erwin.joseph

Deckard's System Scanner v20071014.68
Run by erwin on 2008-01-15 11:23:48
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
17: 2008-01-15 03:23:59 UTC - RP79 - Deckard's System Scanner Restore Point
16: 2008-01-15 02:57:36 UTC - RP78 - Removed Nokia Software Updater.
15: 2008-01-15 02:35:17 UTC - RP77 - Software Distribution Service 3.0
14: 2008-01-15 02:00:18 UTC - RP76 - Removed Nokia Software Updater.
13: 2008-01-15 01:51:57 UTC - RP75 - Installed Windows XP Wudf01005.


-- First Restore Point --
1: 2008-01-14 06:34:24 UTC - RP63 - Removed MSXML 4.0 SP2 (KB927978)


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 0.45 GiB (less than 15%) free.


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-01-15 11:30:41
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Subversion\bin\SvnService.exe
C:\Program Files\Subversion\bin\svnserve.exe
C:\WINDOWS\system32\TpKmpSvc.exe
C:\Program Files\Virtual CD v4\System\VCDSecS.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\IBMTOOLS\utils\ibmprc.exe
C:\Program Files\ThinkPad\Utilities\EzEjMnAp.Exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IPMsg\ipmsg.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Documents and Settings\erwin\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.2.0.2:8080
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: 10.2.1.92 jason
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: (no name) - {8D434C83-27EF-4DDA-9E12-AD84D5A950CB} - (no file)
O2 - BHO: (no name) - {C925390D-0E1B-4981-BA19-1296B2ADAEFA} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [QCWLICON] C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: IPMSG for Win32.lnk = C:\Program Files\IPMsg\ipmsg.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Edit with &XML Spy - C:\Program Files\Altova\xmlspy\spy.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\PkgMgr.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: C:\Program Files\Hide My IP 2007\ProxyFilter.dll
O10 - Unknown file in Winsock LSP: C:\Program Files\Hide My IP 2007\ProxyFilter.dll
O10 - Unknown file in Winsock LSP: C:\Program Files\Hide My IP 2007\ProxyFilter.dll
O10 - Unknown file in Winsock LSP: C:\Program Files\Hide My IP 2007\ProxyFilter.dll
O11 - Options Group: [JAVA_IBM] Java (IBM)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} () - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL
O18 - Protocol: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: khhfc - C:\WINDOWS\system32\
O20 - Winlogon Notify: vturr - C:\WINDOWS\system32\
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\goeykyfx.exe /service
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\system32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SVNService - Clansoft - C:\Program Files\Subversion\bin\SvnService.exe
O23 - Service: Sybase BCKServer _ DEV_IRIS_BS (SYBBCK_DEV_IRIS_BS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\bcksrvr.exe -SDEV_IRIS_BS -R
O23 - Service: Sybase BCKServer _ IBM2EE09452ACE_BS (SYBBCK_IBM2EE09452ACE_BS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\bcksrvr.exe -SIBM2EE09452ACE_BS -R
O23 - Service: Sybase BCKServer _ IRISLAPTOP_BS (SYBBCK_IRISLAPTOP_BS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\bcksrvr.exe -SIRISLAPTOP_BS -R
O23 - Service: Sybase BCKServer _ MyIRIS_BS (SYBBCK_MyIRIS_BS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\bcksrvr.exe -SMyIRIS_BS -R
O23 - Service: Sybase MONServer _ DEV_IRIS_MS (SYBMON_DEV_IRIS_MS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\monsrvr.exe -MDEV_IRIS_MS -C
O23 - Service: Sybase MONServer _ ERWINLAPTOP_MS (SYBMON_ERWINLAPTOP_MS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\monsrvr.exe -MERWINLAPTOP_MS -C
O23 - Service: Sybase MONServer _ IRISLAPTOP_MS (SYBMON_IRISLAPTOP_MS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\monsrvr.exe -MIRISLAPTOP_MS -C
O23 - Service: Sybase SQLServer _ DEV_IRIS (SYBSQL_DEV_IRIS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sDEV_IRIS -C
O23 - Service: Sybase SQLServer _ ERWINLAPTOP (SYBSQL_ERWINLAPTOP) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sERWINLAPTOP -C
O23 - Service: Sybase SQLServer _ IRISLAPTOP (SYBSQL_IRISLAPTOP) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sIRISLAPTOP -C
O23 - Service: Sybase SQLServer _ IRISLOCAL (SYBSQL_IRISLOCAL) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sIRISLOCAL -C
O23 - Service: Sybase SQLServer _ LOCALIRIS (SYBSQL_LOCALIRIS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sLOCALIRIS -C
O23 - Service: Sybase SQLServer _ MyIRIS (SYBSQL_MyIRIS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sMyIRIS -C
O23 - Service: Sybase SQLServer _ SCCPIRIS (SYBSQL_SCCPIRIS) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\sqlsrvr.exe -sSCCPIRIS -C
O23 - Service: Sybase XPServer _ DEV_IRIS_XP (SYBXPS_DEV_IRIS_XP) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\xpserver.exe -SDEV_IRIS_XP -C
O23 - Service: Sybase XPServer _ IRISLAPTOP_XP (SYBXPS_IRISLAPTOP_XP) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\xpserver.exe -SIRISLAPTOP_XP -C
O23 - Service: Sybase XPServer _ LOCALIRIS_XP (SYBXPS_LOCALIRIS_XP) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\xpserver.exe -SLOCALIRIS_XP -C
O23 - Service: Sybase XPServer _ MYIRIS_XP (SYBXPS_MYIRIS_XP) - Unknown owner - C:\Projects\IRIS\Programs\sybase\ASE-12_5\bin\xpserver.exe -SMYIRIS_XP -C
O23 - Service: SYSAM - Unknown owner - C:\Projects\IRIS\Programs\sybase\SYSAM-1_0\bin\lmgrd
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSvc.exe
O23 - Service: VCDSecS - H+H Software GmbH - C:\Program Files\Virtual CD v4\System\VCDSecS.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe
O24 - Desktop Component 1: - C:\Documents and Settings\erwin\Desktop\Temp\Clock\clock.html

