Deckard's System Scanner v20071014.68 Run by CONDRA on 2008-04-28 23:30:10 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as CONDRA.exe) ---------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:30:12 PM, on 4/28/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Unable to get Internet Explorer version! Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvraidservice.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\CONDRA\Desktop\dss.exe C:\DOCUME~1\CONDRA\Desktop\EVERYT~1\TooX\HIJACK~1\CONDRA.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [CM108Sound] RunDll32 CM108.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1209413515312 O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 2612 bytes -- Files created between 2008-03-28 and 2008-04-28 ----------------------------- 2008-04-28 22:18:27 0 dr-h----- C:\Documents and Settings\CONDRA\Recent 2008-04-28 19:30:37 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-04-28 19:30:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-04-28 19:05:14 68096 --a------ C:\WINDOWS\zip.exe 2008-04-28 18:03:29 0 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-04-28 18:00:13 0 d-------- C:\WINDOWS\nview 2008-04-28 17:59:11 0 d-------- C:\NVIDIA 2008-04-28 17:20:42 0 d-------- C:\Documents and Settings\CONDRA\Application Data\Macromedia 2008-04-28 16:07:55 0 d--hs---- C:\WINDOWS\CSC 2008-04-28 09:51:51 0 d-------- C:\WINDOWS\3DEBCFB2389E419C842E15501ACC8C93.TMP 2008-04-27 14:11:47 1002 --a------ C:\WINDOWS\system32\tmp.reg 2008-04-27 14:11:28 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-04-27 14:11:28 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-04-27 14:11:28 86528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-04-27 14:11:28 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-04-27 14:11:28 82944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-04-27 14:11:28 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-04-27 14:11:28 82944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-04-27 14:11:27 53248 --a------ C:\WINDOWS\system32\Process.exe 2008-04-27 12:26:21 0 d-------- C:\Documents and Settings\CONDRA\Application Data\Malwarebytes 2008-04-27 12:26:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-04-26 12:54:32 161792 --a------ C:\WINDOWS\swreg.exe 2008-04-26 12:54:32 98816 --a------ C:\WINDOWS\sed.exe 2008-04-26 12:54:32 80412 --a------ C:\WINDOWS\grep.exe 2008-04-26 12:54:32 73728 --a------ C:\WINDOWS\fdsv.exe 2008-04-26 12:54:31 49152 --a------ C:\WINDOWS\VFind.exe 2008-04-26 12:54:31 212480 --a------ C:\WINDOWS\swxcacls.exe 2008-04-26 12:54:31 136704 --a------ C:\WINDOWS\swsc.exe 2008-04-26 10:54:04 0 d-------- C:\VundoFix Backups 2008-04-25 12:00:28 0 d-------- C:\Documents and Settings\CONDRA\Application Data\TuneUp Software 2008-04-25 12:00:18 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-04-25 12:00:13 0 d-------- C:\Program Files\TuneUp Utilities 2008 2008-04-23 23:31:47 0 d-------- C:\Documents and Settings\CONDRA\Application Data\Google 2008-04-23 22:17:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2008-04-23 22:17:14 0 d-------- C:\Program Files\Google 2008-04-23 19:53:04 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-04-23 19:53:04 2102272 --a------ C:\WINDOWS\system32\x264vfw.dll 2008-04-23 19:53:04 630784 --a------ C:\WINDOWS\system32\vp7vfw.dll 2008-04-23 19:53:04 438272 --a------ C:\WINDOWS\system32\vp6vfw.dll 2008-04-23 19:53:04 144384 --a------ C:\WINDOWS\system32\Iacenc.dll 2008-04-23 19:53:03 159839 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-04-23 19:53:03 755027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-04-23 19:53:03 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-04-23 19:53:03 81920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-04-23 19:53:02 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-04-23 19:53:02 682496 --a------ C:\WINDOWS\system32\divx.dll 2008-04-23 19:53:01 0 d-------- C:\Program Files\K-Lite Codec Pack 2008-04-23 12:31:15 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-04-22 19:34:24 0 d-------- C:\Documents and Settings\LocalService\Desktop 2008-04-22 19:29:33 0 d-------- C:\Program Files\Symantec AntiVirus 2008-04-22 19:29:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-04-22 11:36:19 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-22 11:36:18 0 d-------- C:\Documents and Settings\CONDRA\Application Data\Mozilla 2008-04-21 16:02:46 194 --a------ C:\WINDOWS\system32\RBDELDRV.BAT 2008-04-20 20:32:43 0 d-------- C:\Program Files\Lavasoft 2008-04-20 20:32:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-20 10:56:48 0 d-------- C:\WINDOWS\system32\delete me 2008-04-17 12:28:32 0 d-------- C:\Documents and Settings\All Users\Application Data\TrackMania 2008-04-17 08:44:00 0 d--h---c- C:\WINDOWS\ie8 2008-04-16 10:42:35 0 d-------- C:\Program Files\Microsoft Silverlight 2008-04-14 19:09:10 0 d-------- C:\WINDOWS\system32\Futuremark 2008-04-09 11:15:04 262144 --a------ C:\WINDOWS\Cmi108Uninstall.exe 2008-04-09 11:15:02 315392 --a------ C:\WINDOWS\system\fltr108.dll 2008-04-09 11:15:01 1294336 --a------ C:\WINDOWS\system32\drivers\CM108.sys 2008-04-09 11:15:01 249856 --a------ C:\WINDOWS\system32\CM108rm.exe 2008-04-09 11:15:01 45056 --a------ C:\WINDOWS\system32\CM108rm.dll 2008-04-09 11:15:01 32768 --a------ C:\WINDOWS\system32\c108prop.dll 