini - inifile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
.txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,70
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>
R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>
R0 sfsync04 (StarForce Protection Synchronization Driver (version 4.x)) - c:\windows\system32\drivers\sfsync04.sys <Not Verified; Protection Technology (StarForce); SF FrontLine>
R0 sfvfs02 (StarForce Protection VFS Driver (version 2.x)) - c:\windows\system32\drivers\sfvfs02.sys <Not Verified; Protection Technology; StarForce Protection System>
R2 atksgt - c:\windows\system32\drivers\atksgt.sys
R2 lirsgt - c:\windows\system32\drivers\lirsgt.sys
S2 Ca533av (Icatch(IV) Video Camera Device) - c:\windows\system32\drivers\ca533av.sys (file missing)
S3 USBCamera (Icatch(IV) Still Camera Device) - c:\windows\system32\drivers\bulk533.sys (file missing)
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Scheduled Tasks -------------------------------------------------------------
2007-09-30 09:00:00 386 --a------ C:\WINDOWS\Tasks\rpc.job
-- Files created between 2007-09-05 and 2007-10-05 -----------------------------
2007-10-04 20:24:40 77376 --a------ C:\WINDOWS\system32\oqqsqcyj.dll
2007-10-04 20:21:40 83008 --a------ C:\WINDOWS\system32\rwboqyvq.dll
2007-10-03 21:25:28 0 d-------- C:\Program Files\Lavasoft
2007-10-03 21:25:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 21:24:42 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-02 20:33:28 0 d-------- C:\info
2007-10-02 19:16:29 83008 --a------ C:\WINDOWS\system32\helylmqg.dll
2007-10-01 23:00:33 212 --a------ C:\delete.bat
2007-10-01 17:02:27 83008 --a------ C:\WINDOWS\system32\fjxflerf.dll
2007-09-30 11:59:24 0 d-------- C:\Documents and Settings\Guest\Application Data\Mozilla
2007-09-30 10:38:28 83008 --a------ C:\WINDOWS\system32\cusrjekg.dll
2007-09-30 10:01:33 83008 --a------ C:\WINDOWS\system32\oipqysfv.dll
2007-09-30 08:58:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\WINDOWS
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\Templates
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\Start Menu
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\SendTo
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\Recent
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\PrintHood
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\NetHood
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\My Documents
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\Local Settings
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\Favorites
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Desktop
2007-09-30 00:27:11 0 d--hs---- C:\Documents and Settings\Guest\Cookies
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\Application Data
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\SampleView
2007-09-30 00:27:11 0 d---s---- C:\Documents and Settings\Guest\Application Data\Microsoft
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Identities
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\CyberLink
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Apple Computer
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Adobe
2007-09-30 00:27:10 1572864 --ah----- C:\Documents and Settings\Guest\NTUSER.DAT
2007-09-28 17:43:55 83008 --a------ C:\WINDOWS\system32\kupgnwea.dll
2007-09-27 17:43:34 83008 --a------ C:\WINDOWS\system32\gukujcwl.dll
2007-09-26 17:36:24 83008 --a------ C:\WINDOWS\system32\mirbcgua.dll
2007-09-25 16:36:21 83008 --a------ C:\WINDOWS\system32\kkeppamv.dll
2007-09-23 21:53:39 83008 --a------ C:\WINDOWS\system32\bfkjhrvr.dll
2007-09-22 18:45:27 304160 --a------ C:\StiImg.dat
2007-09-22 18:41:44 0 d-------- C:\WINDOWS\PixArt
2007-09-22 18:41:43 0 d-------- C:\Program Files\Trust
2007-09-22 18:41:43 0 d-------- C:\Program Files\Common Files\PCCamera
2007-09-21 20:47:21 83008 --a------ C:\WINDOWS\system32\hnqualsr.dll
2007-09-20 19:23:01 83008 --a------ C:\WINDOWS\system32\kdpsyrgf.dll
2007-09-15 14:00:10 0 d-------- C:\Program Files\MSN Messenger
2007-09-13 16:21:27 865305 ---hs---- C:\WINDOWS\system32\sttss.bak2
2007-09-12 21:16:55 6488 ---hs---- C:\WINDOWS\system32\sttss.bak1
2007-09-12 21:16:43 109600 --a------ C:\WINDOWS\system32\sptll.dll
2007-09-12 21:16:34 369248 --a------ C:\WINDOWS\system32\sstts.dll
2007-09-12 21:12:23 44054 --a------ C:\WINDOWS\system32\ddcbcab.dll
2007-09-12 21:11:32 44054 --a------ C:\WINDOWS\system32\yaywxwv.dll
-- Find3M Report ---------------------------------------------------------------