--
End of file - 17880 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 Shockprf - c:\windows\system32\drivers\shockprf.sys <Not Verified; IBM Corporation; IBM Hard Drive Active Protection System>
R1 ANC - c:\windows\system32\drivers\anc.sys <Not Verified; IBM Corp.; IBM Access Connections>
R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7>
R1 FD - c:\windows\system32\drivers\fd.sys
R1 IBMTPCHK - c:\windows\system32\drivers\ibmbldid.sys
R1 ShockMgr - c:\windows\system32\drivers\shockmgr.sys <Not Verified; IBM Corporation; IBM Hard Drive Active Protection System>
R1 Smapint - c:\windows\system32\drivers\smapint.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System>
R1 TDSMAPI - c:\windows\system32\drivers\tdsmapi.sys
R1 TPHKDRV - c:\windows\system32\drivers\tphkdrv.sys <Not Verified; IBM Corporation; ThinkPad OnScreenDisplay>
R1 TPPWR - c:\windows\system32\drivers\tppwr.sys <Not Verified; IBM Corp.; IBM ThinkPad Utility>
R1 TSMAPIP - c:\windows\system32\drivers\tsmapip.sys
R1 vcdmpdrv - c:\windows\system32\drivers\vcdmpdrv.sys <Not Verified; H+H Software GmbH; H+H Virtual CD v4>
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.1.6.0) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.1.6.0>
R2 ibmfilter - c:\windows\system32\drivers\ibmfilter.sys <Not Verified; IBM; FFE and RRU>
R2 PMEM - c:\windows\system32\drivers\pmemnt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System>
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>

S3 hwdatacard (Huawei DataCard USB Modem and USB Serial) - c:\windows\system32\drivers\ewusbmdm.sys <Not Verified; Huawei Technologies Co., Ltd.; Huawei Technologies Co., Ltd. USB Modem/Serial Device Driver>
S3 psadd (IBM PSA Access Driver) - c:\windows\system32\drivers\psadd.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
S3 QCNDISIF - c:\windows\system32\drivers\qcndisif.sys <Not Verified; IBM Corporation.; IBM ThinkPad Utility>
S3 tap0801 (TAP-Win32 Adapter V8) - c:\windows\system32\drivers\tap0801.sys <Not Verified; The OpenVPN Project; TAP-Win32 Virtual Network Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 IBM Rapid Restore Ultra Service - "c:\program files\ibm\ibm rapid restore ultra\rrpcsb.exe" <Not Verified; ; rrpcsb Module>
R2 QCONSVC - system32\qconsvc.exe <Not Verified; IBM Corp.; IBM ThinkPad Utility>
R2 RegSrvc - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; RegSrvc Module>
R2 SVNService - c:\program files\subversion\bin\svnservice.exe <Not Verified; Clansoft; SVN Service>
R2 TpKmpSVC (IBM KCU Service) - c:\windows\system32\tpkmpsvc.exe
R2 VCDSecS - c:\program files\virtual cd v4\system\vcdsecs.exe <Not Verified; H+H Software GmbH; Virtual CD>
R2 vtserver (Protector Suite Virtual Token) - "c:\program files\common files\virtual token\vtserver.exe" <Not Verified; UPEK Inc.; IBM fingerprint software>
R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>

