Here is my main.txt and extra.txt. Thank you so very much ahead of time for any and all assistance.
MAIN.TXT-
Deckard's System Scanner v20071014.68
Run by Steve on 2008-05-25 18:13:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
25: 2008-05-25 22:13:51 UTC - RP164 - Deckard's System Scanner Restore Point
24: 2008-05-25 21:07:06 UTC - RP163 - Installed McAfee VirusScan Enterprise
23: 2008-05-25 20:58:45 UTC - RP162 - Removed CodeZulu Bind Maker
22: 2008-05-25 16:43:48 UTC - RP161 - Software Distribution Service 3.0
21: 2008-05-25 15:39:31 UTC - RP160 - Software Distribution Service 3.0
-- First Restore Point --
1: 2008-05-23 23:15:09 UTC - RP140 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
-- HijackThis (run as Steve.exe) -----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:14: VIRUS ALERT!, on 5/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
E:\Motherboard Monitor 5\MBM5.EXE
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Steve\Desktop\dss.exe
C:\DOCUME~1\Steve\Desktop\HIJACK~1\Steve.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://google.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: 818646 helper - {54192079-8E8A-43D8-BCBC-3874916159AF} - (no file)
O2 - BHO: QXK Olive - {5AB14FEE-E161-455B-9A60-91AE848F8FA0} - C:\WINDOWS\nldfmtapefs.dll
O2 - BHO: (no name) - {613E416F-BCB6-43AD-B0FC-DF7B0D5A70BF} - C:\WINDOWS\system32\ssqPggGy.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: QXK Olive - {B33B96B9-E0C2-4648-9819-A38DDCAFA33C} - C:\WINDOWS\boqnrwdmstg.dll
O2 - BHO: (no name) - {B8912258-3C5F-4C39-AA7F-220239956126} - C:\WINDOWS\system32\wvUmMGAp.dll (file missing)
O2 - BHO: (no name) - {D1E9246F-438E-40B0-8BC1-DBB9FE47D745} - blank (file missing)
O2 - BHO: (no name) - {D6DABF5B-85A6-4A7F-8000-A7D70FEB9597} - C:\WINDOWS\system32\yayAQGvT.dll (file missing)
O2 - BHO: (no name) - {E06E930D-6949-4EB3-ACC7-68279A48892A} - C:\WINDOWS\system32\hgGXrrpQ.dll (file missing)
O2 - BHO: (no name) - {E3249750-AA1A-4A75-8FA5-272BF4C58EAE} - C:\WINDOWS\system32\xxyywxwU.dll (file missing)
O2 - BHO: (no name) - {E44CF5DF-A427-4AAF-A6A8-3AEC30F2EBBF} - C:\WINDOWS\system32\jkkHWQIY.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: gktxaspm - {2890C98D-5959-4A94-A6C2-C59E85462152} - blank (file missing)
O3 - Toolbar: atfxqogp - {9E6CD9DF-5EF9-40F4-84FA-C4842EB1F283} - C:\WINDOWS\atfxqogp.dll (file missing)
O4 - HKLM\..\Run: [MBM 5] "E:\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [EPSON Stylus CX5400 (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P28 "EPSON Stylus CX5400 (Copy 2)" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [EPSON Stylus CX5400 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P28 "EPSON Stylus CX5400 (Copy 1)" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [EPSON Stylus CX5400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [3c7c2cee] rundll32.exe "C:\WINDOWS\system32\cqorqovu.dll",b
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKCU\..\Run: [EPSON Stylus CX5400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /M "Stylus CX5400" /EF "HKCU"
O4 - HKCU\..\Run: [WinSpywareProtect (ver. 5.1)] "C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe" /autorun
O4 - Global Startup: $McRebootA5E6DEAA56$.lnk = C:\WINDOWS\system32\cmd.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -
http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) -
http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
http://142.176.20.26/islandcam/AxisCamControl.ocx
O20 - Winlogon Notify: ssqPggGy - C:\WINDOWS\SYSTEM32\ssqPggGy.dll
O21 - SSODL: ComponentBoot - {2281dd5f-6f4b-4bde-822a-a237b1f49cb4} - C:\WINDOWS\Resources\ComponentBoot.dll
O21 - SSODL: vregfwlx - {F2C6D84C-76E7-412E-B235-97FFA040063D} - C:\WINDOWS\vregfwlx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 8360 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 mbmiodrvr - c:\windows\system32\mbmiodrvr.sys <Not Verified;
[email protected]; Windows (R) 2000 DDK driver>
R2 tcaicchg - c:\windows\system32\tcaicchg.sys <Not Verified; 3Com Corporation; 3Com Windows NT NIC Diagnostic/Configuration>
R2 TCAITDI (TCAITDI Protocol) - c:\windows\system32\drivers\tcaitdi.sys <Not Verified; 3Com Corporation; 3Com Windows NT NIC Diagnostic TDI Driver>
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 3Com Gigabit LOM (3C940)
