angelo25

Deckard's System Scanner v20070603.47
Run by Angel on 2007-06-10 at 18:43:38
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
14: 2007-06-10 19:45:36 UTC - RP16 - Removed Ad-Aware 2007
13: 2007-06-10 19:36:26 UTC - RP15 - Installed Ad-Aware 2007
12: 2007-06-10 02:22:14 UTC - RP14 - Windows Update
11: 2007-06-09 19:54:34 UTC - RP13 - Removed Ad-Aware 2007
10: 2007-06-09 19:13:16 UTC - RP12 - Installed Ad-Aware 2007


-- First Restore Point --
1: 2007-06-08 19:32:45 UTC - RP5 - Windows Update


Backed up registry hives.

Performed disk cleanup.


-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-06-10 18:45:19
Platform: Windows Vista (6.00.6000)
MSIE: Internet Explorer (7.00.6000.16386)

Running processes:
C:\Windows\System32\dwm.exe
C:\Windows\explorer.exe
C:\Windows\System32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\ProgramData\twbutobw.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\Macromed\Flash\FlashUtil9c.exe
C:\Users\Angel\Desktop\dss.exe
C:\Windows\System32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [twbutobw.exe] C:\ProgramData\twbutobw.exe
O4 - HKLM\..\Run: [lanmanwrk.exe] C:\Windows\System32\lanmanwrk.exe
O4 - HKLM\..\Run: [Ultimate Fixer] "C:\Program Files\Ultimate Fixer\UltimateFixer.exe" hide
O4 - HKLM\..\Run: [Mircosoft Windows Development Environment] devenv.exe
O4 - HKLM\..\RunServices: [Mircosoft Windows Development Environment] devenv.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Ieuu] "C:\Windows\TSKS~1\cmd.exe" -vt yazb
O4 - HKCU\..\Run: [Ofoyhrw] C:\Windows\?dobe\??plorer.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: ssqpmmn - C:\Windows\system32\ssqpmmn.dll
O20 - Winlogon Notify: winads32 - C:\Windows\system32\winads32.dll


-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.


