This topic is locked
I've gone ahead and run Deckard's System Scanner; it created the main.txt file but not the extra.txt file. Here is the main.txt:
Deckard's System Scanner v20071014.68
Run by z43 on 2008-07-17 14:21:01
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 504 MiB (512 MiB recommended).
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-17 14:21:11
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\TIREMOTE\wuser32.exe
C:\WINDOWS\TIREMOTE\TIRemoteService.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\VPTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\HPLamp.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\z43\winlogon.exe
C:\Program Files\Caere\PageKeeper30\system\PKJobs.exe
C:\Program Files\Caere\PageKeeper30\system\PKSlapi.exe
C:\Program Files\Caere\PageKeeper30\system\PKToPass.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Documents and Settings\z43\Desktop\dss.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {59AAD935-DB8D-4289-A0A3-67E2B3B55BAB} - C:\WINDOWS\system32\urqrQJAs.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {D22C5DD6-69C0-4C96-86BA-68AE91B01ABA} - C:\WINDOWS\system32\iifcASMC.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Track-It! Workstation Manager Service Monitor] C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Lamp] "C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hplamp.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\z43\winlogon.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [BM3f98707b] Rundll32.exe "C:\WINDOWS\system32\bdpfbgfu.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: cpeupdate.lnk = E:\Media\Xtras\ShareIns\cpeupdate.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: PageKeeper Jobs.lnk = C:\Program Files\Caere\PageKeeper30\system\PKJobs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.appl...ex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.wea...Transporter.cab?
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1120135301024
O16 - DPF: {708C978C-BBF5-4038-8DC1-64FF22BCFFB6} (AXScan Control) - https://10.254.254.2...aSpyRemoval.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.c...loadControl.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} (GDIChk Object) - http://www.microsoft...DI/0/GDIChk.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.ma...ash/swflash.cab
O17 - HKLM\Software\..\Telephony: DomainName = ileads.ad.hsvcity.com
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = ileads.ad.hsvcity.com
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = ileads.ad.hsvcity.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: urqrQJAs - C:\WINDOWS\system32\urqrQJAs.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG8\avgwdsvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Track-It! Remoting Helper (TIRemotingHelper) - Unknown owner - C:\WINDOWS\TIRHService.exe
O23 - Service: Track-It! Remote Control (TIRmtCtl) - Intuit Track-It! - C:\WINDOWS\TIREMOTE\wuser32.exe
O23 - Service: Track-It! Workstation Manager (TIRmtSvc) - Numara Software, Inc. - C:\WINDOWS\TIREMOTE\TIRemoteService.exe
O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\winvnc.exe
--
End of file - 9677 bytes
-- Files created between 2008-06-17 and 2008-07-17 -----------------------------
2008-07-17 12:01:51 77 --a------ C:\Documents and Settings\TEMP.ILEADS\3198.bat
2008-07-17 08:55:49 0 d-------- C:\Documents and Settings\TEMP.ILEADS\Application Data\AVGTOOLBAR
2008-07-17 07:04:17 32256 --a------ C:\WINDOWS\system32\ddCVnmnl.dll
2008-07-17 07:04:10 32256 --a------ C:\WINDOWS\system32\wvustSih.dll
2008-07-17 07:03:46 77 --a------ C:\Documents and Settings\TEMP.ILEADS\2109.bat
2008-07-16 15:53:38 0 d--h----- C:\$AVG8.VAULT$
2008-07-16 15:31:20 0 d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-16 15:31:19 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVGTOOLBAR
2008-07-16 14:53:13 102400 --a------ C:\WINDOWS\system32\msgcwwaq.dll
2008-07-16 14:51:06 81920 --a------ C:\WINDOWS\system32\gutmslqq.dll
2008-07-16 14:50:53 93696 --a------ C:\WINDOWS\system32\bdpfbgfu.dll
2008-07-16 14:50:13 847716 --ahs---- C:\WINDOWS\system32\CMSAcfii.ini2
2008-07-16 14:47:30 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-07-16 14:19:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\Google
2008-07-16 14:19:12 32256 --a------ C:\WINDOWS\system32\khfGWmJY.dll
2008-07-16 14:19:08 32256 --a------ C:\WINDOWS\system32\yaywXPij.dll
2008-07-16 12:21:29 102400 --a------ C:\WINDOWS\system32\uhjcfjoq.dll
2008-07-16 12:09:11 0 d-------- C:\WINDOWS\system32\aumsDK18
2008-07-16 12:09:00 32256 --a------ C:\WINDOWS\system32\nnnMefFw.dll
2008-07-16 12:08:58 32256 --a------ C:\WINDOWS\system32\urqrQJAs.dll
