ComboFix-quarantined-files
Code:
2007-09-12 21:11 44054 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yaywxwv.dll.vir
2007-09-12 21:12 44054 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ddcbcab.dll.vir
2007-09-12 21:16 369248 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sstts.dll.vir
2007-09-12 21:16 6488 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sttss.bak1.vir
2007-09-20 19:23 693421 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fgryspdk.ini.vir
2007-09-20 19:23 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kdpsyrgf.dll.vir
2007-09-21 20:47 693481 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rslauqnh.ini.vir
2007-09-21 20:47 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hnqualsr.dll.vir
2007-09-23 21:53 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bfkjhrvr.dll.vir
2007-09-23 21:58 693661 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rvrhjkfb.ini.vir
2007-09-25 16:36 294 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vmappekk.ini.vir
2007-09-25 16:36 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kkeppamv.dll.vir
2007-09-26 17:36 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mirbcgua.dll.vir
2007-09-26 21:54 693484 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\augcbrim.ini.vir
2007-09-27 17:43 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gukujcwl.dll.vir
2007-09-27 18:43 693431 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lwcjukug.ini.vir
2007-09-28 17:43 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kupgnwea.dll.vir
2007-09-28 17:44 693421 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\aewngpuk.ini.vir
2007-09-30 10:01 693652 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\vfsyqpio.ini.vir
2007-09-30 10:01 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\oipqysfv.dll.vir
2007-09-30 10:38 294 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gkejrsuc.ini.vir
2007-09-30 10:38 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\cusrjekg.dll.vir
2007-10-01 17:02 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fjxflerf.dll.vir
2007-10-01 17:44 693961 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\frelfxjf.ini.vir
2007-10-02 19:16 294 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gqmlyleh.ini.vir
2007-10-02 19:16 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\helylmqg.dll.vir
2007-10-04 20:21 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rwboqyvq.dll.vir
2007-10-04 20:24 77376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\oqqsqcyj.dll.vir
2007-10-04 20:57 693593 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qvyqobwr.ini.vir
2007-10-05 20:25 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fbbstwju.dll.vir
2007-10-05 20:26 294 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ujwtsbbf.ini.vir
2007-10-05 21:28 693412 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ebbxxhyf.ini.vir
2007-10-05 21:28 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\fyhxxbbe.dll.vir
2007-10-06 22:46 693481 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rjoapihy.ini.vir
2007-10-06 22:46 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yhipaojr.dll.vir
2007-10-07 16:41 1358 --a------ C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir
2007-10-07 17:37 860072 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sttss.bak2.vir
2007-10-07 17:46 693472 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kujqvwuj.ini.vir
2007-10-07 17:46 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\juwvqjuk.dll.vir
2007-10-07 21:55 77376 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\emgolewn.dll.vir
2007-10-08 21:58 891498 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\sttss.ini.vir
2007-10-08 21:59 309 --a------ C:\Qoobox\Quarantine\catchme.log
2007-10-08 21:59 372700 --a------ C:\Qoobox\Quarantine\catchme2007-10-08_220249.68.zip
Folder PATH listing for volume Partition_1
Volume serial number is 30EF-9CEF
C:\QOOBOX\QUARANTINE
| catchme.log
| catchme2007-10-08_220249.68.zip
|
+---C
| \---WINDOWS
| | cookies.ini.vir
| |
| \---system32
| aewngpuk.ini.vir
| augcbrim.ini.vir
| bfkjhrvr.dll.vir
| cusrjekg.dll.vir
| ddcbcab.dll.vir
| ebbxxhyf.ini.vir
| emgolewn.dll.vir
| fbbstwju.dll.vir
| fgryspdk.ini.vir
| fjxflerf.dll.vir
| frelfxjf.ini.vir
| fyhxxbbe.dll.vir
| gkejrsuc.ini.vir
| gqmlyleh.ini.vir
| gukujcwl.dll.vir
| helylmqg.dll.vir
| hnqualsr.dll.vir
| juwvqjuk.dll.vir
| kdpsyrgf.dll.vir
| kkeppamv.dll.vir
| kujqvwuj.ini.vir
| kupgnwea.dll.vir
| lwcjukug.ini.vir
| mirbcgua.dll.vir
| oipqysfv.dll.vir
| oqqsqcyj.dll.vir
| qvyqobwr.ini.vir
| rjoapihy.ini.vir
| rslauqnh.ini.vir
| rvrhjkfb.ini.vir
| rwboqyvq.dll.vir
| sstts.dll.vir
| sttss.bak1.vir
| sttss.bak2.vir
| sttss.ini.vir
| ujwtsbbf.ini.vir
| vfsyqpio.ini.vir
| vmappekk.ini.vir
| yaywxwv.dll.vir
| yhipaojr.dll.vir
|
\---Registry_backups
Panda scan
Incident Status Location
Potentially unwanted tool:application/mywebsearch Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Potentially unwanted tool:application/funweb Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.112.2o7.net/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\all users.silver\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@2o7[2].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@2o7[3].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@ad.yieldmanager[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@ad.yieldmanager[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@ad.yieldmanager[3].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@adrevolver[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@ads.pointroll[1].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@adtech[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@atdmt[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@atdmt[3].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@azjmp[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@bs.serving-sys[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@doubleclick[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@doubleclick[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@doubleclick[3].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@mediaplex[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@questionmarket[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@server.iad.liveperson[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@server.iad.liveperson[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@statcounter[1].