************************************************************************************ ISeeYouXP v2.0 Beta 14 ISeeYouXP v1.3.0-v2.0 Beta 14 Copyright - ShadowPuterDude ISeeYouXP v1.2.9 and earlier Copyright - PhilliePhan ------------------------------------------------------------------------------------ **** PLEASE NOTE THAT MOST (if not ALL) OF THE ITEMS BELOW ARE NOT BADDIES! **** **** PLEASE CONSULT A KNOWLEDGEABLE PERSON BEFORE TAKING ANY ACTION. **** ************************************************************************************ Windows/Browser/Java Versions: Microsoft (R) Windows Script Host Verso 5.6 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Microsoft (R) Windows Script Host Verso 5.6 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Microsoft (R) Windows Script Host Verso 5.6 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Scan done at 16:50:12,23, dom 16/11/2008 ------------------------------------------------------------------------------------ ISeeYouXP installation folder and files No foi possvel executar C:\ISEEYOUXP\LOCATE.COM ------------------------------------------------------------------------------------ System Environment Variables ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Admin\Dados de aplicativos CLIENTNAME=Console CommonProgramFiles=C:\Arquivos de programas\Arquivos comuns COMPUTERNAME=ADMINISTRADOR ComSpec=C:\WINDOWS\system32\cmd.exe errcode=0 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Admin LOGONSERVER=\\ADMINISTRADOR NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0409 ProgramFiles=C:\Arquivos de programas PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Admin\CONFIG~1\Temp TMP=C:\DOCUME~1\Admin\CONFIG~1\Temp USERDOMAIN=ADMINISTRADOR USERNAME=Admin USERPROFILE=C:\Documents and Settings\Admin windir=C:\WINDOWS ------------------------------------------------------------------------------------ Showing any Pocket Killbox backup files No foi possvel executar C:\ISEEYOUXP\LOCATE.COM ------------------------------------------------------------------------------------ Displaying BOOT.INI: [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect ------------------------------------------------------------------------------------ Displaying SYSTEM.INI: ; for 16-bit app support [drivers] wave=mmdrv.dll timer=timer.drv [mci] [mcidrv32] VideoVer=425734 hr=11 dr=24 [driver32] [386enh] woafont=app850.FON EGA80WOA.FON=EGA80850.FON EGA40WOA.FON=EGA40850.FON CGA80WOA.FON=CGA80850.FON CGA40WOA.FON=CGA40850.FON FileSysChange=off ------------------------------------------------------------------------------------ Displaying WIN.INI: ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 [MCI Extensions.BAK] aif=MPEGVideo aifc=MPEGVideo aiff=MPEGVideo asf=MPEGVideo asx=MPEGVideo au=MPEGVideo m1v=MPEGVideo m3u=MPEGVideo mp2=MPEGVideo mp2v=MPEGVideo mp3=MPEGVideo mpa=MPEGVideo mpe=MPEGVideo mpeg=MPEGVideo mpg=MPEGVideo mpv2=MPEGVideo snd=MPEGVideo wax=MPEGVideo wm=MPEGVideo wma=MPEGVideo wmv=MPEGVideo wmx=MPEGVideo wpl=MPEGVideo wvx=MPEGVideo [annie] CaptureFile=D:\Documents and Settings\Raul soares\Meus documentos\Meus Videos\-pica pau - pica pau einsten-.avi VideoDevice2=@device:pnp:\\?\usb#vid_0c45&pid_608f&mi_00#6&355dea8&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\global AudioDevice2= FrameRate=667111 UseFrameRate=1 CaptureAudio=0 CaptureCC=0 WantPreview=1 MasterStream=1 UseTimeLimit=0 TimeLimit=0 [MSUCE] Advanced=1 CodePage=Unicode Font=Arial ------------------------------------------------------------------------------------ Displaying AUTOEXEC.BAT: ------------------------------------------------------------------------------------ Displaying CONFIG.SYS: ------------------------------------------------------------------------------------ Displaying Running Processes: PROCESS PID PRIO PATH smss.exe 576 Normal C:\WINDOWS\System32\smss.exe csrss.exe 652 Normal C:\WINDOWS\system32\csrss.exe winlogon.exe 676 High C:\WINDOWS\system32\winlogon.exe services.exe 