ok i downloaded and ran dss. here are the results.
the main text says:
Deckard's System Scanner v20071014.68
Run by susyq on 2007-11-27 16:20:09
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- Last 5 Restore Point(s) --
23: 2007-11-27 19:02:42 UTC - RP220 - Scheduled Checkpoint
22: 2007-11-26 07:42:31 UTC - RP219 - Restore Operation
21: 2007-11-26 07:32:25 UTC - RP218 - Restore Operation
20: 2007-11-26 06:38:30 UTC - RP217 - Scheduled Checkpoint
19: 2007-11-22 17:21:13 UTC - RP216 - Scheduled Checkpoint
-- First Restore Point --
1: 2007-11-05 10:37:19 UTC - RP198 - Scheduled Checkpoint
Backed up registry hives.
Performed disk cleanup.
Total Physical Memory: 446 MiB (1024 MiB recommended).
-- HijackThis (run as susyq.exe) -----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:24:41 PM, on 11/27/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal
Running processes:
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\sysconf.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Users\susyq\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\susyq.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 200.124.131.116 casinocontroller.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [GenSrv] C:\Windows\sysconf.exe -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PokerTime Poker - {7220F1C9-B7E0-47a6-A0BD-D5B3940BCC79} - C:\Program Files\PokerTimeMPP\MPPoker.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {08653405-44A9-4E99-9C09-DD00770AAA08} (Support Platform Strapper) -
http://www.supportspace.com/rcp/4.0....pace_tools.dll
O16 - DPF: {40AC0F29-DF27-4711-B279-48B1F83A66AB} (AtlBoxWordCtlAttrib Class) -
http://kraisoft.com/files/online/aquacade.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://gfx1.mail.live.com/mail/w1/re...PUplden-us.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) -
http://js.dada.net/lib/uploader/Imag...?ts=20070921_2
O16 - DPF: {916CCBE5-C8C5-4F34-AEF8-064504454C75} (AtlAsianataCtlAttrib Class) -
http://kraisoft.com/files/online/asianata.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (Download Helper Class) -
http://activex.microgaming.com/DLhel...7/dlhelper.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://www.shockwave.com/content/zum...loader_v10.cab
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
--
End of file - 6282 bytes
-- File Associations -----------------------------------------------------------
All associations okay.
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R3 AvgWFP (AVG7 Firewall Driver x86) - c:\windows\system32\drivers\avgwfp.sys
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Files created between 2007-10-27 and 2007-11-27 -----------------------------
2007-11-26 06:18:00 0 d-------- C:\Program Files\Trend Micro
2007-11-25 23:12:54 0 dr------- C:\Users\wildcherrys\Searches
2007-11-25 23:12:39 0 dr------- C:\Users\wildcherrys\Contacts
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\Templates
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\Start Menu
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\SendTo
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\Recent
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\PrintHood
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\NetHood
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\My Documents
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\Local Settings
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\Cookies
2007-11-25 23:12:08 0 d--hs---- C:\Users\wildcherrys\Application Data
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Videos
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Saved Games
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Pictures
2007-11-25 23:12:06 786432 --ahs---- C:\Users\wildcherrys\NTUSER.DAT
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Music
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Links
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Favorites
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Downloads
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Documents