S2 DomainService - c:\windows\system32\goeykyfx.exe /service (file missing)
S2 SYSAM - c:\projects\iris\programs\sybase\sysam-1_0\bin\lmgrd (file missing)
S3 OpenVPNService (OpenVPN Service) - c:\program files\openvpn\bin\openvpnserv.exe
S3 PsaSrv (IBM PSA Access Driver Control) - c:\windows\system32\psasrv.exe (file missing)
S3 SYBBCK_DEV_IRIS_BS (Sybase BCKServer _ DEV_IRIS_BS) - c:\projects\iris\programs\sybase\ase-12_5\bin\bcksrvr.exe -sdev_iris_bs -r (file missing)
S3 SYBBCK_IBM2EE09452ACE_BS (Sybase BCKServer _ IBM2EE09452ACE_BS) - c:\projects\iris\programs\sybase\ase-12_5\bin\bcksrvr.exe -sibm2ee09452ace_bs -r (file missing)
S3 SYBBCK_IRISLAPTOP_BS (Sybase BCKServer _ IRISLAPTOP_BS) - c:\projects\iris\programs\sybase\ase-12_5\bin\bcksrvr.exe -sirislaptop_bs -r (file missing)
S3 SYBBCK_MyIRIS_BS (Sybase BCKServer _ MyIRIS_BS) - c:\projects\iris\programs\sybase\ase-12_5\bin\bcksrvr.exe -smyiris_bs -r (file missing)
S3 SYBMON_DEV_IRIS_MS (Sybase MONServer _ DEV_IRIS_MS) - c:\projects\iris\programs\sybase\ase-12_5\bin\monsrvr.exe -mdev_iris_ms -c (file missing)
S3 SYBMON_ERWINLAPTOP_MS (Sybase MONServer _ ERWINLAPTOP_MS) - c:\projects\iris\programs\sybase\ase-12_5\bin\monsrvr.exe -merwinlaptop_ms -c (file missing)
S3 SYBMON_IRISLAPTOP_MS (Sybase MONServer _ IRISLAPTOP_MS) - c:\projects\iris\programs\sybase\ase-12_5\bin\monsrvr.exe -mirislaptop_ms -c (file missing)
S3 SYBSQL_DEV_IRIS (Sybase SQLServer _ DEV_IRIS) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -sdev_iris -c (file missing)
S3 SYBSQL_ERWINLAPTOP (Sybase SQLServer _ ERWINLAPTOP) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -serwinlaptop -c (file missing)
S3 SYBSQL_IRISLAPTOP (Sybase SQLServer _ IRISLAPTOP) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -sirislaptop -c (file missing)
S3 SYBSQL_IRISLOCAL (Sybase SQLServer _ IRISLOCAL) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -sirislocal -c (file missing)
S3 SYBSQL_LOCALIRIS (Sybase SQLServer _ LOCALIRIS) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -slocaliris -c (file missing)
S3 SYBSQL_MyIRIS (Sybase SQLServer _ MyIRIS) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -smyiris -c (file missing)
S3 SYBSQL_SCCPIRIS (Sybase SQLServer _ SCCPIRIS) - c:\projects\iris\programs\sybase\ase-12_5\bin\sqlsrvr.exe -ssccpiris -c (file missing)
S3 SYBXPS_DEV_IRIS_XP (Sybase XPServer _ DEV_IRIS_XP) - c:\projects\iris\programs\sybase\ase-12_5\bin\xpserver.exe -sdev_iris_xp -c (file missing)
S3 SYBXPS_IRISLAPTOP_XP (Sybase XPServer _ IRISLAPTOP_XP) - c:\projects\iris\programs\sybase\ase-12_5\bin\xpserver.exe -sirislaptop_xp -c (file missing)
S3 SYBXPS_LOCALIRIS_XP (Sybase XPServer _ LOCALIRIS_XP) - c:\projects\iris\programs\sybase\ase-12_5\bin\xpserver.exe -slocaliris_xp -c (file missing)
S3 SYBXPS_MYIRIS_XP (Sybase XPServer _ MYIRIS_XP) - c:\projects\iris\programs\sybase\ase-12_5\bin\xpserver.exe -smyiris_xp -c (file missing)
S4 aspnet_state (ASP.NET State Service) - c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe (file missing)