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@stats1.reliablestats[1].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@tradedoubler[2].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@tradedoubler[3].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\all users.silver\Cookies\all_users@zedo[1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\all users.silver\Desktop\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\all users.silver\Desktop\ComboFix.exe[nircmd.cfexe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\all users.silver\Local Settings\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\Cache\7ED6F4AAd01[nircmd.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\all users.silver\Local Settings\Application Data\Mozilla\Firefox\Profiles\ljof80og.default\Cache\7ED6F4AAd01[nircmd.cfexe]
Potentially unwanted tool:Application/MyWebSearch Not disinfected C:\Program Files\Uninstall My Web Search.dll
Spyware:Spyware/Virtumonde Not disinfected C:\qoobox\Quarantine\C\WINDOWS\system32\ddcbcab.dll.vir
Spyware:Spyware/Virtumonde Not disinfected C:\qoobox\Quarantine\catchme2007-10-08_220249.68.zip[yaywxwv.dll]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe
Main.txt
Deckard's System Scanner v20070905.67
Run by all users on 2007-10-10 18:58:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 495 MiB (512 MiB recommended).
-- HijackThis (run as all users.exe) -------------------------------------------
Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-10-10 18:58:48
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16512)
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Media Center Diagnostic Kit\Tests\Bin\ehMonitor.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\all users.silver\Desktop\~D_KrYpTs~ #F1L35#\tools\dss.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Alienware Dock.lnk = C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - ?p=ZJfox000
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) -
http://courses.learndirect.co.uk/pro...er/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{57E675E6-1867-49DB-B52E-79071F46A97D}: NameServer = 192.168.1.1,212.159.11.150
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{60A1B07B-5116-4755-A6E2-4B352E89E406}: NameServer = 212.139.132.20 212.139.132.21
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{DBED8F7B-7929-47CC-9E4D-A0F9673FAFE1}: NameServer = 192.168.1.1,212.159.11.150
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O20 - AppInit_DLLs: wbsys.dll
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O22 - SharedTaskScheduler: blippers - {f2efa195-4785-4db1-9316-b48c64bb71da} - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
-- Files created between 2007-09-10 and 2007-10-10 -----------------------------
2007-10-03 21:25:28 0 d-------- C:\Program Files\Lavasoft
2007-10-03 21:25:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 21:24:42 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-02 20:33:28 0 d-------- C:\info
2007-10-01 23:00:33 212 --a------ C:\delete.bat
2007-09-30 11:59:24 0 d-------- C:\Documents and Settings\Guest\Application Data\Mozilla
2007-09-30 08:58:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\WINDOWS
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\Templates
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\Start Menu
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\SendTo
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\Recent
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\PrintHood
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\NetHood
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\My Documents
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\Local Settings
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\Favorites
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Desktop
2007-09-30 00:27:11 0 d--hs---- C:\Documents and Settings\Guest\Cookies
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\Application Data
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\SampleView
2007-09-30 00:27:11 0 d---s---- C:\Documents and Settings\Guest\Application Data\Microsoft
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Identities
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\CyberLink
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Apple Computer
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Adobe
2007-09-30 00:27:10 1572864 --ah----- C:\Documents and Settings\Guest\NTUSER.DAT
2007-09-22 18:45:27 304160 --a------ C:\StiImg.dat
2007-09-22 18:41:44 0 d-------- C:\WINDOWS\PixArt
2007-09-22 18:41:43 0 d-------- C:\Program Files\Trust
2007-09-22 18:41:43 0 d-------- C:\Program Files\Common Files\PCCamera
2007-09-15 14:00:10 0 d-------- C:\Program Files\MSN Messenger
-- Find3M Report ---------------------------------------------------------------
2007-10-10 18:23:52 0 d-------- C:\Program Files\AlienGUIse
2007-10-07 14:30:14 0 d-------- C:\Program Files\lx_cats
2007-10-04 22:33:10 0 d-------- C:\Program Files\TweakGenie
2007-10-04 22:32:14 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-10-04 22:32:12 0 d-------- C:\Program Files\Activision
2007-10-04 22:31:30 0 d-------- C:\Program Files\My Pet Hotel
2007-10-04 22:31:30 0 d-------- C:\Program Files\Mindscape
2007-10-04 22:26:58 0 d-------- C:\Program Files\Jasc Software Inc
2007-10-04 22:23:39 0 d-------- C:\Program Files\eGames
2007-10-03 21:24:42 0 d-------- C:\Program Files\Common Files
2007-10-03 21:24:23 0 d-------- C:\Documents and Settings\all users.silver\Application Data\Lavasoft
2007-10-02 19:56:59 0 d-------- C:\Documents and Settings\all users.silver\Application Data\LimeWire
2007-10-01 17:11:36 5060 --a------ C:\Documents and Settings\all users.silver\Application Data\wklnhst.dat
2007-09-30 08:55:47 0 d-------- C:\Documents and Settings\all users.silver\Application Data\AdobeUM
2007-09-04 19:34:22 0 d-------- C:\Documents and Settings\all users.silver\Application Data\Google
2007-09-04 19:33:27 0 d-------- C:\Program Files\Google
2007-09-04 18:44:16 0 d-------- C:\Program Files\Play89
2007-08-19 11:54:27 0 d-------- C:\Documents and Settings\all users.silver\Application Data\GlueTypeView
2007-08-19 11:36:17 0 d-------- C:\Program Files\Yahoo!