2007-11-25 23:12:06 0 dr------- C:\Users\wildcherrys\Desktop
2007-11-25 23:12:06 0 d--h----- C:\Users\wildcherrys\AppData
2007-11-13 17:37:57 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-12 22:52:55 0 d-------- C:\Program Files\Thegrideon Software
2007-11-12 20:27:19 0 dr------- C:\Users\kryste\Searches
2007-11-12 20:27:02 0 dr------- C:\Users\kryste\Contacts
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\Templates
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\Start Menu
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\SendTo
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\Recent
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\PrintHood
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\NetHood
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\Local Settings
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\Cookies
2007-11-12 20:26:39 0 d--hs---- C:\Users\kryste\Application Data
2007-11-12 20:26:38 0 d--hs---- C:\Users\kryste\My Documents
2007-11-12 20:26:37 0 dr------- C:\Users\kryste\Favorites
2007-11-12 20:26:37 0 dr------- C:\Users\kryste\Downloads
2007-11-12 20:26:37 0 dr------- C:\Users\kryste\Documents
2007-11-12 20:26:37 0 dr------- C:\Users\kryste\Desktop
2007-11-12 20:26:37 0 d--h----- C:\Users\kryste\AppData
2007-11-12 20:26:36 0 dr------- C:\Users\kryste\Videos
2007-11-12 20:26:36 0 dr------- C:\Users\kryste\Saved Games
2007-11-12 20:26:36 0 dr------- C:\Users\kryste\Pictures
2007-11-12 20:26:36 524288 --ahs---- C:\Users\kryste\NTUSER.DAT
2007-11-12 20:26:36 0 dr------- C:\Users\kryste\Music
2007-11-12 20:26:36 0 dr------- C:\Users\kryste\Links
2007-11-07 12:26:27 0 d-------- C:\Windows\pss
2007-11-07 11:45:10 0 d-------- C:\Program Files\SupportSpace
2007-11-07 10:35:54 0 dr-h----- C:\$VAULT$.AVG
2007-11-07 09:24:20 47104 --a------ C:\Windows\system32\drivers\avgwfp.sys
2007-11-07 09:23:31 0 d-------- C:\Users\All Users\Grisoft
2007-11-07 09:23:31 0 d-------- C:\Users\All Users\avg7
2007-11-07 09:00:00 0 d-------- C:\inetpub
2007-11-05 18:45:15 561152 --ahs---- C:\Windows\sysconf.exe
2007-11-05 18:45:15 53248 --ahs---- C:\Windows\sysconf.dll
2007-10-31 02:42:28 0 d-------- C:\Program Files\Bergman
-- Find3M Report ---------------------------------------------------------------
2007-11-27 10:04:37 0 d-------- C:\Users\susyq\AppData\Roaming\AVG7
2007-11-26 21:12:46 1024 --a------ C:\test.bin
2007-11-26 19:03:24 0 d-------- C:\Program Files\POKER4EVER
2007-11-16 14:10:37 0 d-------- C:\Users\susyq\AppData\Roaming\MP3Rocket
2007-11-16 13:23:48 0 d-------- C:\Program Files\Windows Mail
2007-11-13 17:37:57 0 d-------- C:\Program Files\Common Files
2007-11-07 10:35:54 0 d-------- C:\Program Files\Atlantic Lounge
2007-10-25 15:35:55 278528 --a------ C:\Windows\system32\livesnth.dll <Not Verified; LiveUpdate; LiveSynth>
2007-10-22 17:35:10 0 d-------- C:\Users\susyq\AppData\Roaming\Microgaming
2007-10-22 17:35:07 0 d-------- C:\Program Files\PokerTimeMPP
2007-10-15 11:12:37 0 d-------- C:\Users\susyq\AppData\Roaming\Bot Productions
2007-10-15 11:12:25 0 d-------- C:\Program Files\Custom Concentration
2007-10-15 10:44:07 0 d-------- C:\Program Files\LineIt
2007-10-15 09:32:43 0 d-------- C:\Program Files\MP3 Rocket
2007-10-14 10:25:07 0 d-------- C:\Program Files\Google
2007-10-09 22:19:03 0 d-------- C:\Users\susyq\AppData\Roaming\123 Free Solitaire
2007-10-09 22:15:40 0 d-------- C:\Program Files\123 Free Solitaire
2007-10-09 22:10:17 0 d-------- C:\Users\susyq\AppData\Roaming\Google
2007-10-08 09:27:12 0 d-------- C:\Program Files\Java
2007-10-06 04:37:34 0 d-------- C:\Program Files\Tournament Indicator
2007-09-02 12:33:51 31 --ah----- C:\Windows\uccspecc.sys
2007-08-30 02:12:31 174 --ahs---- C:\Program Files\desktop.ini
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [05/10/2007 11:59 AM]
"RtHDVCpl"="RtHDVCpl.exe" [01/17/2007 10:46 PM C:\Windows\RtHDVCpl.exe]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [04/27/2007 10:25 AM]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [11/02/2006 04:34 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 12:11 AM]
