Here's the log file after the DSS:
Deckard's System Scanner v20071014.68
Run by Geon on 2008-07-25 13:54:14
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
33: 2008-07-25 18:54:39 UTC - RP63 - Deckard's System Scanner Restore Point
32: 2008-07-25 17:29:36 UTC - RP62 - Removed Apple Software Update
31: 2008-07-25 17:27:57 UTC - RP61 - Removed Bonjour
30: 2008-07-25 15:25:32 UTC - RP60 - System Checkpoint
29: 2008-07-15 01:45:37 UTC - RP59 - Removed Windows Live Sign-in Assistant
-- First Restore Point --
1: 2008-05-01 20:15:33 UTC - RP31 - Removed Apple Mobile Device Support
Backed up registry hives.
Performed disk cleanup.
Percentage of Memory in Use: 80% (more than 75%).Total Physical Memory: 120 MiB (512 MiB recommended).-- HijackThis (run as Geon.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:04 PM, on 7/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Documents and Settings\Geon\Desktop\Deckard's System Scanner.exe
C:\DOCUME~1\Geon\Desktop\HIJACK~1\Geon.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.c...rch/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://us.rd.yahoo.c...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.c...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://us.rd.yahoo.c...//www.yahoo.comO2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {45A4902E-4479-4EAE-A186-8D0F7E4C78DE} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRAM FILES\YAHOO!\COMMON\YIESRVC.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: (no name) - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - (no file)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRAM FILES\YAHOO!\COMMON\YIESRVC.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -
http://crucial.com/c.../cpcScanner.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -
http://cdn2.zone.msn...ro.cab56649.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.m...ash/swflash.cabO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
--
End of file - 6654 bytes
-- File Associations -----------------------------------------------------------
.bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153.com - comfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,2.hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23.ini - inifile - DefaultIcon - shell32.dll,-151.js - JSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,7.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1.txt - txtfile - DefaultIcon - shell32.dll,-152.vbs - VBSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,6-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
All drivers whitelisted.
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Scheduled Tasks -------------------------------------------------------------
2008-07-25 13:45:04 354 --a------ C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job
2008-07-25 13:13:46 370 --a------ C:\WINDOWS\Tasks\RegCure.job
2008-07-25 13:13:46 436 --a------ C:\WINDOWS\Tasks\RegCure Program Check.job
2008-07-25 13:08:06 490 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check 05112007165003.job
2008-07-25 13:00:20 350 --a------ C:\WINDOWS\Tasks\At14.job
2008-07-25 13:00:14 350 --a------ C:\WINDOWS\Tasks\At38.job
2008-07-25 12:00:06 350 --a------ C:\WINDOWS\Tasks\At13.job
2008-07-25 12:00:02 350 --a------ C:\WINDOWS\Tasks\At37.job
2008-07-25 11:00:16 350 --a------ C:\WINDOWS\Tasks\At12.job
2008-07-25 11:00:12 350 --a------ C:\WINDOWS\Tasks\At36.job
2008-07-25 10:00:04 350 --a------ C:\WINDOWS\Tasks\At11.job
2008-07-25 10:00:02 350 --a------ C:\WINDOWS\Tasks\At35.job
2008-07-24 23:01:14 350 --a------ C:\WINDOWS\Tasks\At24.job
2008-07-24 23:00:48 350 --a------ C:\WINDOWS\Tasks\At48.job
2008-07-24 22:02:34 350 --a------ C:\WINDOWS\Tasks\At23.job
2008-07-24 22:02:06 350 --a------ C:\WINDOWS\Tasks\At47.job
2008-07-24 21:00:06 350 --a------ C:\WINDOWS\Tasks\At22.job
2008-07-24 21:00:04 350 --a------ C:\WINDOWS\Tasks\At46.job
2008-07-24 20:50:46 490 --a------ C:\WINDOWS\Tasks\McAfee.com Update Check 10242006123100.job
2008-07-22 14:08:32 350 --a------ C:\WINDOWS\Tasks\At39.job
2008-07-22 14:00:06 350 --a------ C:\WINDOWS\Tasks\At15.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At45.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At44.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At43.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At42.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At41.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At40.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At34.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At33.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At32.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At31.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At30.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At29.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At28.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At27.job