720 Normal C:\WINDOWS\system32\services.exe lsass.exe 732 Normal C:\WINDOWS\system32\lsass.exe svchost.exe 880 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 944 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 980 Normal C:\WINDOWS\System32\svchost.exe svchost.exe 1028 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 1144 Normal C:\WINDOWS\system32\svchost.exe aston.exe 1460 Normal D:\ARQUIV~1\Aston\aston.exe spoolsv.exe 1496 Normal C:\WINDOWS\system32\spoolsv.exe svchost.exe 1732 Normal C:\WINDOWS\system32\svchost.exe wdfmgr.exe 1772 Normal C:\WINDOWS\system32\wdfmgr.exe ctfmon.exe 772 Normal C:\WINDOWS\system32\ctfmon.exe firefox.exe 856 Normal C:\Arquivos de programas\Mozilla Firefox\firefox.exe stinger.exe 1056 Normal C:\Documents and Settings\Admin\Desktop\stinger.exe cmd.exe 3544 Normal C:\WINDOWS\system32\cmd.exe ntvdm.exe 4020 Normal C:\WINDOWS\system32\ntvdm.exe pv.exe 3776 Normal C:\ISeeYouXP\pv.exe ------------------------------------------------------------------------------------ Displaying Windows Services: Microsoft (R) Windows Script Host Verso 5.6 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. ------------------------------------------------------------------------------------ Displaying LOG for Microsoft Windows Malicious Software Removal Tool: *** Microsoft Windows MRT Log NOT Found! **** ---------------------------------------------------------------------------- Listing HKCU Explorer\Advanced//Hidden and SuperHidden Registry Keys if Hidden = 0 then Hidden Files and Folders are not shown if SuperHidden = 1 is the desired default value. if ShowSuperHidden = 0 then System Files are not shown if HideFileExt = 1 then File Extension are not shown We want their values to be (from top to bottom) 1,1,1,0 ---------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced Hidden REG_DWORD 1 (0x1) SuperHidden REG_DWORD 1 (0x1) HideFileExt REG_DWORD 0 (0x0) ************************************************************************************ Examining Select Windows Registry Keys ------------------------------------------------------------------------------------ -------------------------------------------------------------------------- Items Found in ZoneMap\Domains: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains\msn.com ---------------------------------------------------------------------------- Current User ZoneMap ProtocolDefaults ---------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\protocoldefaults REG_SZ http REG_DWORD 3 (0x3) https REG_DWORD 3 (0x3) ftp REG_DWORD 3 (0x3) file REG_DWORD 3 (0x3) @ivt REG_DWORD 1 (0x1) shell REG_DWORD 0 (0x0) ---------------------------------------------------------------------------- Default URL Prefix Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\DefaultPrefix REG_SZ http:// HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\Prefixes ftp REG_SZ ftp:// gopher REG_SZ gopher:// home REG_SZ http:// mosaic REG_SZ http:// www REG_SZ http:// -------------------------------------------------------------------------- Startup Items Disabled via MSCONFIG: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk backup REG_SZ C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup location REG_SZ Common Startup item REG_SZ Adobe Reader Speed Launch HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Ralink Wireless Utility.lnk backup REG_SZ C:\WINDOWS\pss\Ralink Wireless Utility.lnkCommon Startup location REG_SZ Common Startup command REG_SZ C:\ARQUIV~1\RALINK\Common\RaUI.exe -s item REG_SZ Ralink Wireless Utility HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ msmsgs hkey REG_SZ HKCU command REG_SZ "C:\Arquivos de programas\Messenger\msmsgs.exe" /background inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ TeaTimer hkey REG_SZ HKCU inimapping REG_SZ 0 command REG_SZ C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\state system.ini REG_DWORD 0 (0x0) win.ini REG_DWORD 0 (0x0) bootini REG_DWORD 0 (0x0) services REG_DWORD 