"GenSrv"="C:\Windows\sysconf.exe" [02/28/2006 12:54 AM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [11/07/2007 09:24 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/12/2007 05:40 PM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system]
"LogonHoursAction"=2 (0x2)
"DontDisplayLogonHoursWarnings"=1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 11/07/2007 09:24 AM 9216 C:\Windows\System32\avgwlntf.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\AppInfo]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\KeyIso]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\NTDS]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\ProfSvc]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sacsvr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\SWPRV]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TabletInputService]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TBS]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TrustedInstaller]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\VDS]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\volmgr.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\volmgrx.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Micros oft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Micros oft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HomeKeyLogger]
C:\Program Files\HomeKeyLogger\KeyLogger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxczbmgr.exe]
"C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc wlansvc EMDMgmt TabletInputService WPDBusEnum
LocalServiceNoNetwork PLA DPS BFE mpssvc
iissvcs w3svc was
rsmsvcs ntmssvc
ipripsvc iprip
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
-- Hosts -----------------------------------------------------------------------
200.124.131.116 casinocontroller.com
-- End of Deckard's System Scanner: finished at 2007-11-27 16:27:33 ------------
and the extra text says:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft® Windows Vista™ Home Basic (build 6000)
Architecture: X86; Language: English
CPU 0: AMD Sempron(tm) Processor 3200+
Percentage of Memory in Use: 75%
Physical Memory (total/avail): 445.88 MiB / 108.29 MiB
Pagefile Memory (total/avail): 1437.76 MiB / 803.62 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1930.7 MiB
C: is Fixed (NTFS) - 111.79 GiB total, 85.21 GiB free.
D: is CDROM (No Media)
E: is Removable (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
\\.\PHYSICALDRIVE0 - WDC WD12 00JS-00NCB1 SCSI Disk Device - 111.79 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 111.79 GiB - C:
\\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device
\\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device
\\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device
\\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device
-- Security Center -------------------------------------------------------------
AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.
AV: AVG 7.5.503 v7.5.503 (Grisoft)
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation)
[HKLM\System\CurrentControlSet\Services\SharedAcces s\Parameters\FirewallPolicy\DomainProfile\Authoriz edApplications\List]
"C:\\Windows\\system32\\DllHost.exe"="C:\\Windows\ \system32\\DllHost.exe:*:Enabled
llHost"
[HKLM\System\CurrentControlSet\Services\SharedAcces s\Parameters\FirewallPolicy\StandardProfile\Author izedApplications\List]
"C:\\Windows\\system32\\DllHost.exe"="C:\\Windows\ \system32\\DllHost.exe:*:Enabled
llHost"
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\susyq\AppData\Roaming
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=POKER-FREAK
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\susyq
LOCALAPPDATA=C:\Users\susyq\AppData\Local
LOGONSERVER=\\POKER-FREAK
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\Sys tem32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\Ulead Systems\MPEG
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WS F;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 95 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=5f02
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0_01\lib\ext\QTJava.zip