2008-07-16 12:08:29 77 --a------ C:\Documents and Settings\TEMP.ILEADS\7897.bat
2008-07-16 11:02:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-07-16 10:56:26 0 d-------- C:\Program Files\Alwil Software
2008-07-15 13:41:02 0 d-------- C:\Program Files\AVG
2008-07-15 12:38:21 77 --a------ C:\Documents and Settings\TEMP.ILEADS\1313.bat
2008-07-15 12:13:51 843642 --ahs---- C:\WINDOWS\system32\jQtsvGgh.ini2
2008-07-15 11:37:25 0 d-------- C:\Documents and Settings\z43\Application Data\Adobe
2008-07-15 11:11:51 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-15 10:48:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-15 10:38:28 63 --a------ C:\WINDOWS\system\SysSD.dll
2008-07-15 08:17:24 720194 --ahs---- C:\WINDOWS\system32\jmTDgMoq.ini2
2008-07-15 08:12:23 0 d-------- C:\WINDOWS\system32\olixds18
2008-07-15 08:12:06 77 --a------ C:\Documents and Settings\TEMP.ILEADS\4002.bat
2008-07-11 11:15:56 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia
2008-07-11 11:15:56 0 d-------- C:\Documents and Settings\LocalService\Application Data\Adobe
2008-07-11 10:17:52 0 d-------- C:\Documents and Settings\Administrator\Application Data\U3
2008-07-11 09:28:58 0 d-------- C:\Documents and Settings\LocalService\Application Data\Google
2008-07-11 09:28:57 0 d--hs---- C:\WINDOWS\SHVudHN2aWxsZSBQb2xpY2UgRGVwYXJ0bWVudA
2008-07-11 09:28:56 0 d-------- C:\Program Files\Temporary
2008-07-11 08:47:55 0 dr------- C:\Documents and Settings\LocalService\Favorites
2008-07-11 05:02:05 101888 --a------ C:\WINDOWS\system32\haejqr.dll
2008-07-11 05:02:04 101888 --a------ C:\WINDOWS\system32\wusrhsqr.dll
2008-07-10 05:04:14 101376 --a------ C:\WINDOWS\system32\zzhpvc.dll
2008-07-10 05:04:13 101376 --a------ C:\WINDOWS\system32\bgbuucpg.dll
2008-07-09 16:06:27 2312 --ahs---- C:\WINDOWS\system32\adgPonnn.ini2
2008-07-09 15:58:28 37376 --a------ C:\Documents and Settings\TEMP.ILEADS\services.exe
2008-07-09 15:24:55 0 d-------- C:\Program Files\Conduit
2008-07-09 15:24:50 0 d-------- C:\Documents and Settings\TEMP.ILEADS\Application Data\BitZipper
2008-07-09 15:12:44 0 d-------- C:\Program Files\Motorola
2008-07-09 15:05:25 22768 --a------ C:\Documents and Settings\TEMP.ILEADS\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft® Windows ® 2000 Operating System>
2008-07-09 10:08:47 0 d-------- C:\WINDOWS\system32\Adobe
2008-07-08 13:59:53 0 d-------- C:\Program Files\Common Files\DirectX
2008-07-08 13:59:46 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 18:38:32 53248 ---hs---- C:\Documents and Settings\z43\winlogon.exe
2008-06-27 18:38:32 53248 ---hs---- C:\Documents and Settings\TEMP.ILEADS\winlogon.exe
2008-06-27 18:38:32 53248 ---hs---- C:\Documents and Settings\Administrator\winlogon.exe
2008-06-17 09:37:14 0 d-------- C:\Documents and Settings\carlton.brooks.ad\Application Data\Adobe
2008-06-17 09:36:11 0 d-------- C:\Documents and Settings\carlton.brooks.ad\Application Data\Google
2008-06-17 09:31:12 0 d-------- C:\Documents and Settings\carlton.brooks.ad\Application Data\Identities
2008-06-17 09:28:12 0 dr------- C:\Documents and Settings\carlton.brooks.ad\Favorites
2008-06-17 09:28:12 0 d-------- C:\Documents and Settings\carlton.brooks.ad\Desktop
2008-06-17 09:28:12 0 d--hs---- C:\Documents and Settings\carlton.brooks.ad\Cookies
2008-06-17 09:28:12 0 dr-h----- C:\Documents and Settings\carlton.brooks.ad\Application Data
2008-06-17 09:28:12 0 d---s---- C:\Documents and Settings\carlton.brooks.ad\Application Data\Microsoft
2008-06-17 09:28:11 0 d--h----- C:\Documents and Settings\carlton.brooks.ad\Templates
2008-06-17 09:28:11 0 dr------- C:\Documents and Settings\carlton.brooks.ad\Start Menu
2008-06-17 09:28:11 0 dr-h----- C:\Documents and Settings\carlton.brooks.ad\SendTo
2008-06-17 09:28:11 0 dr-h----- C:\Documents and Settings\carlton.brooks.ad\Recent
2008-06-17 09:28:11 0 d--h----- C:\Documents and Settings\carlton.brooks.ad\PrintHood
2008-06-17 09:28:11 819200 --a------ C:\Documents and Settings\carlton.brooks.ad\NTUSER.DAT
2008-06-17 09:28:11 0 d--h----- C:\Documents and Settings\carlton.brooks.ad\NetHood
2008-06-17 09:28:11 0 dr------- C:\Documents and Settings\carlton.brooks.ad\My Documents
2008-06-17 09:28:11 0 d--h----- C:\Documents and Settings\carlton.brooks.ad\Local Settings
2008-06-17 09:21:46 0 d-------- C:\Program Files\MCS
-- Find3M Report ---------------------------------------------------------------
2008-07-15 13:21:52 0 d-------- C:\Program Files\Common Files
2008-07-14 08:59:43 0 d-------- C:\Program Files\Java
2008-07-09 16:00:18 109249 --a------ C:\Program Files\MSWINSCK.OCX <Not Verified; Microsoft Corporation; Microsoft Winsock Control>