0 (0x0) startup REG_DWORD 2 (0x2) -------------------------------------------------------------------------- Select AutoRun Registry Keys: -------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonceex HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce HKEY_USERS\.default\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce HKEY_USERS\s-1-5-19\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\s-1-5-20\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE -------------------------------------------------------------------------- WinLogon Notify Registry Key: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ crypt32.dll Logoff REG_SZ ChainWlxLogoffEvent HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ cryptnet.dll Logoff REG_SZ CryptnetWlxLogoffEvent HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll DLLName REG_SZ cscdll.dll Logon REG_SZ WinlogonLogonEvent Logoff REG_SZ WinlogonLogoffEvent ScreenSaver REG_SZ WinlogonScreenSaverEvent Startup REG_SZ WinlogonStartupEvent Shutdown REG_SZ WinlogonShutdownEvent StartShell REG_SZ WinlogonStartShellEvent Impersonate REG_DWORD 0 (0x0) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy Asynchronous REG_DWORD 1 (0x1) DllName REG_EXPAND_SZ %SystemRoot%\System32\dimsntfy.dll Startup REG_SZ WlDimsStartup Shutdown REG_SZ WlDimsShutdown Logon REG_SZ WlDimsLogon Logoff REG_SZ WlDimsLogoff StartShell REG_SZ WlDimsStartShell Lock REG_SZ WlDimsLock Unlock REG_SZ WlDimsUnlock HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp DLLName REG_SZ wlnotify.dll Logon REG_SZ SCardStartCertProp Logoff REG_SZ SCardStopCertProp Lock REG_SZ SCardSuspendCertProp Unlock REG_SZ SCardResumeCertProp Enabled REG_DWORD 1 (0x1) Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ wlnotify.dll Impersonate REG_DWORD 0 (0x0) StartShell REG_SZ SchedStartShell Logoff REG_SZ SchedEventLogOff HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy Logoff REG_SZ WLEventLogoff Impersonate REG_DWORD 0 (0x0) Asynchronous REG_DWORD 1 (0x1) DllName REG_EXPAND_SZ sclgntfy.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn DLLName REG_SZ WlNotify.dll Lock REG_SZ SensLockEvent Logon REG_SZ SensLogonEvent Logoff REG_SZ SensLogoffEvent Safe REG_DWORD 1 (0x1) MaxWait REG_DWORD 600 (0x258) StartScreenSaver REG_SZ SensStartScreenSaverEvent StopScreenSaver REG_SZ SensStopScreenSaverEvent Startup REG_SZ SensStartupEvent Shutdown REG_SZ SensShutdownEvent StartShell REG_SZ SensStartShellEvent PostShell REG_SZ SensPostShellEvent Disconnect REG_SZ SensDisconnectEvent Reconnect REG_SZ SensReconnectEvent Unlock REG_SZ SensUnlockEvent Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ wlnotify.dll Impersonate REG_DWORD 0 (0x0) Logoff REG_SZ TSEventLogoff Logon REG_SZ TSEventLogon PostShell REG_SZ TSEventPostShell Shutdown REG_SZ TSEventShutdown StartShell REG_SZ TSEventStartShell Startup REG_SZ TSEventStartup MaxWait REG_DWORD 600 (0x258) Reconnect REG_SZ TSEventReconnect Disconnect REG_SZ TSEventDisconnect HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon Logon REG_SZ WLEventLogon Logoff REG_SZ WLEventLogoff Startup REG_SZ WLEventStartup Shutdown REG_SZ WLEventShutdown StartScreenSaver REG_SZ WLEventStartScreenSaver StopScreenSaver REG_SZ WLEventStopScreenSaver Lock REG_SZ WLEventLock Unlock REG_SZ WLEventUnlock StartShell REG_SZ WLEventStartShell PostShell REG_SZ WLEventPostShell Disconnect REG_SZ WLEventDisconnect Reconnect REG_SZ WLEventReconnect Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 0 (0x0) SafeMode REG_DWORD 1 (0x1) MaxWait REG_DWORD -1 (0xffffffff) DllName REG_EXPAND_SZ WgaLogon.dll Event REG_DWORD 0 (0x0) InstallEvent REG_SZ 1.8.0031.9 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings REG_SZ Data REG_BINARY 