-- Files created between 2007-05-10 and 2007-06-10 -----------------------------

2007-06-10 14:57:00 0 d-------- C:\Users\Angel\Incomplete
2007-06-10 14:54:34 0 d-------- C:\Program Files\Java
2007-06-10 14:54:00 0 d-------- C:\Program Files\Common Files\Java
2007-06-10 14:53:52 0 d-------- C:\Program Files\LimeWire
2007-06-10 14:53:41 0 d-a------ C:\Users\All Users\TEMP
2007-06-10 14:34:41 0 d-------- C:\Users\Angel\Pavark
2007-06-09 22:11:38 0 d-------- C:\Program Files\TVAnts
2007-06-09 19:42:58 0 d-------- C:\Users\All Users\Spybot - Search & Destroy
2007-06-09 19:14:35 0 d-------- C:\Program Files\SecondLife
2007-06-09 17:46:19 967 --a------ C:\Windows\ScUnin.pif
2007-06-09 17:46:19 94208 --a------ C:\Windows\ScUnin.exe <Not Verified; Blizzard Entertainment; Starcraft Uninstaller>
2007-06-09 17:46:19 35473 --a------ C:\Windows\scunin.dat
2007-06-09 17:45:00 0 d-------- C:\Program Files\Starcraft
2007-06-09 10:51:30 0 d-------- C:\Program Files\SopCast
2007-06-09 10:05:01 22296 --a------ C:\Windows\system32\qmnlnapo.exe
2007-06-09 09:35:29 21504 --a------ C:\Windows\jestertb.dll
2007-06-09 00:59:31 0 d-------- C:\Program Files\PPStream
2007-06-08 22:01:07 0 d-------- C:\Users\All Users\CopyPod
2007-06-08 22:01:03 0 d-------- C:\Program Files\CopyPod
2007-06-08 21:37:39 0 d-------- C:\Program Files\utorrent
2007-06-08 20:39:27 161 --a------ C:\ipodpos.dll
2007-06-08 19:41:21 33302 --a------ C:\Windows\system32\opnlkhh.dll
2007-06-08 19:36:50 33302 --a------ C:\Windows\system32\awtqqrq.dll
2007-06-08 19:26:48 33302 --a------ C:\Windows\system32\ssqrrqp.dll
2007-06-08 19:25:37 2 --a------ C:\-1799255024
2007-06-08 19:25:35 724 --a------ C:\Windows\system32\qmopt.dll
2007-06-08 19:25:33 22296 --a------ C:\Windows\system32\lanmanwrk.exe <LANMAN~1.EXE>
2007-06-08 19:25:27 2 --a------ C:\Windows\system32\wnscpicomsv.exe <WNSCPI~1.EXE>
2007-06-08 19:25:25 33302 --a------ C:\Windows\system32\ssqpmmn.dll
2007-06-08 19:25:25 0 d-------- C:\Windows\?dobe
2007-06-08 19:25:25 56832 --a------ C:\Users\All Users\twbutobw.exe
2007-06-08 19:25:25 0 d-------- C:\Program Files\Outerinfo
2007-06-08 19:25:19 40183 ---hs---- C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe
2007-06-08 19:24:36 0 --a------ C:\ntldr
2007-06-08 19:24:15 19456 --a------ C:\Windows\system32\winads32.dll
2007-06-08 18:32:42 0 d-------- C:\Users\All Users\Adobe
2007-06-08 18:32:11 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-08 18:30:20 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-06-08 18:22:54 0 d-------- C:\Program Files\Lavasoft
2007-06-08 18:22:53 0 d-------- C:\Users\All Users\Lavasoft
2007-06-08 18:14:47 0 d-------- C:\Users\All Users\Google
2007-06-08 18:14:31 0 d-------- C:\Users\All Users\Google Updater
2007-06-08 18:14:28 0 d-------- C:\Program Files\Google
2007-06-08 15:18:04 0 d-------- C:\SWSetup
2007-06-08 15:18:04 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-08 15:03:18 0 d-------- C:\Windows\Panther
2007-06-08 15:03:02 0 d--hs---- C:\Boot
2007-06-08 14:32:19 0 d-------- C:\Windows\system32\directx
2007-06-08 14:32:00 0 d-------- C:\mgafold
2007-06-08 14:30:12 0 d--hs---- C:\Windows\Installer
2007-06-08 14:19:41 0 dr------- C:\Users\Angel\Searches
2007-06-08 14:19:15 0 dr------- C:\Users\Angel\Contacts
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\Templates
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\Start Menu
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\SendTo
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\Recent
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\PrintHood
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\NetHood
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\My Documents
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\Local Settings
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\Cookies
2007-06-08 14:18:56 0 d--hs---- C:\Users\Angel\Application Data
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Videos
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Saved Games
2007-06-08 14:18:55 0 d-------- C:\Users\Angel\Pictures
2007-06-08 14:18:55 0 d-------- C:\Users\Angel\Music
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Links
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Favorites
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Downloads
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Documents
2007-06-08 14:18:55 0 dr------- C:\Users\Angel\Desktop
2007-06-08 14:18:55 0 d--h----- C:\Users\Angel\AppData
2007-06-08 14:18:54 1310720 --ahs---- C:\Users\Angel\NTUSER.DAT
2007-06-08 14:11:15 0 d-------- C:\Program Files\Common Files\eSellerate
2007-06-08 14:09:12 0 d-------- C:\Windows\SoftwareDistribution
2007-06-08 14:08:40 0 --a------ C:\Windows\system32\atiicdxx.dat
2007-06-08 1433 0 d-------- C:\Windows\Debug
2007-06-08 1433 0 d-------- C:\Windows\CSC
2007-06-08 14:04:26 0 d-------- C:\Windows\Prefetch
2007-06-08 14:04:11 0 d--hs---- C:\System Volume Information
2007-06-08 13:49:49 0 d-------- C:\Windows\system32\Macromed
2007-06-08 13:49:37 0 d-------- C:\Users\All Users\Yahoo!
2007-06-08 13:48:16 0 d-------- C:\Program Files\Yahoo!
2007-06-08 13:41:50 0 d-------- C:\Program Files\Alwil Software
2007-06-08 13:09:05 0 d-------- C:\Program Files\iPod
2007-06-08 13:08:28 0 d-------- C:\Program Files\iTunes
2007-06-08 13:07:11 0 d-------- C:\Program Files\QuickTime
2007-06-08 1349 0 d-------- C:\Program Files\Apple Software Update
2007-06-08 1322 0 d-------- C:\Users\All Users\Apple Computer
2007-06-08 12:35:54 0 d-------- C:\Program Files\CONEXANT
2007-06-08 12:23:05 171136 -rahs---- C:\grldr
2007-06-08 12:22:36 11210 --a------ C:\Windows\system32\vstaldr2
2007-06-08 12:22:36 159552 --a------ C:\Windows\system32\vstaldr1
2007-06-08 12:22:36 226 --a------ C:\Windows\system32\incom.vbs
2007-06-08 12:22:36 175 --a------ C:\Windows\system32\com.vbs
2007-06-08 12:22:36 87552 --a------ C:\Windows\system32\bootrest.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-06-08 12:22:36 87552 --a------ C:\Windows\system32\bootinst.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-06-08 12:22:36 374 --a------ C:\Windows\system32\Asus.bin