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) PRO/1000 MT Mobile Connection
Device ID: PCI\VEN_8086&DEV_101E&SUBSYS_05491014&REV_03\4&39A85202&0&08F0
Manufacturer: Intel
Name: Intel(R) PRO/1000 MT Mobile Connection
PNP Device ID: PCI\VEN_8086&DEV_101E&SUBSYS_05491014&REV_03\4&39A85202&0&08F0
Service: E1000

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: TAP-Win32 Adapter V8
Device ID: ROOT\NET\0000
Manufacturer: TAP-Win32 Provider
Name: TAP-Win32 Adapter V8
PNP Device ID: ROOT\NET\0000
Service: tap0801

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia N91
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia N91
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd


-- Scheduled Tasks -------------------------------------------------------------

2008-01-15 11:27:00 366 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job
2008-01-14 16:31:02 338 --a------ C:\WINDOWS\Tasks\Uniblue SpyEraser.job
2008-01-14 16:25:38 270 --a------ C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
2008-01-14 16:25:34 392 --a------ C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job
2007-12-12 23:32:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2007-12-15 and 2008-01-15 -----------------------------

2008-01-15 10:59:12 0 d-------- C:\Program Files\Hide My IP 2007 <HIDEMY~1>
2008-01-14 17:46:32 0 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-01-14 17:13:58 0 dr-h----- C:\Documents and Settings\erwin\Recent
2008-01-14 16:30:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-01-14 15:52:27 0 d-------- C:\Program Files\Uniblue
2008-01-14 15:45:40 0 d-------- C:\Documents and Settings\erwin\Application Data\Uniblue
2008-01-14 14:58:58 0 d-------- C:\Program Files\Common Files\Nokia
2008-01-14 14:58:32 0 d-------- C:\Program Files\PC Connectivity Solution
2008-01-14 1418 0 d-------- C:\Documents and Settings\All Users\Application Data\Installations
2007-12-20 12:05:54 0 d-------- C:\Program Files\jprofiler5
2007-12-17 21:38:10 0 d-------- C:\Program Files\Wondershare


-- Find3M Report ---------------------------------------------------------------

2008-01-15 11:23:59 0 d-------- C:\Documents and Settings\erwin\Application Data\Free Download Manager
2008-01-15 10:58:31 0 d-------- C:\Program Files\Nokia
2008-01-14 17:11:45 0 d-------- C:\Program Files\Free Download Manager
2008-01-14 14:58:58 0 d-------- C:\Program Files\Common Files
2008-01-14 14:47:08 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-14 14:40:28 0 d-------- C:\Program Files\Subversion
2008-01-14 14:37:28 0 d-------- C:\Program Files\Common Files\PCSuite
2008-01-13 20:34:25 0 d-------- C:\Program Files\Warcraft III
2008-01-09 08:00:05 0 d-------- C:\Documents and Settings\erwin\Application Data\AVG7
2007-12-24 14:15:42 0 d-------- C:\Program Files\Mystery Case Files Ravenhearst
2007-12-20 12:30:17 0 d-------- C:\Program Files\jprofiler4
2007-12-17 09:07:37 0 dr-h----- C:\Documents and Settings\erwin\Application Data\yahoo!
2007-12-11 14:42:00 0 d-------- C:\Documents and Settings\erwin\Application Data\PlayFirst
2007-11-29 13:44:51 0 d-------- C:\Documents and Settings\erwin\Application Data\Real