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000275a7110db94e5469b3ac456ac7d2ea304000000040000005300000003660000a800000010000000c036f01f361eb6df795bbd074e572d6f0000000004800000a000000010000000ea73b79450911b6ea5cd67bff9342b8e30020000c4bd4bf4771c2272b8e37989b46ba21e7267928fcf6765fda61e8564d375c41a89382faee84e9bb4571ef763ac1c3e4a405717ff90153481871f05b3e390c4d6a917649ebefcf34171b0729c8f8ca048ec282df5a6ce37a823f5534548a74c77f108bb1aa363c9523e5b3e30d0dfdd7e2ceb7cfe841a2b4dc02fdc654388d8f6de3ee6402534464b0bffc7722cd4323e08d4adccfd25013aa273c21845e7e5715af7fe3388a92b329983c32ce47414cdb027b534d280969f1b72a4d07448c1c2583e526558f662ee16387f837500ec639fbaed33d909303a6347ea9e7b71d2972db52b86b002a21f1dde4372bd2e82e4008d099b82265639aea6c1eed5d5877c62f27ee04a30bf20d427b59dd26c159df6f05dcf23f120283fc2e99a24645313040e084a5dd90098884094857759ee39480fd993ec55e73c7f696f35734f73a810cf46cf096221d81603665da08f4b198fe3208d8d3768d9591456527bc3bcf8abcf2c9be8b7ad5f2d11707b7ce9732c70f83d725dc6cf3f2c7118f59188bc4163bf85cf5f55e39f3311e242223a5807c91d78fa858753b3f3040cfcf7594ed7cd888b807056a5b060989a7e3fd02b6f026c67ab0cb6398178e6ba364e6b0dcc9abe39360e27bb3e1693f770f14eb873fdcffd0d81e11d26613a2b9e084c76dfd6ec4b540be0c7600942d67387cb6057ec4dc4adfe281ae063387d50cf67dde4bf9713875984a44b6a6bcdaca0d80d86a15a28347f7be5cb644393f4cbaaf97589c17e64f2381ceafe2e7a60362bf0ee14000000e12379eb0bd627f3ed3b3188882d2485c5edbf0f HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon DLLName REG_SZ wlnotify.dll Logon REG_SZ RegisterTicketExpiredNotificationEvent Logoff REG_SZ UnregisterTicketExpiredNotificationEvent Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) -------------------------------------------------------------------------- Shared Task Scheduler Registry Items: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler {438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Pr-carregador Browseui {8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Daemon de cache de categorias de componente -------------------------------------------------------------------------- Scheduled Tasks: -------------------------------------------------------------------------- O volume na unidade C no tem nome. O nmero de srie do volume 109F-D523 Pasta de C:\WINDOWS\tasks 15/11/2008 15:55 . 15/11/2008 15:55 .. 28/10/2001 10:07 65 desktop.ini 16/11/2008 13:44 328 GlaryInitialize.job 16/11/2008 13:44 6 SA.DAT 3 arquivo(s) 399 bytes Total de arquivos na lista: 3 arquivo(s) 399 bytes 2 pasta(s) 9.359.753.216 bytes disponveis HR C:\WINDOWS\tasks\desktop.ini A C:\WINDOWS\tasks\GlaryInitialize.job A H C:\WINDOWS\tasks\SA.DAT ---------------------------------------------------------------------------- ShellExecuteHooks Registry Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ ---------------------------------------------------------------------------- ShellServiceObjectDelayLoad Registry Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload PostBootReminder REG_SZ {7849596a-48ea-486e-8937-a2a3009f31a9} CDBurn REG_SZ {fbeb8a05-beee-4442-804e-409d6c4515e9} WebCheck REG_SZ {E6FB5E20-DE35-11CF-9C87-00AA005127ED} SysTray REG_SZ {35CEC8A3-2BE6-11D2-8773-92E220524153} ---------------------------------------------------------------------------- ModuleUsage Registry Keys: ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage ---------------------------------------------------------------------------- BHO Registry Keys: ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6} -------------------------------------------------------------------------- Select Policy Keys: -------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0) NoBandCustomize REG_DWORD 0 (0x0) NoMovingBands REG_DWORD 0 (0x0) NoCloseDragDropBands REG_DWORD 0 (0x0) NoSetTaskbar REG_DWORD 0 (0x0) NoToolbarsOnTaskbar REG_DWORD 0 (0x0) HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system HideLegacyLogonScripts REG_DWORD 0 (0x0) HideLogoffScripts REG_DWORD 0 (0x0) HideStartupScripts REG_DWORD 0 (0x0) RunLogonScriptSync REG_DWORD 1 (0x1) RunStartupScriptSync REG_DWORD 0 (0x0) HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\Shell HKEY_CURRENT_USER\software\policies\microsoft\internet explorer HKEY_CURRENT_USER\software\policies\microsoft\internet explorer\Control