-- Find3M Report ---------------------------------------------------------------

2007-06-10 15:10:15 0 d-------- C:\Users\Angel\AppData\Roaming\LimeWire
2007-06-09 21:26:15 0 d-------- C:\Users\Angel\AppData\Roaming\Apple Computer
2007-06-09 19:15:17 0 d-------- C:\Users\Angel\AppData\Roaming\SecondLife
2007-06-09 11:13:26 0 d-------- C:\Users\Angel\AppData\Roaming\Ultimate Fixer
2007-06-09 11:08:33 0 d-------- C:\Users\Angel\AppData\Roaming\SopCast
2007-06-09 01:02:23 0 d-------- C:\Users\Angel\AppData\Roaming\ppstream
2007-06-08 21:48:48 0 d-------- C:\Users\Angel\AppData\Roaming\uTorrent
2007-06-08 19:09:56 0 d-------- C:\Users\Angel\AppData\Roaming\Adobe
2007-06-08 18:31:07 0 d-------- C:\Users\Angel\AppData\Roaming\Google
2007-06-08 14:19:25 0 d-------- C:\Users\Angel\AppData\Roaming\Identities
2007-06-08 14:00:40 0 d-------- C:\Users\Angel\AppData\Roaming\yahoo!
2007-06-08 13:51:14 0 d-------- C:\Users\Angel\AppData\Roaming\Macromedia
2007-06-08 12:38:22 0 d-------- C:\Program Files\Windows Defender
2007-06-08 12:38:21 0 d-------- C:\Program Files\Windows Mail
2007-06-08 12:22:36 0 d-------- C:\Users\Angel\AppData\Roaming\WinRAR


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Windows Defender"=hex(2):25,50,72,6f,67,72,61,6d,46,69,6c,65,73,25,5c,57,69,\
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"twbutobw.exe"="C:\\ProgramData\\twbutobw.exe"
"lanmanwrk.exe"="C:\\Windows\\System32\\lanmanwrk.exe"
"Ultimate Fixer"="\"C:\\Program Files\\Ultimate Fixer\\UltimateFixer.exe\" hide"
"Mircosoft Windows Development Environment"="devenv.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"Ieuu"="\"C:\\Windows\\TSKS~1\\cmd.exe\" -vt yazb"
"Ofoyhrw"="C:\\Windows\\?dobe\\??plorer.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Mircosoft Windows Development Environment"="devenv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000001
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"scforceoption"=dword:00000000
"FilterAdministratorToken"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\UIPI]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\UIPI\Clipboard]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{8A61098D-612B-4EF2-943D-64E920684061}"=""

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpmmn
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winads32

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="credssp.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Notification Packages REG_MULTI_SZ scecli\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0\0
Authentication Packages REG_MULTI_SZ msv1_0\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AppInfo
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\KeyIso
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\NTDS
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\ProfSvc
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sacsvr
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\SWPRV
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\TabletInputService
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\TBS
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\TrustedInstaller
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\volmgr.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\volmgrx.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ nsi\0lltdsvc\0SSDPSRV\0upnphost\0SCardSvr\0w32time\0EventSystem\0RemoteRegistry\0WinHttpAutoProxySvc\0lanmanworkstation\0TBS\0SLUINotify\0THREADORDER\0fdrespub\0netprofm\0fdphost\0wcncsvc\0QWAVE\0Mcx2Svc\0WebClient\0\0
LocalSystemNetworkRestricted REG_MULTI_SZ hidserv\0UxSms\0WdiSystemHost\0Netman\0trkwks\0AudioEndpointBuilder\0WUDFSvc\0irmon\0sysmain\0IPBusEnum\0dot3svc\0PcaSvc\0CscService\0wlansvc\0UmRdpService\0EMDMgmt\0WPDBusEnum\0TabletInputService\0\0
NetworkServiceNetworkRestricted REG_MULTI_SZ PolicyAgent\0\0
LocalServiceNoNetwork REG_MULTI_SZ PLA\0DPS\0BFE\0mpssvc\0ehstart\0\0
NetworkService REG_MULTI_SZ CryptSvc\0DHCP\0TermService\0KtmRm\0DNSCache\0NapAgent\0nlasvc\0WinRM\0WECSVC\0Tapisrv\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WerSvcGroup REG_MULTI_SZ wersvc\0\0
swprv REG_MULTI_SZ swprv\0\0
LocalServiceNetworkRestricted REG_MULTI_SZ DHCP\0eventlog\0AudioSrv\0LmHosts\0wscsvc\0p2pimsvc\0PNRPSvc\0p2psvc\0WPCSvc\0PnrpAutoReg\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
regsvc REG_MULTI_SZ RemoteRegistry\0\0
wcssvc REG_MULTI_SZ WcsPlugInService\0\0
DcomLaunch REG_MULTI_SZ PlugPlay\0DcomLaunch\0\0
wdisvc REG_MULTI_SZ WdiServiceHost\0\0
sdrsvc REG_MULTI_SZ sdrsvc\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
secsvcs REG_MULTI_SZ WinDefend\0\0

hklm\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
AeLookupSvc
wercplsupport
CertPropSvc
SCPolicySvc
gpsvc
IKEEXT
LogonHours
PCAudit
iphlpsvc
AppInfo
msiscsi
MMCSS
ProfSvc
EapHost
SessionEnv
hkmsvc


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{caef5432-1603-11dc-b966-806e6f6e6963}]
shell\AutoRun\command E:\SETUP.EXE


-- End of Deckard's System Scanner: finished at 2007-06-10 at 18:45:47 ---------