2008-04-09 11:15:01 712704 --a------ C:\WINDOWS\system32\a3d108pu.dll 2008-04-08 00:22:14 0 d-------- C:\Program Files\eDimensional USB audio 2008-03-30 11:40:06 0 d-------- C:\WINDOWS\nvidia icons -- Find3M Report --------------------------------------------------------------- 2008-04-28 19:13:05 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-04-28 18:59:19 0 d-------- C:\Program Files\Common Files 2008-04-28 18:17:00 0 d-------- C:\Program Files\Steam 2008-04-28 17:20:32 0 d-------- C:\Documents and Settings\CONDRA\Application Data\Adobe 2008-04-28 14:44:30 0 d-------- C:\Documents and Settings\CONDRA\Application Data\BitTorrent 2008-04-25 11:59:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-04-24 22:00:43 0 d-------- C:\Program Files\PeerGuardian2 2008-04-23 19:48:44 0 d-------- C:\Program Files\DivX 2008-04-23 14:01:01 0 d-------- C:\Documents and Settings\CONDRA\Application Data\mIRC 2008-04-23 13:30:28 74720 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-04-22 17:32:44 0 d-------- C:\Program Files\THQ 2008-04-22 17:32:44 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-04-19 22:23:13 0 d-------- C:\Documents and Settings\CONDRA\Application Data\GrabIt 2008-04-17 09:58:00 384 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-0000000A-00001102-00000004-20021102}.dat 2008-04-17 09:58:00 384 --a------ C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000A-00001102-00000004-20021102}.dat 2008-04-15 22:30:02 0 d-------- C:\Program Files\Common Files\InstallShield 2008-04-01 21:21:27 0 d-------- C:\Program Files\Adobeman's DVDA GUI 2008-03-27 11:50:58 0 d-------- C:\Program Files\Giant 2008-03-27 11:20:11 0 d-------- C:\Program Files\LucasArts 2008-03-24 19:52:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe 2008-03-24 19:52:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2008-03-24 19:52:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2008-03-24 19:52:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2008-03-24 19:52:00 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2008-03-24 19:52:00 1482752 --a------ C:\WINDOWS\system32\nview.dll 2008-03-24 19:52:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2008-03-24 19:52:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2008-03-24 19:52:00 425984 --a------ C:\WINDOWS\system32\keystone.exe 2008-03-17 22:19:56 0 d-------- C:\Program Files\Pro Imaging Powertoys 2008-03-17 22:19:56 0 d-------- C:\Program Files\Common Files\Nikon 2008-03-17 22:09:09 0 d-------- C:\Program Files\Canon 2008-03-17 22:08:54 0 d-------- C:\Program Files\Common Files\Canon 2008-03-17 21:33:02 0 d-------- C:\Program Files\Common Files\Adobe 2008-03-15 08:40:46 0 d-------- C:\Program Files\Electronic Arts 2008-03-10 19:48:40 0 d---s---- C:\Program Files\HLSW 2008-02-28 20:19:06 215144 --a------ C:\WINDOWS\patchw32.dll 2008-02-28 20:11:05 0 d-------- C:\Program Files\AGEIA Technologies 2008-02-28 10:39:00 0 d-------- C:\Program Files\DVDFab Decrypter 3 2008-02-13 21:58:45 99 --a------ C:\WINDOWS\È 2008-02-13 21:56:33 184 --a------ C:\WINDOWS\system32\e000002.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [06/01/2006 07:09 AM] "Tweak UI"="TWEAKUI.CPL" [03/25/2003 07:49 AM C:\WINDOWS\system32\tweakui.cpl] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [04/11/2007 04:32 PM C:\WINDOWS\KHALMNPR.Exe] "CM108Sound"="CM108.cpl" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [03/24/2008 07:52 PM] "nwiz"="nwiz.exe" [03/24/2008 07:52 PM C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [03/24/2008 07:52 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [07/03/2007 01:32 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "EditLevel"=0 (0x0) "NoFileMenu"=0 (0x0) "NoCommonGroups"=0 (0x0) "NoRun"=0 (0x0) "NoClose"=0 (0x0) "NoSaveSettings"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminder.lnk] backup=C:\WINDOWS\pss\Event Planner Reminder.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk] backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^CONDRA^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] "C:\Program Files\BitTorrent_DNA\dna.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp] CTXFIHLP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] MMTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray2K] MMTray2k.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTrayLSI] MMTrayLSI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nHancer] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SB Audigy 2 Startup Menu] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Update] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "idsvc"=3 (0x3) "WMPNetworkSvc"=3 (0x3) "Creative Service for CDROM Access"=2 (0x2) "EPSON_PM_RPCV4_01"=2 (0x2) "ose"=3 (0x3) "odserv"=3 (0x3) "NMIndexingService"=3 (0x3) "Nero BackItUp Scheduler 3"=2 (0x2) "Microsoft Office Groove Audit Service"=3 (0x3) "InCDsrv"=2 (0x2) "AVG Anti-Spyware Guard"=2 (0x2) "IDriverT"=3 (0x3) "SSScsiSV"=3 (0x3) "SPTISRV"=3 (0x3) "SonicStage Back-End Service"=3 (0x3) "PACSPTISVR"=3 (0x3) "MSCSPTISRV"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) "Bonjour Service"=2 (0x2) "aawservice"=2 (0x2) "PREVXAgent"=2 (0x2) "TuneUp.Defrag"=3 (0x3) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp -- End of Deckard's System Scanner: finished at 2008-04-28 23:30:33 ------------