2008-07-22 12:30:36 350 --a------ C:\WINDOWS\Tasks\At26.job
2008-07-22 12:30:34 350 --a------ C:\WINDOWS\Tasks\At25.job
2008-07-20 20:00:40 350 --a------ C:\WINDOWS\Tasks\At21.job
2008-07-18 17:00:28 350 --a------ C:\WINDOWS\Tasks\At18.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At9.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At8.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At7.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At6.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At5.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At4.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At3.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At20.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At2.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At19.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At17.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At16.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At10.job
2008-07-13 20:31:06 350 --a------ C:\WINDOWS\Tasks\At1.job
2008-06-04 19:00:02 502 --a------ C:\WINDOWS\Tasks\Tune-up Application Start.job
-- Files created between 2008-06-25 and 2008-07-25 -----------------------------
2008-07-25 13:12:50 0 d-------- C:\Program Files\RegCure
2008-07-23 23:14:22 0 d-------- C:\Documents and Settings\Geon\Application Data\gtk-2.0
2008-07-23 23:13:22 0 d-------- C:\Documents and Settings\Geon\.thumbnails
2008-07-23 23:10:28 0 d-------- C:\Documents and Settings\Geon\.gimp-2.4
2008-07-23 23:07:57 0 d-------- C:\Program Files\GIMP-2.0
2008-07-22 14:01:18 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Macromedia
2008-07-22 14:01:16 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Adobe
2008-07-22 14:00:19 0 dr------- C:\Documents and Settings\NetworkService\Favorites
2008-07-16 20:59:06 0 d--hs---- C:\FOUND.006
2008-07-14 20:45:52 0 d-------- C:\WINDOWS\system32\appmgmt
2008-07-13 20:31:03 29760 --a------ C:\WINDOWS\system32\RqPjjFlL.exe
2008-07-03 21:33:35 0 d-------- C:\Program Files\Safari
2008-06-26 19:50:54 0 dr-h----- C:\$VAULT$.AVG
2008-06-26 19:24:33 0 d-------- C:\Documents and Settings\Geon\Application Data\U3
2008-06-25 19:28:51 0 d-------- C:\Documents and Settings\Geon\Application Data\AVG7
2008-06-25 19:25:46 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-06-25 19:23:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-25 19:23:32 0 d-------- C:\Documents and Settings\All Users\Application Data\avg7
-- Find3M Report ---------------------------------------------------------------
2008-07-24 22:32:14 1744 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-22 14:24:12 1632 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-06-30 19:17:04 4608 --a------ C:\Documents and Settings\Geon\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2008-06-19 14:11:18 171064 --a------ C:\Documents and Settings\Geon\Application Data\GDIPFONTCACHEV1.DAT
2008-06-04 21:55:28 4278470 --ah----- C:\Documents and Settings\Geon\Application Data\IconCache.db
2008-06-04 17:45:12 0 d-------- C:\Program Files\Microsoft.NET
2008-06-04 17:43:50 0 d-------- C:\Program Files\Microsoft ActiveSync
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45A4902E-4479-4EAE-A186-8D0F7E4C78DE}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [08/04/2004 12:00 PM C:\WINDOWS\SYSTEM32\systray.exe]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [06/02/2003 02:25 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [06/25/2008 07:24 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:00 PM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 12:15:54 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoRun"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"=0 (0x0)
"NoRun"=0 (0x0)
"NoClose"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoFileMenu"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"VirusScan Online"=C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"SoundMan"=soundman.exe
"HPDJ Taskbar Utility"=C:\WINDOWS\SYSTEM32\hpztsb03.exe
"LoadQM"=loadqm.exe
"AVG7_CC"=C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
"AVG7_EMC"=C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE
"AVG7_AMSVR"=C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5e38c10-0060-11dd-ba3e-0001292cbee4}]
Auto\command- setup.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
-- End of Deckard's System Scanner: finished at 2008-07-25 13:58:06 ------------