2008-06-17 09:21:26 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-06-10 08:29:10 1080 --a------ C:\WINDOWS\AUTOLNCH.REG
2008-05-29 10:39:50 0 d-------- C:\Program Files\Common Files\Adobe
2008-05-29 10:39:47 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-02 20:01:58 1568 --a------ C:\mcs.reg
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59AAD935-DB8D-4289-A0A3-67E2B3B55BAB}]
07/16/2008 12:08 PM 32256 --a------ C:\WINDOWS\system32\urqrQJAs.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
07/16/2008 03:31 PM 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D22C5DD6-69C0-4C96-86BA-68AE91B01ABA}]
C:\WINDOWS\system32\iifcASMC.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [07/30/2002 11:35 AM]
"WinVNC"="C:\Program Files\RealVNC\WinVNC\WinVNC.exe" [11/27/2002 01:47 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]
"Track-It! Workstation Manager Service Monitor"="C:\WINDOWS\TIREMOTE\TIServiceMonitor.exe" [01/31/2007 10:57 AM]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [06/07/2003 06:32 AM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [09/24/2005 12:08 AM]
"HP Lamp"="C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hplamp.exe" [06/25/1999 02:00 AM]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [05/01/2003 06:44 PM]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [07/18/2003 05:23 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/09/2008 09:47 AM]
"Windows Logon Applicationedc"="C:\Documents and Settings\z43\winlogon.exe" [06/27/2008 06:38 PM]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [07/16/2008 03:31 PM]
"BM3f98707b"="C:\WINDOWS\system32\bdpfbgfu.dll" [07/16/2008 02:50 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B4977567-6B39-4AFA-9CD2-47A20209F5FE}"= C:\WINDOWS\system32\pmNHwvUN.dll [ ]
"{59AAD935-DB8D-4289-A0A3-67E2B3B55BAB}"= C:\WINDOWS\system32\urqrQJAs.dll [07/16/2008 12:08 PM 32256]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrQJAs]
urqrQJAs.dll 07/16/2008 12:08 PM 32256 C:\WINDOWS\system32\urqrQJAs.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\iifcASMC
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=\\ad\SYSVOL\ad.hsvcity.com\scripts\addtrackitadmin.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-1006\Scripts\Logon\0\0]
"Script"=\\hpdpsc\NETLOGON\removeileads.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-1006\Scripts\Logon\1\0]
"Script"=\\hpdpsc\NETLOGON\WrittenDirectives.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-1006\Scripts\Logon\1\1]
"Script"=\\hpdpsc\NETLOGON\Written Directive Acknowledgement Web Site.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-1006\Scripts\Logon\1\2]
"Script"=\\hpdpsc\NETLOGON\AlaCOP.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2600\Scripts\Logon\0\0]
"Script"=\\hpdpsc\NETLOGON\IleadsMapReplace.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2600\Scripts\Logon\1\0]
"Script"=\\hpdpsc\NETLOGON\removeileads.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2600\Scripts\Logon\2\0]
"Script"=\\hpdpsc\NETLOGON\WrittenDirectives.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2600\Scripts\Logon\2\1]
"Script"=\\hpdpsc\NETLOGON\Written Directive Acknowledgement Web Site.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2600\Scripts\Logon\2\2]
"Script"=\\hpdpsc\NETLOGON\AlaCOP.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2820\Scripts\Logon\0\0]
"Script"=\\hpdpsc\NETLOGON\WrittenDirectives.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2820\Scripts\Logon\0\1]
"Script"=\\hpdpsc\NETLOGON\Written Directive Acknowledgement Web Site.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-2820\Scripts\Logon\0\2]
"Script"=\\hpdpsc\NETLOGON\AlaCOP.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-3438\Scripts\Logon\0\0]
"Script"=rgswaimhplj1200.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-3438\Scripts\Logon\0\1]
"Script"=rgswaimhpljc4600.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-3877\Scripts\Logon\0\0]
"Script"=\\hpdpsc\NETLOGON\WrittenDirectives.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-3877\Scripts\Logon\0\1]
"Script"=\\hpdpsc\NETLOGON\Written Directive Acknowledgement Web Site.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-3877\Scripts\Logon\1\0]
"Script"=rgswaimhplj1200.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1748781540-81348466-22564546-3877\Scripts\Logon\1\1]
"Script"=rgswaimhpljc4600.vbs
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}]
C:\Program Files\Services.exe
-- End of Deckard's System Scanner: finished at 2008-07-17 14:22:53
Thanks in advance for whatever help anyone can give me, this one is a little out of my league!
Sign In
Create Account