Panel HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0) NoResolveSearch REG_DWORD 1 (0x1) NoDriveTypeAutoRun REG_DWORD 227 (0xe3) NoDrives REG_DWORD 0 (0x0) NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1) DisableRegistryTools REG_DWORD 0 (0x0) HideLegacyLogonScripts REG_DWORD 0 (0x0) HideLogoffScripts REG_DWORD 0 (0x0) RunLogonScriptSync REG_DWORD 1 (0x1) RunStartupScriptSync REG_DWORD 0 (0x0) HideStartupScripts REG_DWORD 0 (0x0) HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\.default\software\microsoft\windows\currentversion\policies HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\Explorer HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system ************************************************************************************ Checking File System for suspicious Files -------------------------------------------------------------------------- Items in the Root Directory: -------------------------------------------------------------------------- Locating all files created in C:\ No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all Backup files on C: -------------------------------------------------------------------------- Locating all *.BAK* files No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of Internet Explorer on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of beep.sy_ on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of beep.sys on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of Windows Explorer on C: -------------------------------------------------------------------------- Locating all copies of Windows Explorer No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in Document and Settings: -------------------------------------------------------------------------- Listing contents of C:\Documents and Settings No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Desktop Items: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Admin\Desktop within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Desktop\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Start Menu Items: -------------------------------------------------------------------------- Locating all files created inC:\Documents and Settings\Admin\Start Menu within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\Admin\Start Menu\Programs\Startup within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Start Menu within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Application Data Items: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Admin\Application Data\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\Admin\Local Settings\Application Data\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Application Data\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\Documents and Settings\Admin\Local Settings\TEMP: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Admin\Local Settings\TEMP within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in Templates Folder: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Admin\Templates No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in Program Files: -------------------------------------------------------------------------- Locating all files created in C:\Arquivos de programas\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Arquivos de programas\Arquivos comuns\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in the Windows Directory: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\Downloaded Program Files: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\Downloaded Program Files\ within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\PCHealth\HelpCtr\Binaries: -------------------------------------------------------------------------- Locating all files in C:\WINDOWS\PCHealth\HelpCtr\Binaries No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32 within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\com: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\com