2007-10-04 22:33:10 0 d-------- C:\Program Files\TweakGenie
2007-10-04 22:32:14 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-10-04 22:32:12 0 d-------- C:\Program Files\Activision
2007-10-04 22:31:30 0 d-------- C:\Program Files\My Pet Hotel
2007-10-04 22:31:30 0 d-------- C:\Program Files\Mindscape
2007-10-04 22:26:58 0 d-------- C:\Program Files\Jasc Software Inc
2007-10-04 22:23:39 0 d-------- C:\Program Files\eGames
2007-10-04 22:01:18 0 d-------- C:\Program Files\lx_cats
2007-10-04 21:51:36 0 d-------- C:\Program Files\AlienGUIse
2007-10-03 21:24:42 0 d-------- C:\Program Files\Common Files
2007-10-03 21:24:23 0 d-------- C:\Documents and Settings\all users.silver\Application Data\Lavasoft
2007-10-02 19:56:59 0 d-------- C:\Documents and Settings\all users.silver\Application Data\LimeWire
2007-10-01 17:11:36 5060 --a------ C:\Documents and Settings\all users.silver\Application Data\wklnhst.dat
2007-09-30 08:55:47 0 d-------- C:\Documents and Settings\all users.silver\Application Data\AdobeUM
2007-09-04 19:34:22 0 d-------- C:\Documents and Settings\all users.silver\Application Data\Google
2007-09-04 19:33:27 0 d-------- C:\Program Files\Google
2007-09-04 18:44:16 0 d-------- C:\Program Files\Play89
2007-08-19 11:54:27 0 d-------- C:\Documents and Settings\all users.silver\Application Data\GlueTypeView
2007-08-19 11:36:17 0 d-------- C:\Program Files\Yahoo!
2007-08-15 20:24:34 532480 -----n--- C:\WINDOWS\system32\PixelChix - Hamster Jam.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>
2007-08-15 17:52:38 0 d-------- C:\Program Files\MSXML 6.0
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{733E9132-53CA-4C97-9AC9-145C4502FA20}]
12/09/2007 21:11 44054 --a------ C:\WINDOWS\system32\yaywxwv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89AD4D75-2429-462e-BD4E-443F233F6033}]
04/10/2007 20:24 77376 --a------ C:\WINDOWS\system32\oqqsqcyj.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF51CC67-7E7A-4989-A2A7-01D7BAACB0A5}]
12/09/2007 21:16 369248 --a------ C:\WINDOWS\system32\sstts.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [13/09/2002 21:42]
"SoundMan"="SOUNDMAN.EXE" [01/03/2006 16:22 C:\WINDOWS\soundman.exe]
"Run StartupMonitor"="StartupMonitor.exe" [20/05/2000 17:23 C:\WINDOWS\StartupMonitor.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [06/09/2007 11:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" [26/07/2006 04:03]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/03/2007 01:02]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [10/08/2004 20:00]
C:\Documents and Settings\all users.silver\Start Menu\Programs\Startup\
Alienware Dock.lnk - C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe [07/12/2006 18:23:12]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [14/10/2006 14:12:20]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)
"NoFind"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoRun"=0 (0x0)
"NoLogoff"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"NoClose"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoRun"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)
"NoCommonGroups"=0 (0x0)
"NoStrCmpLogical"=1 (0x1)
"NoRecentDocsMenu"=0 (0x0)
"NoFind"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"StartMenuLogOff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{733E9132-53CA-4C97-9AC9-145C4502FA20}"= C:\WINDOWS\system32\yaywxwv.dll [12/09/2007 21:11 44054]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sstts]
C:\WINDOWS\system32\sstts.dll 12/09/2007 21:16 369248 C:\WINDOWS\system32\sstts.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 21/12/2001 00:34 24576 C:\Program Files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yaywxwv]
yaywxwv.dll 12/09/2007 21:11 44054 C:\WINDOWS\system32\yaywxwv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
"C:\Program Files\Lexmark 2400 Series\ezprint.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcrmon.exe]
"C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"WZCSVC"=2 (0x2)
"W32Time"=2 (0x2)
"ALG"=3 (0x3)
"WebClient"=2 (0x2)
"VSS"=3 (0x3)
"Themes"=2 (0x2)
"SwPrv"=3 (0x3)
"CiSvc"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"TrkWks"=2 (0x2)
"Browser"=2 (0x2)
"wuauserv"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
-- Hosts -----------------------------------------------------------------------
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
60 more entries in hosts file.
-- End of Deckard's System Scanner: finished at 2007-10-05 16:24:17 ------------