2007-08-15 20:24:34 532480 --a------ C:\WINDOWS\system32\PixelChix - Hamster Jam.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>
2007-08-15 17:52:38 0 d-------- C:\Program Files\MSXML 6.0
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [13/09/2002 21:42]
"SoundMan"="SOUNDMAN.EXE" [01/03/2006 16:22 C:\WINDOWS\soundman.exe]
"Run StartupMonitor"="StartupMonitor.exe" [20/05/2000 17:23 C:\WINDOWS\StartupMonitor.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [06/09/2007 11:06]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/03/2007 01:02]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [10/08/2004 20:00]
C:\Documents and Settings\all users.silver\Start Menu\Programs\Startup\
Alienware Dock.lnk - C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe [07/12/2006 18:23:12]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [14/10/2006 14:12:20]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoFileMenu"=0 (0x0)
"NoCommonGroups"=0 (0x0)
"NoStrCmpLogical"=1 (0x1)
"NoRecentDocsMenu"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 21/12/2001 00:34 24576 C:\Program Files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
"C:\Program Files\Lexmark 2400 Series\ezprint.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcrmon.exe]
"C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"WZCSVC"=2 (0x2)
"W32Time"=2 (0x2)
"ALG"=3 (0x3)
"WebClient"=2 (0x2)
"VSS"=3 (0x3)
"Themes"=2 (0x2)
"SwPrv"=3 (0x3)
"CiSvc"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"TrkWks"=2 (0x2)
"Browser"=2 (0x2)
"wuauserv"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
-- End of Deckard's System Scanner: finished at 2007-10-10 18:59:46 ------------
Deckard's System Scanner v20070905.67
Run by all users on 2007-10-10 18:58:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 495 MiB (512 MiB recommended).
-- HijackThis (run as all users.exe) -------------------------------------------
Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-10-10 18:58:48
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16512)
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Media Center Diagnostic Kit\Tests\Bin\ehMonitor.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\slmdmsr.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\all users.silver\Desktop\~D_KrYpTs~ #F1L35#\tools\dss.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKEY_LOCAL_MACHINE\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKEY_LOCAL_MACHINE\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Alienware Dock.lnk = C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Search - ?p=ZJfox000
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) -
http://courses.learndirect.co.uk/pro...er/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{57E675E6-1867-49DB-B52E-79071F46A97D}: NameServer = 192.168.1.1,212.159.11.150
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{60A1B07B-5116-4755-A6E2-4B352E89E406}: NameServer = 212.139.132.20 212.139.132.21
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{DBED8F7B-7929-47CC-9E4D-A0F9673FAFE1}: NameServer = 192.168.1.1,212.159.11.150
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O20 - AppInit_DLLs: wbsys.dll
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O22 - SharedTaskScheduler: blippers - {f2efa195-4785-4db1-9316-b48c64bb71da} - (no file)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
-- Files created between 2007-09-10 and 2007-10-10 -----------------------------
2007-10-03 21:25:28 0 d-------- C:\Program Files\Lavasoft
2007-10-03 21:25:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-03 21:24:42 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-02 20:33:28 0 d-------- C:\info
2007-10-01 23:00:33 212 --a------ C:\delete.bat
2007-09-30 11:59:24 0 d-------- C:\Documents and Settings\Guest\Application Data\Mozilla
2007-09-30 08:58:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\WINDOWS
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\Templates
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\Start Menu
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\SendTo
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\Recent
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\PrintHood
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\NetHood
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\My Documents
2007-09-30 00:27:11 0 d--h----- C:\Documents and Settings\Guest\Local Settings
2007-09-30 00:27:11 0 dr------- C:\Documents and Settings\Guest\Favorites