within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\components: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\components within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\drivers: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\drivers within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\drivers\etc: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\drivers\etc within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\TEMP: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\TEMP within the last 90 days. No foi possvel executar C:\ISEEYOUXP\LOCATE.COM ************************************************************************************ Checking for .COM files to Delete. They will only print if deleted! Locating .COM files in the C:\WINDOWS\System32 folder No foi possvel executar C:\ISEEYOUXP\LOCATE.COM ************************************************************************************ Miscellaneous Malware Detections: ------------------------------------------------------------------------------------ **** Delfin Media {31EE3286-D785-4E3F-95FC-51D00FDABC01} NOT FOUND by this tool! **** **** SmitFraud {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! **** **** SpywareStrike {C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D} NOT FOUND by this tool! **** **** SpywareStrike {C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C} NOT FOUND by this tool! **** **** SpywareStrike {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} NOT FOUND by this tool! **** **** SpyAxe {A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! **** **** SpyFalcon {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! **** **** SpyFalcon {C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D} NOT FOUND by this tool! **** **** SpyFalcon {CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E} NOT FOUND by this tool! **** **** SpyFalcon {35a88e51-b53d-43e9-b8a7-75d4c31b4676} NOT FOUND by this tool! **** **** SpyFalcon {64ba30a2-811a-4597-b0af-d551128be340} NOT FOUND by this tool! **** **** SpyFalcon {89aef01d-d237-49c7-84dc-4e1904c1fd31} NOT FOUND by this tool! **** **** SpyFalcon {e04408db-4812-4478-8d4d-e46edcffd3b6} NOT FOUND by this tool! **** **** SpyFalcon {336ec37f-54bf-4f13-8237-03f64fa591e7} NOT FOUND by this tool! **** **** SpyFalcon {5bc82bdb-bc03-4671-9a78-3ef2b68449de} NOT FOUND by this tool! **** **** SpyFalcon {24c60b9b-26b5-4201-9f7a-fb9219356ae9} NOT FOUND by this tool! **** **** SpyFalcon {a0c51615-738a-4542-801a-5af61614e182} NOT FOUND by this tool! **** **** SpyFalcon {70fbd528-2d3c-4a00-9b8c-bbf441e534be} NOT FOUND by this tool! **** **** SpyFalcon {a566f298-05a6-4b3d-b672-da7c27316430} NOT FOUND by this tool! **** **** SpyFalcon {f5947202-e9cb-4a72-88e7-22f2cbd2b124} NOT FOUND by this tool! **** **** SpyFalcon {5aaf6542-f4ba-4df4-873d-4902ecbe794c} NOT FOUND by this tool! **** **** SpyFalcon {3e4155b8-5a4a-4e95-83b2-ab032da9acbc} NOT FOUND by this tool! **** **** SpyFalcon {9952355f-fefb-4764-bcd7-a993d03dd7e2} NOT FOUND by this tool! **** **** SpyFalcon {55059d4f-a1ac-4837-ae07-4859101f598d} NOT FOUND by this tool! **** **** SpyFalcon {c3786a8d-6426-4c29-a23f-f36e47b31e0c} NOT FOUND by this tool! **** **** SpyLocked {25b7d2fd-4f71-46d1-801a-7de323e4ec82} NOT FOUND by this tool! **** **** SpyLocked {4233AC08-A2C4-4742-A0B4-83719613D62C} NOT FOUND by this tool! **** **** SpyLocked {716002DB-288C-4BF0-80CD-A467E78D8B55} NOT FOUND by this tool! **** **** SpyLocked {735E980D-45D2-4777-AF82-9923D3C8D3AE} NOT FOUND by this tool! **** **** SpyLocked {B23DC537-3E13-44C7-BF67-D8405EB377F7} NOT FOUND by this tool! **** **** SpyLocked {B292EC9F-A074-4115-8342-1F459702D8D2} NOT FOUND by this tool! **** **** SpyLocked {CECA6F2B-247B-4ECE-9B7A-D0135C8036FC} NOT FOUND by this tool! **** **** SpyLocked {DA3B49F6-8C54-4429-A275-21A86DCCA413} NOT FOUND by this tool! **** **** SpyLocked {EDE8BED5-92CF-4482-8F51-A01CD9B3EA37} NOT FOUND by this tool! **** **** SpyLocked {FA4FBF53-C766-4622-8011-A87A805EEBF0} NOT