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\susyq\AppData\Local\Temp
TMP=C:\Users\susyq\AppData\Local\Temp
USERDOMAIN=poker-freak
USERNAME=susyq
USERPROFILE=C:\Users\susyq
windir=C:\Windows
-- User Profiles ---------------------------------------------------------------
susyq
kryste
(new local, net ready)
wildcherrys
-- Add/Remove Programs ---------------------------------------------------------
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
123 Free Solitaire --> C:\PROGRA~1\123FRE~1\UNWISE.EXE C:\PROGRA~1\123FRE~1\INSTALL.LOG
3Dice Casino --> C:\Users\susyq\AppData\Local\3Dice Casino\Uninstall.exe
ABBYY FineReader 6.0 Sprint --> MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
AcroChallenge 2.86 --> MsiExec.exe /X{FA3D29BC-9440-4CB4-993D-189543036C1E}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activ eX.exe
Adobe Reader 8 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A80000000002}
Adobe Shockwave Player --> C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
AGEIA PhysX v2.4.4 --> "C:\Program Files\AGEIA Technologies\uninstall.exe"
Apple Mobile Device Support --> MsiExec.exe /I{8FC46258-0843-4D79-B7F0-F2B82FE6173B}
Apple Software Update --> MsiExec.exe /I{A260B422-70E1-41E2-957D-F76FA21266D5}
Atlantic Lounge --> "C:\Program Files\Atlantic Lounge\Install.exe" -u
AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL
Bejeweled Deluxe 1.87 --> C:\Program Files\PopCap Games\Bejeweled Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Bejeweled Deluxe\Install.log"
Bergman --> C:\Program Files\Bergman\Uninstall.exe
BigJuicyOdds 2.1.0 --> "C:\Program Files\Dynamic Gaming Systems\BigJuicyOdds.com\unins000.exe"
BubbasPoker 2.1.0 --> "C:\Program Files\Dynamic Gaming Systems\BubbasPoker.com\unins000.exe"
Custom Concentration --> C:\Program Files\Custom Concentration\Setup.exe /uninstall
Dynomite Deluxe 2.71 --> C:\Program Files\PopCap Games\Dynomite Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Dynomite Deluxe\Install.log"
eePyramid --> "C:\Program Files\nr4\unins000.exe"
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
iNetBet Casino --> "C:\Program Files\iNetBet Casino\Install.exe" -u
iTunes --> MsiExec.exe /I{3592F5CB-B524-43AA-92F2-2377268199CC}
Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Lexmark 1200 Series --> C:\Program Files\Lexmark 1200 Series\Install\x86\Uninst.exe
LineIt --> C:\Program Files\LineIt\uninstall.exe
MP3 Rocket --> C:\Program Files\MP3 Rocket\Uninstall.exe
Photo Explosion Special Edition --> MsiExec.exe /X{DD040AAA-F295-492B-AD91-C8DC24488273}
PhotoFiltre --> "C:\Program Files\PhotoFiltre\Uninst.exe"
Poker4ever --> C:\Program Files\Poker4ever\uninst.exe
PokerTime Poker --> C:\PROGRA~1\POKERT~1\POKERT~1\UNWISE.EXE C:\PROGRA~1\POKERT~1\POKERT~1\INSTALL.LOG
Powerbet --> "C:\Program Files\Powerbet\Install.exe" -u
QBeez(TM) 2 --> C:\PROGRA~1\SHOCKW~1.COM\QBEEZ2~1\UNWISE.EXE C:\PROGRA~1\SHOCKW~1.COM\QBEEZ2~1\INSTALL.LOG
QuickTime --> MsiExec.exe /I{08094E03-AFE4-4853-9D31-6D0743DF5328}
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver --> RtlUpd.exe -r -m
SlotoCash --> C:\Program Files\SlotoCash\uninst.exe
SpiteNET: Spite and Malice v.9.5 --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\SpiteNET9\ST6UNST.LOG"
Super TextTwist --> C:\PROGRA~1\GAMEHO~1\TEXTTW~1\UNWISE.EXE /U C:\PROGRA~1\GAMEHO~1\TEXTTW~1\INSTALL.LOG
Superior Poker --> C:\Program Files\Superior Poker\uninst.exe
SupportSpace Support Tools --> MsiExec.exe /I{D8B374AE-9420-4AFD-8DFC-FF7759429899}
Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Word Mojo Gold --> C:\PROGRA~1\FRESHG~1\WORDMO~1\UNWISE.EXE C:\PROGRA~1\FRESHG~1\WORDMO~1\INSTALL.LOG
-- Application Event Log -------------------------------------------------------
Event Record #/Type18851 / Error
Event Submitted/Written: 11/27/2007 04:20:04 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application IEUser.exe, version 6.0.6000.16546, time stamp 0x46c64caa, faulting module CRYPT32.dll, version 6.0.6000.16425, time stamp 0x45b96fde, exception code 0xc0000005, fault offset 0x000016a1,
process id 0xebc, application start time 0xIEUser.exe0.