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D434C83-27EF-4DDA-9E12-AD84D5A950CB}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C925390D-0E1B-4981-BA19-1296B2ADAEFA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [04/01/2004 10:52 AM]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [03/26/2004 02:40 PM]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [09/16/2003 12:00 PM]
"ControlCenter"="C:\Program Files\IBM fingerprint software\ctlcntr.exe" [09/24/2004 04:11 PM]
"UC_Start"="C:\Program Files\IBM\Updater\\ucstartup.exe" [07/15/2004 07:34 AM]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [02/05/2004 09:39 AM]
"TPHOTKEY"="C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [08/18/2004 03:06 AM]
"S3TRAY2"="S3Tray2.exe" [10/12/2001 02:32 PM C:\WINDOWS\system32\S3Tray2.exe]
"QCWLICON"="C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe" [11/09/2004 06:53 PM]
"IBMPRC"="C:\IBMTOOLS\UTILS\ibmprc.exe" [03/20/2004 03:12 AM]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [12/25/2003 05:04 PM]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [07/29/2004 04:37 PM]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [07/29/2004 04:37 PM]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [07/29/2004 04:37 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [12/27/2007 08:22 AM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 PM]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [12/10/2007 10:12 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

C:\Documents and Settings\erwin\Start Menu\Programs\Startup\
IPMSG for Win32.lnk - C:\Program Files\IPMsg\ipmsg.exe [7/24/2005 10:53:03 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= C:\Documents and Settings\erwin\Desktop\Temp\Clock\clock.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khhfc]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
C:\Program Files\IBM fingerprint software\psfus.dll 09/24/2004 04:15 PM 108636 C:\Program Files\IBM fingerprint software\psfus.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
QConGina.dll 11/09/2004 06:53 PM 262144 C:\WINDOWS\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturr]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli pwdmon

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^erwin^Start Menu^Programs^Startup^MySQL System Tray Monitor.lnk]
backup=C:\WINDOWS\pss\MySQL System Tray Monitor.lnkStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FD_SAP]
C:\WINDOWS\System32\Drivers\SAP\FD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IBM RecordNow!]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ibmmessages]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq.com]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mRouterConfig]
"C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
"C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite for Smartphones]
"C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgrWired]
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QCTRAY]
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TP4EX]
tp4ex.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TpShocks]
TpShocks.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Trickler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UC_SMB]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VCDPlayer]
C:\PROGRA~1\VIRTUA~1\System\VCDPlay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wa7pcw]
"C:\Program Files\Common Files\WinAntiVirus Pro 2007\wa7pcw.exe" -c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"aspnet_state"=3 (0x3)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
AutoRun\command- Z:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{102fee30-3d6d-11db-b128-001125875e30}]
AutoRun\command- RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{102fee31-3d6d-11db-b128-001125875e30}]
AutoRun\command- RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b258330-e639-11da-b060-001125875e30}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NETSVCS.EXE
é_†™\command- NETSVCS.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b032295-3d07-11dc-bc13-005056c00008}]
Auto\command- F:\sal.xls.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35b4ffa0-8d19-11dc-bcd8-005056c00008}]
Auto\command- infrom.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{640d3db0-8e8c-11dc-bcdd-005056c00008}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe .MS32DLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7dd17750-59e8-11db-b179-001125875e30}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe maskrider.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{891d4d19-301e-11dc-bbde-005056c00008}]
Auto\command- RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
Browser\command- RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b567c40-382b-11dc-bbf9-005056c00008}]
AutoRun\command- fooool.exe
explore\Command- fooool.exe
open\Command- fooool.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51ebc40-f61e-11d9-ae61-0012f024a592}]
AutoRun\command- E:\
explore\Command- E:\RECYCLER\INFO.exe
open\Command- E:\RECYCLER\INFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd0da4c0-4a20-11dc-bc31-005056c00008}]
AutoRun\command- E:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e04adb41-b71c-11db-b249-005056c00008}]
AutoRun\command- F:\
explore\Command- F:\RECYCLER\INFO.exe
open\Command- F:\RECYCLER\INFO.exe




-- Hosts -----------------------------------------------------------------------

10.2.1.92 jason


-- End of Deckard's System Scanner: finished at 2008-01-15 11:31:47 ------------

Attached Files

extra.txt (29.5 KB, 0 views)

koala

Hi, welcome to TSF

You forgot to post any details describing your problem. And this should have been posted in the HJT forum.

If you think your computer is infected....