FOUND by this tool! **** **** SpywareLocked {0E4E5110-A772-4C4A-A7DC-137FE10ABD6E} NOT FOUND by this tool! **** **** SpywareLocked {07A582E8-BAE3-457D-9D29-2048DE45A369} NOT FOUND by this tool! **** **** SpywareLocked {3BAA1AD8-EE49-4772-BF0B-F55083E0F7AA} NOT FOUND by this tool! **** **** SpywareLocked {9D6FAC42-A7BE-4702-87EF-75D8DC14249E} NOT FOUND by this tool! **** **** SpywareLocked {ABEF791F-947E-4CDF-83C3-E72A240AFB67} NOT FOUND by this tool! **** **** SpywareLocked {BD0FC212-0A36-4232-83CC-2063FB9282E0} NOT FOUND by this tool! **** **** SpywareLocked {B0DED443-5E68-4001-A81B-0A0001621AB8} NOT FOUND by this tool! **** **** SpywareLocked {F38B1B2B-4976-46DD-9FE5-60FDE72F0B4D} NOT FOUND by this tool! **** **** SpywareQuake {0c7416f0-dd23-420f-97f5-aae352ea2bf1} NOT FOUND by this tool! **** **** SpywareQuake {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} NOT FOUND by this tool! **** **** SpywareQuake {AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E} NOT FOUND by this tool! **** **** SpywareQuake {CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A} NOT FOUND by this tool! **** **** SpywareQuake {EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E} NOT FOUND by this tool! **** **** SpywareQuake {e5b1e382-817e-4b74-8a96-ec78751e6acf} NOT FOUND by this tool! **** **** SpywareQuake {a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb} NOT FOUND by this tool! **** **** SpywareQuake {cbb430e6-5b1b-474a-9d7e-160d4fe74bea} NOT FOUND by this tool! **** **** SpywareQuake {62eb0924-19d2-4226-b4b9-8ad1f70904c1} NOT FOUND by this tool! **** **** SpywareQuake {6c69e319-0d03-47da-997a-36586cbc53b3} NOT FOUND by this tool! **** **** SpywareQuake {aea3d2df-2b2c-4d7b-81a0-d975c6dc088e} NOT FOUND by this tool! **** **** SpywareSheriff {1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E} NOT FOUND by this tool! **** **** VirusBurster {9d635a36-6b3c-4146-8625-f3aaf507bbf8} NOT FOUND by this tool! **** **** TrustCleaner {24E27EA9-FCF3-444F-BD80-20543BA5D946} NOT FOUND by this tool! **** **** Troj/Small-ER {4F141CBA-1457-6CCA-03A7-7AA21B61EA0F} NOT FOUND by this tool! **** **** Troj/Spabot-E {429F4BB8-7BF7-4152-8011-3C6F9EB7E892} NOT FOUND by this tool! **** **** Troj/Dloader-OF {203B1C4D9-BC71-8916-38AD-9DEA5D213614} NOT FOUND by this tool! **** **** Troj/Crafted-A {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! **** **** Troj/Agent-FG {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} NOT FOUND by this tool! **** **** TX 4 BrowserAd adware {8e99f990-b75a-4568-b3c8-24cbc8cbbfc1} NOT FOUND by this tool! **** **** Trojan-Proxy.Win32.Small {87A3E824-A726-4CF4-8A66-6314B11BDA0C} NOT FOUND by this tool! **** **** Trojan-Downloader.Win32.Delf.ks {786C369D-409A-456f-A13C-971EADA850C6} NOT FOUND by this tool! **** **** W32/Almanahe.a Worm NOT FOUND by this tool! **** **** msctl32.dll SpamBot NOT FOUND by this tool! **** **** KeyLogger NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR BOT-TYPE WORMS: -------------------------------------------------------------------------- **** W32/Sdbot Worm NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR KNOWN ROOTKIT STEALTHING AGENTS: -------------------------------------------------------------------------- **** i386p.* Stealthing Agent NOT FOUND by this tool! **** **** ErrorSafe erssdd.* Stealthing Agent NOT FOUND by this tool! **** **** VUNDO DP.* Stealthing Agent NOT FOUND by this tool! **** **** Troj/NTRootK-BP main.* Stealthing Agent NOT FOUND by this tool! **** **** W32/Almanahe.sys RioDrvrs.* Stealthing Agent NOT FOUND by this tool! **** **** W32/Almanahe.sys DKIS6.