Device ID: PCI\VEN_10B7&DEV_1700&SUBSYS_80EB1043&REV_12\4&2E98101C&0&28F0
Manufacturer: 3Com
Name: 3Com Gigabit LOM (3C940)
PNP Device ID: PCI\VEN_10B7&DEV_1700&SUBSYS_80EB1043&REV_12\4&2E98101C&0&28F0
Service: EL2000
-- Files created between 2008-04-25 and 2008-05-25 -----------------------------
2008-05-25 17:53:34 4884 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-25 17:53:10 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-25 17:53:10 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-05-25 17:53:10 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-05-25 17:53:10 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-25 17:53:10 82944 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-25 17:53:09 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-05-25 17:53:09 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified;
http://www.beyondlogic.org; Command Line Process Utility>
2008-05-25 17:53:09 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-25 17:08:20 1495552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk>
2008-05-25 17:08:20 0 d-------- C:\Program Files\Common Files\Cisco Systems
2008-05-25 17:07:01 0 d-------- C:\Program Files\McAfee
2008-05-25 17:07:01 0 d-------- C:\Program Files\Common Files\McAfee
2008-05-25 12:45:14 90624 --a------ C:\WINDOWS\system32\cqorqovu.dll
2008-05-25 12:44:32 698141 --ahs---- C:\WINDOWS\system32\YIQWHkkj.ini2
2008-05-25 12:44:29 318336 --a------ C:\WINDOWS\system32\jkkHWQIY.dll
2008-05-25 11:47:24 693904 --ahs---- C:\WINDOWS\system32\pAGMmUvw.ini2
2008-05-25 10:37:44 694044 --ahs---- C:\WINDOWS\system32\Uwxwyyxx.ini2
2008-05-25 09:10:08 90624 --a------ C:\WINDOWS\system32\ycmtrdrq.dll
2008-05-25 09:09:51 323584 --a------ C:\WINDOWS\vregfwlx.dll
2008-05-25 09:09:50 94208 --a------ C:\WINDOWS\xmpstean.exe
2008-05-25 09:09:50 159744 --a------ C:\WINDOWS\edwf.exe
2008-05-25 09:09:50 266240 --a------ C:\WINDOWS\boqnrwdmstg.dll
2008-05-24 01:10:02 9728 --a------ C:\Program Files\tmp2.exe
2008-05-24 01:10:02 9728 --a------ C:\Program Files\tmp1.exe
2008-05-24 01:10:02 9728 --a------ C:\Program Files\tmp0.exe
2008-05-24 01:09:56 0 d-------- C:\WINDOWS\system32\818646
2008-05-24 00:39:07 90112 --a------ C:\WINDOWS\system32\mutisnwc.dll
2008-05-23 23:48:07 693428 --ahs---- C:\WINDOWS\system32\TvGQAyay.ini2
2008-05-23 22:25:26 1716 --ahs---- C:\WINDOWS\system32\QprrXGgh.ini2
2008-05-23 20:22:00 0 d-------- C:\Documents and Settings\Steve\Application Data\TmpRecentIcons
2008-05-23 20:10:01 62910 --a------ C:\Program Files\Uninstall.exe <Not Verified; $PROGRAMNAME; $PROGRAMNAME>
2008-05-23 20:10:01 0 --a------ C:\Program Files\uninstall.dat
2008-05-23 19:15:51 90112 --a------ C:\WINDOWS\system32\xtbkteks.dll
2008-05-23 19:14:59 1905 --ahs---- C:\WINDOWS\system32\nnTsYcdd.ini2
2008-05-23 19:10:51 29312 --a------ C:\WINDOWS\system32\vtUlKEtt.dll
2008-05-23 19:09:52 29312 --a------ C:\WINDOWS\system32\ssqPggGy.dll
2008-05-23 19:09:45 217088 --a------ C:\WINDOWS\nldfmtapefs.dll
2008-05-23 19:09:45 81920 --a------ C:\WINDOWS\mdtgkswr.exe
2008-05-23 19:09:45 176128 --a------ C:\WINDOWS\gnowmebk.dll
2008-05-23 19:09:45 94208 --a------ C:\WINDOWS\eope.exe
-- Find3M Report ---------------------------------------------------------------
2008-05-25 17:08:20 0 d-------- C:\Program Files\Common Files
2008-04-22 20:18:13 0 d-------- C:\Program Files\Common Files\INCA Shared
2008-04-18 09:28:39 2547 --a------ C:\WINDOWS\unins000.dat
2008-04-18 09:27:18 691545 --a------ C:\WINDOWS\unins000.exe
2008-03-29 11:56:47 0 d-------- C:\Program Files\Google
2008-03-28 14:11:53 0 d-------- C:\Program Files\Java
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54192079-8E8A-43D8-BCBC-3874916159AF}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5AB14FEE-E161-455B-9A60-91AE848F8FA0}]
05/23/2008 14:50: VIRUS ALERT! 217088 --a------ C:\WINDOWS\nldfmtapefs.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{613E416F-BCB6-43AD-B0FC-DF7B0D5A70BF}]
05/23/2008 19:09: VIRUS ALERT! 29312 --a------ C:\WINDOWS\system32\ssqPggGy.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B33B96B9-E0C2-4648-9819-A38DDCAFA33C}]
05/24/2008 11:19: VIRUS ALERT! 266240 --a------ C:\WINDOWS\boqnrwdmstg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8912258-3C5F-4C39-AA7F-220239956126}]