Event Record #/Type18850 / Error
Event Submitted/Written: 11/27/2007 04:19:36 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application DllHost.exe, version 6.0.6000.16386, time stamp 0x4549b14e, faulting module uxtheme.dll, version 6.0.6000.16386, time stamp 0x4549bde7, exception code 0xc0000005, fault offset 0x00001f49,
process id 0xcdc, application start time 0xDllHost.exe0.
Event Record #/Type18849 / Error
Event Submitted/Written: 11/27/2007 04:18:18 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application IEUser.exe, version 6.0.6000.16546, time stamp 0x46c64caa, faulting module CRYPT32.dll, version 6.0.6000.16425, time stamp 0x45b96fde, exception code 0xc0000005, fault offset 0x000016a1,
process id 0x43c, application start time 0xIEUser.exe0.
Event Record #/Type18848 / Error
Event Submitted/Written: 11/27/2007 04:18:18 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application IEUser.exe, version 6.0.6000.16546, time stamp 0x46c64caa, faulting module CRYPT32.dll, version 6.0.6000.16425, time stamp 0x45b96fde, exception code 0xc0000005, fault offset 0x000016a1,
process id 0x8e4, application start time 0xIEUser.exe0.
Event Record #/Type18847 / Error
Event Submitted/Written: 11/27/2007 04:18:17 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application IEUser.exe, version 6.0.6000.16546, time stamp 0x46c64caa, faulting module CRYPT32.dll, version 6.0.6000.16425, time stamp 0x45b96fde, exception code 0xc0000005, fault offset 0x000016a1,
process id 0x674, application start time 0xIEUser.exe0.
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type37852 / Error
Event Submitted/Written: 11/27/2007 10:02:49 AM
Event ID/Source: 10010 / DCOM
Event Description:
{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}
Event Record #/Type37851 / Error
Event Submitted/Written: 11/27/2007 10:02:08 AM
Event ID/Source: 10010 / DCOM
Event Description:
{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Event Record #/Type37849 / Error
Event Submitted/Written: 11/27/2007 09:59:04 AM
Event ID/Source: 10010 / DCOM
Event Description:
{F81CD990-910B-4BBF-9CB3-6A77F3D697B3}
Event Record #/Type37764 / Error
Event Submitted/Written: 11/27/2007 09:53:49 AM
Event ID/Source: 19 / Print
Event Description:
The print spooler failed to share printer Lexmark 1200 Series with shared resource name Lexmark 1200 Series. Error 2114. The printer cannot be used by others on the network.
Event Record #/Type37763 / Error
Event Submitted/Written: 11/27/2007 09:53:49 AM
Event ID/Source: 19 / Print
Event Description:
The print spooler failed to share printer Lexmark 1200 Series (Copy 1) with shared resource name Lexmark 1200 Series (Copy 1). Error 2114. The printer cannot be used by others on the network.
-- End of Deckard's System Scanner: finished at 2007-11-27 16:27:33 ------------
PC Help Forum
» Security & Safety
» [Fixed] Hijackthis! Logs
»
HELP nothing works
HELP nothing works