* Stealthing Agent NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR VISIBLE ROOTKIT-TYPE REGISTRY KEYS: -------------------------------------------------------------------------- **** Rustock.B trojan, PE386 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, huy32 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, lzx32 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, msguard rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, xpdt.sy_ rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, xpdt.sys rootkit NOT FOUND by this tool! **** **** CmdService adware NOT FOUND by this tool! **** **** Network_Monitor adware NOT FOUND by this tool! **** **** Trojan.Peacomm NOT FOUND by this tool! **** **** Trojan.Peacomm windev NOT FOUND by this tool! **** **** AVPE Haxdoor NOT FOUND by this tool! **** **** MEMLOW Haxdoor NOT FOUND by this tool! **** **** VDMT Haxdoor NOT FOUND by this tool! **** **** YCSVGA Haxdoor NOT FOUND by this tool! **** **** PPTP Haxdoor FOUND by this tool! **** CAREFULL HERE THIS WILL ALSO FIND WinLanMiniport DisplayName REG_SZ Miniporta de rede remota (PPTP) Description REG_SZ Miniporta de rede remota (PPTP) DisplayName REG_SZ Miniporta de rede remota (PPTP) Description REG_SZ Miniporta de rede remota (PPTP) DisplayName REG_SZ Miniporta de rede remota (PPTP) Description REG_SZ Miniporta de rede remota (PPTP) **** DVB Haxdoor NOT FOUND by this tool! **** **** YVBB Haxdoor NOT FOUND by this tool! **** **** YVPP Haxdoor NOT FOUND by this tool! **** **** NKGFS Haxdoor NOT FOUND by this tool! **** **** XMSK Haxdoor NOT FOUND by this tool! **** **** AVPX Haxdoor NOT FOUND by this tool! **** **** MMXF Haxdoor NOT FOUND by this tool! **** **** DP1112 Vundo Rootkit NOT FOUND by this tool! **** **** SYSBUS32 Rootkit Driver NOT FOUND by this tool! **** **** I386P Rootkit Driver NOT FOUND by this tool! **** **** ERSSDD Rootkit NOT FOUND by this tool! **** **** GencTurK RootKit NOT FOUND by this tool! **** **** Troj/NTRootK-BP RootKit NOT FOUND by this tool! **** **** W32/Almanahe.sys NOT FOUND by this tool! **** ************************************************************************************ Dumping HKLM Uninstall Programs list DisplayName REG_SZ Adobe Flash Player ActiveX DisplayName REG_SZ Adobe Flash Player Plugin DisplayName REG_SZ Arquivo do WinRAR DisplayName REG_SZ Assistente de Conexo do Windows Live DisplayName REG_SZ Aston.1.9.2 DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB923789) DisplayName REG_SZ Canon iP1200 DisplayName REG_SZ CCleaner (remove only) DisplayName REG_SZ Choice Guard DisplayName REG_SZ Clean Virus MSN DisplayName REG_SZ D'Accord Afinador 3.0 DisplayName REG_SZ D'Accord Dicionrio DisplayName REG_SZ D'Accord Violo Player 2.0 DisplayName REG_SZ Eusing Free Registry Cleaner DisplayName REG_SZ Glary Utilities 2.5.1 DisplayName REG_SZ K-Lite Mega Codec Pack 3.9.5 DisplayName REG_SZ Malwarebytes' Anti-Malware DisplayName REG_SZ Messenger Plus! Live DisplayName REG_SZ Microsoft .NET Framework 2.0 DisplayName REG_SZ Microsoft .NET Framework 2.0 DisplayName REG_SZ Microsoft Application Error Reporting DisplayName REG_SZ Microsoft Office Professional Edio 2003 DisplayName REG_SZ Mozilla Firefox (2.0.0.18) DisplayName REG_SZ MSXML 4.0 SP2 (KB936181) DisplayName REG_SZ MSXML 4.0 SP2 (KB954430) DisplayName REG_SZ Nero 7 Micro 7.9.6.0 DisplayName REG_SZ neroxml DisplayName REG_SZ Platform DisplayName REG_SZ Ralink Wireless LAN DisplayName REG_SZ Realtek AC'97 Audio DisplayName REG_SZ Security Update para o produto Microsoft .NET Framework 2.0 (KB928365) DisplayName REG_SZ Spybot - Search & Destroy DisplayName REG_SZ USB PC Camera (SN9C103) DisplayName REG_SZ VCRedistSetup DisplayName REG_SZ VIA Gerenciador de dispositivo de plataforma DisplayName REG_SZ WebFldrs XP DisplayName REG_SZ Windows Genuine Advantage Notifications (KB905474) DisplayName REG_SZ Windows Live installer DisplayName REG_SZ Windows Live Messenger DisplayName REG_SZ Windows Media Format Runtime DisplayName REG_SZ Windows Media Player 10 ParentDisplayName REG_SZ Microsoft .NET Framework 2.0 ParentDisplayName REG_SZ Windows Updates ParentDisplayName REG_SZ Windows Updates ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Software Updates ##################################################################################################### -- All DONE! :) ~ ShadowPuterDude ~