C:\WINDOWS\system32\wvUmMGAp.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D1E9246F-438E-40B0-8BC1-DBB9FE47D745}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D6DABF5B-85A6-4A7F-8000-A7D70FEB9597}]
C:\WINDOWS\system32\yayAQGvT.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E06E930D-6949-4EB3-ACC7-68279A48892A}]
C:\WINDOWS\system32\hgGXrrpQ.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E3249750-AA1A-4A75-8FA5-272BF4C58EAE}]
C:\WINDOWS\system32\xxyywxwU.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E44CF5DF-A427-4AAF-A6A8-3AEC30F2EBBF}]
05/25/2008 12:44: VIRUS ALERT! 318336 --a------ C:\WINDOWS\system32\jkkHWQIY.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MBM 5"="E:\Motherboard Monitor 5\MBM5.EXE" [06/12/2004 10:40: VIRUS ALERT!]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [07/13/2006 15:11: VIRUS ALERT!]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [11/04/2005 19:07: VIRUS ALERT!]
"CTHelper"="CTHELPER.EXE" [05/24/2006 00:20: VIRUS ALERT! C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [05/24/2006 00:20: VIRUS ALERT! C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [05/11/2000 02:00: VIRUS ALERT!]
"TCASUTIEXE"="TCAUDIAG.exe" [02/12/2003 05:55: VIRUS ALERT! C:\WINDOWS\system32\TCAUDIAG.EXE]
"RegistryMechanic"="" []
"EPSON Stylus CX5400 (Copy 2)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.exe" [05/26/2003 20:00: VIRUS ALERT!]
"EPSON Stylus CX5400 (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.exe" [05/26/2003 20:00: VIRUS ALERT!]
"EPSON Stylus CX5400"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.exe" [05/26/2003 20:00: VIRUS ALERT!]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [10/31/2003 19:42: VIRUS ALERT!]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/2007 10:54: VIRUS ALERT!]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25: VIRUS ALERT!]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [06/10/2005 05:21: VIRUS ALERT!]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09: VIRUS ALERT!]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 20:51: VIRUS ALERT!]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 13:35: VIRUS ALERT!]
"3c7c2cee"="C:\WINDOWS\system32\cqorqovu.dll" [05/25/2008 12:45: VIRUS ALERT!]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [11/30/2006 08:50: VIRUS ALERT!]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [11/17/2006 13:39: VIRUS ALERT!]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus CX5400"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.exe" [05/26/2003 20:00: VIRUS ALERT!]
"Steam"="" []
"WinSpywareProtect (ver. 5.1)"="C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe" []
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
$McRebootA5E6DEAA56$.lnk - C:\WINDOWS\system32\cmd.exe [8/23/2001 8:00:00 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"DisableRegistryTools"=0 (0x0)
"NoDispCPL"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoToolbarCustomize"=1 (0x1)
"StartMenuLogoff"=1 (0x1)
"NoStartMenuMorePrograms"=0 (0x0)
"NoSetFolders"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{613E416F-BCB6-43AD-B0FC-DF7B0D5A70BF}"= C:\WINDOWS\system32\ssqPggGy.dll [05/23/2008 19:09: VIRUS ALERT! 29312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ComponentBoot"= {2281dd5f-6f4b-4bde-822a-a237b1f49cb4} - C:\WINDOWS\Resources\ComponentBoot.dll [05/24/2008 01:09: VIRUS ALERT! 14886]
"vregfwlx"= {F2C6D84C-76E7-412E-B235-97FFA040063D} - C:\WINDOWS\vregfwlx.dll [05/24/2008 11:19: VIRUS ALERT! 323584]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqPggGy]
ssqPggGy.dll 05/23/2008 19:09: VIRUS ALERT! 29312 C:\WINDOWS\system32\ssqPggGy.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkHWQIY
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Steve^Start Menu^Programs^Startup^MultiRes.lnk]
backup=C:\WINDOWS\pss\MultiRes.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
"C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37c2598e-8d40-11db-a7cc-000c6ecf411d}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL PortableVaultAES.exe
Explore\command- explorer.exe /n,/e ,.
Launch\command- G:\portablevaultaes.exe
*Newly Created Service* - MCAFEEFRAMEWORK
*Newly Created Service* - MCSHIELD
*Newly Created Service* - MCTASKMANAGER
*Newly Created Service* - MFEAPFK
*Newly Created Service* - MFETDIK
-- End of Deckard's System Scanner: finished at 2008-05-25 18:16:43 ------------