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Desktop
2007-09-30 00:27:11 0 d--hs---- C:\Documents and Settings\Guest\Cookies
2007-09-30 00:27:11 0 dr-h----- C:\Documents and Settings\Guest\Application Data
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\SampleView
2007-09-30 00:27:11 0 d---s---- C:\Documents and Settings\Guest\Application Data\Microsoft
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Identities
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\CyberLink
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Apple Computer
2007-09-30 00:27:11 0 d-------- C:\Documents and Settings\Guest\Application Data\Adobe
2007-09-30 00:27:10 1572864 --ah----- C:\Documents and Settings\Guest\NTUSER.DAT
2007-09-22 18:45:27 304160 --a------ C:\StiImg.dat
2007-09-22 18:41:44 0 d-------- C:\WINDOWS\PixArt
2007-09-22 18:41:43 0 d-------- C:\Program Files\Trust
2007-09-22 18:41:43 0 d-------- C:\Program Files\Common Files\PCCamera
2007-09-15 14:00:10 0 d-------- C:\Program Files\MSN Messenger
-- Find3M Report ---------------------------------------------------------------
2007-10-10 18:23:52 0 d-------- C:\Program Files\AlienGUIse
2007-10-07 14:30:14 0 d-------- C:\Program Files\lx_cats
2007-10-04 22:33:10 0 d-------- C:\Program Files\TweakGenie
2007-10-04 22:32:14 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-10-04 22:32:12 0 d-------- C:\Program Files\Activision
2007-10-04 22:31:30 0 d-------- C:\Program Files\My Pet Hotel
2007-10-04 22:31:30 0 d-------- C:\Program Files\Mindscape
2007-10-04 22:26:58 0 d-------- C:\Program Files\Jasc Software Inc
2007-10-04 22:23:39 0 d-------- C:\Program Files\eGames
2007-10-03 21:24:42 0 d-------- C:\Program Files\Common Files
2007-10-03 21:24:23 0 d-------- C:\Documents and Settings\all users.silver\Application Data\Lavasoft
2007-10-02 19:56:59 0 d-------- C:\Documents and Settings\all users.silver\Application Data\LimeWire
2007-10-01 17:11:36 5060 --a------ C:\Documents and Settings\all users.silver\Application Data\wklnhst.dat
2007-09-30 08:55:47 0 d-------- C:\Documents and Settings\all users.silver\Application Data\AdobeUM
2007-09-04 19:34:22 0 d-------- C:\Documents and Settings\all users.silver\Application Data\Google
2007-09-04 19:33:27 0 d-------- C:\Program Files\Google
2007-09-04 18:44:16 0 d-------- C:\Program Files\Play89
2007-08-19 11:54:27 0 d-------- C:\Documents and Settings\all users.silver\Application Data\GlueTypeView
2007-08-19 11:36:17 0 d-------- C:\Program Files\Yahoo!
2007-08-15 20:24:34 532480 --a------ C:\WINDOWS\system32\PixelChix - Hamster Jam.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>
2007-08-15 17:52:38 0 d-------- C:\Program Files\MSXML 6.0
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [13/09/2002 21:42]
"SoundMan"="SOUNDMAN.EXE" [01/03/2006 16:22 C:\WINDOWS\soundman.exe]
"Run StartupMonitor"="StartupMonitor.exe" [20/05/2000 17:23 C:\WINDOWS\StartupMonitor.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [06/09/2007 11:06]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09/03/2007 01:02]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [10/08/2004 20:00]
C:\Documents and Settings\all users.silver\Start Menu\Programs\Startup\
Alienware Dock.lnk - C:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe [07/12/2006 18:23:12]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [14/10/2006 14:12:20]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoFileMenu"=0 (0x0)
"NoCommonGroups"=0 (0x0)
"NoStrCmpLogical"=1 (0x1)
"NoRecentDocsMenu"=0 (0x0)
"NoSMHelp"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoSetTaskBar"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoStartMenuMFUprogramsList"=0 (0x0)
"NoStartMenuMorePrograms"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"MaxRecentDocs"=15 (0xf)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\AlienGUIse\fastload.dll 21/12/2001 00:34 24576 C:\Program Files\AlienGUIse\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
"C:\Program Files\Lexmark 2400 Series\ezprint.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcrmon.exe]
"C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"WZCSVC"=2 (0x2)
"W32Time"=2 (0x2)
"ALG"=3 (0x3)
"WebClient"=2 (0x2)
"VSS"=3 (0x3)
"Themes"=2 (0x2)
"SwPrv"=3 (0x3)
"CiSvc"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"TrkWks"=2 (0x2)
"Browser"=2 (0x2)
"wuauserv"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
-- End of Deckard's System Scanner: finished at 2007-10-10 18:59:46 ------------