************************************************************************************ ISeeYouXP v2.0 Beta 14 ISeeYouXP v1.3.0-v2.0 Beta 14 Copyright - ShadowPuterDude ISeeYouXP v1.2.9 and earlier Copyright - PhilliePhan ------------------------------------------------------------------------------------ **** PLEASE NOTE THAT MOST (if not ALL) OF THE ITEMS BELOW ARE NOT BADDIES! **** **** PLEASE CONSULT A KNOWLEDGEABLE PERSON BEFORE TAKING ANY ACTION. **** ************************************************************************************ Windows/Browser/Java Versions: Microsoft Windows XP Professional Version: 5.1.2600 Service Pack: 3.0 Windows Directory: C:\WINDOWS Internet Explorer Version: 7.0.5730.11 Build: 75730 Language: English (United States) Path: C:\Program Files\Internet Explorer Sun Microsystems Java Runtime Version: 1.6.0_10 Boot State: Fail-safe boot Scan done at 21:48:20,81, qui 01/01/2009 ------------------------------------------------------------------------------------ ISeeYouXP installation folder and files Cannot execute C:\ISEEYOUXP\LOCATE.COM 3 Dir(s) 10.078.683.136 bytes free ------------------------------------------------------------------------------------ System Environment Variables ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Owner\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=ELIANE ComSpec=C:\WINDOWS\system32\cmd.exe errcode=0 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Owner LOGONSERVER=\\ELIANE NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Smart Projects\IsoBuster PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 44 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=2c02 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip SAFEBOOT_OPTION=MINIMAL SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Owner\LOCALS~1\Temp TMP=C:\DOCUME~1\Owner\LOCALS~1\Temp USERDOMAIN=ELIANE USERNAME=Owner USERPROFILE=C:\Documents and Settings\Owner windir=C:\WINDOWS ------------------------------------------------------------------------------------ Showing any Pocket Killbox backup files Cannot execute C:\ISEEYOUXP\LOCATE.COM ------------------------------------------------------------------------------------ Displaying BOOT.INI: [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect ------------------------------------------------------------------------------------ Displaying SYSTEM.INI: ; for 16-bit app support [drivers] wave=mmdrv.dll timer=timer.drv [mci] [driver32] [386enh] woafont=dosapp.FON EGA80WOA.FON=EGA80WOA.FON EGA40WOA.FON=EGA40WOA.FON CGA80WOA.FON=CGA80WOA.FON CGA40WOA.FON=CGA40WOA.FON ------------------------------------------------------------------------------------ Displaying WIN.INI: ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 CMCDLLNAME32=mapi32.dll CMCDLLNAME=mapi.dll CMC=1 MAPIX=1 MAPIXVER=1.0.0.1 OLEMessaging=1 [MCI Extensions.BAK] aif=MPEGVideo aifc=MPEGVideo aiff=MPEGVideo asf=MPEGVideo asx=MPEGVideo au=MPEGVideo m1v=MPEGVideo m3u=MPEGVideo mp2=MPEGVideo mp2v=MPEGVideo mp3=MPEGVideo mpa=MPEGVideo mpe=MPEGVideo mpeg=MPEGVideo mpg=MPEGVideo mpv2=MPEGVideo snd=MPEGVideo wax=MPEGVideo wm=MPEGVideo wma=MPEGVideo wmx=MPEGVideo wpl=MPEGVideo wvx=MPEGVideo m2v=MPEGVideo mod=MPEGVideo wmv=MPEGVideo [Status] State=Running ------------------------------------------------------------------------------------ Displaying CONFIG.SYS: ------------------------------------------------------------------------------------ Displaying Running Processes: PROCESS PID PRIO PATH smss.exe 164 Normal C:\WINDOWS\System32\smss.exe csrss.exe 228 Normal C:\WINDOWS\system32\csrss.exe winlogon.exe 252 High C:\WINDOWS\system32\winlogon.exe services.exe 296 Normal C:\WINDOWS\system32\services.exe lsass.exe 308 Normal C:\WINDOWS\system32\lsass.exe svchost.exe 468 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 576 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 624 Normal C:\WINDOWS\system32\svchost.exe userinit.exe 864 Normal C:\WINDOWS\system32\userinit.exe Explorer.EXE 896 Normal C:\WINDOWS\Explorer.EXE cmd.exe 1004 Normal C:\WINDOWS\system32\cmd.exe ntvdm.exe 1260 Normal C:\WINDOWS\system32\ntvdm.exe wmiprvse.exe 1372 Normal C:\WINDOWS\system32\wbem\wmiprvse.exe pv.exe 1740 Normal C:\ISeeYouXP\pv.exe ------------------------------------------------------------------------------------ Displaying Windows Services: Name: Alerter Display Name: Alerter Description: Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: Apple Mobile Device Display Name: Apple Mobile Device Description: Fornece a interface para dispositivos mveis Apple. Path Name: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" Start Mode: Auto State: Stopped Name: AppMgmt Display Name: Application Management Description: Provides software installation services such as Assign, Publish, and Remove. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: AudioSrv Display Name: Windows Audio Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: BITS Display Name: Background Intelligent Transfer Service Description: Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: Browser Display Name: Computer Browser Description: Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: ClipSrv Display Name: ClipBook Description: Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\clipsrv.exe Start Mode: Disabled State: Stopped Name: clr_optimization_v2.0.50727_32 Display Name: .NET Runtime Optimization Service v2.0.50727_X86 Description: Microsoft .NET Framework NGEN Path Name: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe Start Mode: Manual State: Stopped Name: COMSysApp Display Name: COM+ System Application Description: Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} Start Mode: Manual State: Stopped Name: CryptSvc Display Name: Cryptographic Services Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: DcomLaunch Display Name: DCOM Server Process Launcher Description: Provides launch functionality for DCOM services. Path Name: C:\WINDOWS\system32\svchost -k DcomLaunch Start Mode: Auto State: Running Name: Dhcp Display Name: DHCP Client Description: Manages network configuration by registering and updating IP addresses and DNS names. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: dmadmin Display Name: Logical Disk Manager Administrative Service Description: Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. Path Name: C:\WINDOWS\System32\dmadmin.exe /com Start Mode: Manual State: Stopped Name: dmserver Display Name: Logical Disk Manager Description: Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: Dnscache Display Name: DNS Client Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k NetworkService Start Mode: Manual State: Stopped Name: Dot3svc Display Name: Wired AutoConfig Description: This service performs IEEE 802.1X authentication on Ethernet interfaces Path Name: C:\WINDOWS\System32\svchost.exe -k dot3svc Start Mode: Manual State: Stopped Name: EapHost Display Name: Extensible Authentication Protocol Service Description: Provides windows clients Extensible Authentication Protocol Service Path Name: C:\WINDOWS\System32\svchost.exe -k eapsvcs Start Mode: Manual State: Stopped Name: ehSched Display Name: Media Center Scheduler Service Description: Path Name: C:\WINDOWS\eHome\ehSched.exe Start Mode: Auto State: Stopped Name: ERSvc Display Name: Error Reporting Service Description: Allows error reporting for services and applictions running in non-standard environments. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: Eventlog Display Name: Event Log Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Path Name: C:\WINDOWS\system32\services.exe Start Mode: Auto State: Running Name: EventSystem Display Name: COM+ Event System Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: FastUserSwitchingCompatibility Display Name: Fast User Switching Compatibility Description: Provides management for applications that require assistance in a multiple user environment. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: GbpSv Display Name: GbpSv Description: Path Name: Start Mode: Unknown State: Unknown Name: gusvc Display Name: Google Updater Service Description: Path Name: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" Start Mode: Manual State: Stopped Name: helpsvc Display Name: Help and Support Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: HidServ Display Name: HID Input Service Description: Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: hkmsvc Display Name: Health Key and Certificate Management Service Description: Manages health certificates and keys (used by NAP) Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: HTTPFilter Display Name: HTTP SSL Description: This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k HTTPFilter Start Mode: Manual State: Stopped Name: JavaQuickStarterService Display Name: Java Quick Starter Description: Prefetches JRE files for faster startup of Java applets and applications Path Name: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" Start Mode: Auto State: Stopped Name: lanmanserver Display Name: Server Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: lanmanworkstation Display Name: Workstation Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: LmHosts Display Name: TCP/IP NetBIOS Helper Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Manual State: Stopped Name: McrdSvc Display Name: Media Center Extender Service Description: Path Name: C:\WINDOWS\ehome\mcrdsvc.exe Start Mode: Auto State: Stopped Name: Messenger Display Name: Messenger Description: Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: MHN Display Name: MHN Description: Multimedia Home Networking (MHN) is a networking platform for Audio Video (AV) streaming applications on IP home networks. MHN enhances AV streaming performance and reliability by ensuring network quality-of-service (QoS) for AV applications by providing mechanisms for admission control, run time monitoring and enforcement, application feedback, and traffic prioritization. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: MSIServer Display Name: Windows Installer Description: Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\msiexec.exe /V Start Mode: Manual State: Stopped Name: napagent Display Name: Network Access Protection Agent Description: Allows windows clients to participate in Network Access Protection Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: NetDDE Display Name: Network DDE Description: Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\netdde.exe Start Mode: Disabled State: Stopped Name: NetDDEdsdm Display Name: Network DDE DSDM Description: Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\netdde.exe Start Mode: Disabled State: Stopped Name: Netman Display Name: Network Connections Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: Nla Display Name: Network Location Awareness (NLA) Description: Collects and stores network configuration and location information, and notifies applications when this information changes. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: NtmsSvc Display Name: Removable Storage Description: Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: NwSapAgent Display Name: SAP Agent Description: Service Advertising Protocol Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: ose Display Name: Office Source Engine Description: Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports. Path Name: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" Start Mode: Manual State: Stopped Name: RasAuto Display Name: Remote Access Auto Connection Manager Description: Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: RasMan Display Name: Remote Access Connection Manager Description: Creates a network connection. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: RemoteAccess Display Name: Routing and Remote Access Description: Offers routing services to businesses in local area and wide area network environments. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: RemoteRegistry Display Name: Remote Registry Description: Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: RpcSs Display Name: Remote Procedure Call (RPC) Description: Provides the endpoint mapper and other miscellaneous RPC services. Path Name: C:\WINDOWS\system32\svchost -k rpcss Start Mode: Auto State: Running Name: RSVP Display Name: QoS RSVP Description: Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. Path Name: C:\WINDOWS\system32\rsvp.exe Start Mode: Manual State: Stopped Name: Schedule Display Name: Task Scheduler Description: Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: seclogon Display Name: Secondary Logon Description: Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: SENS Display Name: System Event Notification Description: Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: SharedAccess Display Name: Windows Firewall/Internet Connection Sharing (ICS) Description: Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: ShellHWDetection Display Name: Shell Hardware Detection Description: Provides notifications for AutoPlay hardware events. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: SNDSrvc Display Name: Symantec Network Drivers Service Description: Symantec Network Drivers Service Path Name: "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" Start Mode: Manual State: Stopped Name: srservice Display Name: System Restore Service Description: Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: SSDPSRV Display Name: SSDP Discovery Service Description: Enables discovery of UPnP devices on your home network. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Auto State: Stopped Name: stisvc Display Name: Windows Image Acquisition (WIA) Description: Provides image acquisition services for scanners and cameras. Path Name: C:\WINDOWS\system32\svchost.exe -k imgsvc Start Mode: Manual State: Stopped Name: SwPrv Display Name: MS Software Shadow Copy Provider Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\dllhost.exe /Processid:{3FF47403-8D58-44E8-ACA4-F0ED40B1E66E} Start Mode: Manual State: Stopped Name: TapiSrv Display Name: Telephony Description: Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: TeamViewer4 Display Name: TeamViewer 4 Description: TeamViewer Remote Software Path Name: "D:\TeamViewer\Version4\TeamViewer_Service.exe" -service Start Mode: Auto State: Stopped Name: TermService Display Name: Terminal Services Description: Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. Path Name: C:\WINDOWS\System32\svchost -k DComLaunch Start Mode: Manual State: Stopped Name: Themes Display Name: Themes Description: Provides user experience theme management. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: TlntSvr Display Name: Telnet Description: Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\tlntsvr.exe Start Mode: Disabled State: Stopped Name: TrkWks Display Name: Distributed Link Tracking Client Description: Maintains links between NTFS files within a computer or across computers in a network domain. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: upnphost Display Name: Universal Plug and Play Device Host Description: Provides support to host Universal Plug and Play devices. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: VSS Display Name: Volume Shadow Copy Description: Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\vssvc.exe Start Mode: Manual State: Stopped Name: W32Time Display Name: Windows Time Description: Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: WebClient Display Name: WebClient Description: Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Manual State: Stopped Name: winmgmt Display Name: Windows Management Instrumentation Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: WLSetupSvc Display Name: Windows Live Setup Service Description: Windows Live Setup Service Path Name: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe" Start Mode: Manual State: Stopped Name: WmdmPmSN Display Name: Portable Media Serial Number Service Description: Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: Wmi Display Name: Windows Management Instrumentation Driver Extensions Description: Provides systems management information to and from drivers. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: WMPNetworkSvc Display Name: Windows Media Player Network Sharing Service Description: Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play Path Name: "C:\Program Files\Windows Media Player\wmpnetwk.exe" Start Mode: Manual State: Stopped Name: wscsvc Display Name: Security Center Description: Monitors system security settings and configurations. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: wuauserv Display Name: Automatic Updates Description: Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: WudfSvc Display Name: Windows Driver Foundation - User-mode Driver Framework Description: Manages user-mode driver host processes Path Name: C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup Start Mode: Auto State: Stopped Name: WZCSVC Display Name: Wireless Zero Configuration Description: Provides automatic configuration for the 802.11 adapters Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Stopped Name: xmlprov Display Name: Network Provisioning Service Description: Manages XML configuration files on a domain basis for automatic network provisioning. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: ZuneBusEnum Display Name: Zune Bus Enumerator Description: Configures Zune for wireless syncing Path Name: c:\WINDOWS\system32\ZuneBusEnum.exe Start Mode: Auto State: Stopped Name: ZuneNetworkSvc Display Name: Zune Network Sharing Service Description: Shares Zune media libraries to Zune devices using Universal Plug and Play Path Name: "c:\Program Files\Zune\ZuneNss.exe" Start Mode: Manual State: Stopped Name: ZuneWlanCfgSvc Display Name: Zune Wireless Configuration Service Description: Configures Zune for wireless syncing Path Name: c:\WINDOWS\system32\ZuneWlanCfgSvc.exe Start Mode: Manual State: Stopped ------------------------------------------------------------------------------------ Displaying LOG for Microsoft Windows Malicious Software Removal Tool: --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.40, April 2008 Started On Tue Mar 18 03:02:13 2008 ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\DivX\DivX Web Player\npdivx32.dll (code 0x0000000D (13)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 18 03:03:25 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.41, May 2008 Started On Sat May 17 03:02:33 2008 ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\DivX\DivX Web Player\npdivx32.dll (code 0x0000000D (13)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Sat May 17 03:03:45 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.42, June 2008 Started On Thu Jun 12 03:07:56 2008 ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\GbpSv.exe (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\gbpdist.dll (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\gbpdist.dll (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\DivX\DivX Web Player\npdivx32.dll (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\gbpdist.dll (code 0x0000000D (13)) ->Scan ERROR: resource file://C:\Program Files\GbPlugin\gbpdist.dll (code 0x0000000D (13)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Jun 12 03:10:25 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.0, July 2008 Started On Tue Jul 22 08:30:42 2008 ->Scan ERROR: resource service://GbpSv (code 0x0000054F (1359)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Tue Jul 22 08:31:45 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.1, August 2008 Started On Thu Aug 14 03:09:28 2008 Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Aug 14 03:10:38 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.2, September 2008 Started On Thu Sep 11 05:52:41 2008 ->Scan ERROR: resource file://C:\Program Files\VS Revo Group\Revo Uninstaller\revouninstaller.exe (code 0x0000000D (13)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Sep 11 05:53:55 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.3, October 2008 Started On Thu Oct 16 03:02:13 2008 ->Scan ERROR: resource file://C:\Program Files\VS Revo Group\Revo Uninstaller\revouninstaller.exe (code 0x0000000D (13)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Oct 16 03:03:48 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.4, November 2008 Started On Thu Nov 13 03:06:35 2008 Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Nov 13 03:08:45 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.5, December 2008 Started On Fri Dec 12 03:00:27 2008 Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Fri Dec 12 03:02:16 2008 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v2.5, December 2008 Started On Tue Dec 30 17:34:21 2008 ->Scan ERROR: resource service://GbpSv (code 0x0000054F (1359)) Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Tue Dec 30 17:54:07 2008 dows Malicious Software Removal Tool Finished On Tue Dec 30 17:36:24 2008 ---------------------------------------------------------------------------- Listing HKCU Explorer\Advanced//Hidden and SuperHidden Registry Keys if Hidden = 0 then Hidden Files and Folders are not shown if SuperHidden = 1 is the desired default value. if ShowSuperHidden = 0 then System Files are not shown if HideFileExt = 1 then File Extension are not shown We want their values to be (from top to bottom) 1,1,1,0 ---------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced Hidden REG_DWORD 1 (0x1) SuperHidden REG_DWORD 1 (0x1) ShowSuperHidden REG_DWORD 1 (0x1) HideFileExt REG_DWORD 0 (0x0) ************************************************************************************ Examining Select Windows Registry Keys ------------------------------------------------------------------------------------ -------------------------------------------------------------------------- Items Found in ZoneMap\Domains: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains ---------------------------------------------------------------------------- Current User ZoneMap ProtocolDefaults ---------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\protocoldefaults REG_SZ http REG_DWORD 3 (0x3) https REG_DWORD 3 (0x3) ftp REG_DWORD 3 (0x3) file REG_DWORD 3 (0x3) @ivt REG_DWORD 1 (0x1) shell REG_DWORD 0 (0x0) ---------------------------------------------------------------------------- Default URL Prefix Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\DefaultPrefix REG_SZ http:// HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\Prefixes ftp REG_SZ ftp:// gopher REG_SZ gopher:// home REG_SZ http:// mosaic REG_SZ http:// www REG_SZ http:// -------------------------------------------------------------------------- Startup Items Disabled via MSCONFIG: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk backup REG_SZ C:\WINDOWS\pss\Google Updater.lnkCommon Startup location REG_SZ Common Startup item REG_SZ Google Updater HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk backup REG_SZ C:\WINDOWS\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup location REG_SZ Common Startup item REG_SZ WG111v2 Smart Wizard Wireless Setting HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^LimeWire On Startup.lnk backup REG_SZ C:\WINDOWS\pss\LimeWire On Startup.lnkStartup location REG_SZ Startup item REG_SZ LimeWire On Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ Reader_sl hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ ccApp hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ CamTray hkey REG_SZ HKCU command REG_SZ "C:\Program Files\Creative\Shared Files\CamTray.exe" inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ ehtray hkey REG_SZ HKLM command REG_SZ C:\WINDOWS\ehome\ehtray.exe inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ IPHSend hkey REG_SZ HKLM command REG_SZ C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jdbmgr key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ SVCH0ST hkey REG_SZ HKCU inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ Language hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ LogMeInSystray hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ msmsgs hkey REG_SZ HKCU command REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ MsnMsgr hkey REG_SZ HKCU command REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSWosCheck key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ osCheck hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ NvCpl hkey REG_SZ HKLM command REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ NvMcTray hkey REG_SZ HKLM command REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ nwiz hkey REG_SZ HKLM command REG_SZ nwiz.exe /install inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ osCheck hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\readericon key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ readericon45G hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ RECGUARD hkey REG_SZ HKLM command REG_SZ %WINDIR%\SMINST\RECGUARD.EXE inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ Remind_XP hkey REG_SZ HKLM command REG_SZ %WINDIR%\Creator\Remind_XP.exe inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ PDVDServ hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ SOUNDMAN hkey REG_SZ HKLM command REG_SZ SOUNDMAN.EXE inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ jusched hkey REG_SZ HKLM inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ SVCH0ST hkey REG_SZ HKCU inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ GoogleToolbarNotifier hkey REG_SZ HKCU command REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2 key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ RegistryBooster hkey REG_SZ HKCU inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ dumprep 0 -u hkey REG_SZ HKLM command REG_SZ %systemroot%\system32\dumprep 0 -u inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0330Mon.exe key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ V0330Mon hkey REG_SZ HKLM command REG_SZ C:\WINDOWS\V0330Mon.exe inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run item REG_SZ ZuneLauncher hkey REG_SZ HKLM command REG_SZ "C:\Program Files\Zune\ZuneLauncher.exe" inimapping REG_SZ 0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\state system.ini REG_DWORD 0 (0x0) win.ini REG_DWORD 0 (0x0) bootini REG_DWORD 0 (0x0) services REG_DWORD 0 (0x0) startup REG_DWORD 2 (0x2) -------------------------------------------------------------------------- Select AutoRun Registry Keys: -------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonceex HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup nwiz REG_SZ nwiz.exe /install NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce REG_SZ C:\WINDOWS\System32\cmd.exe /C del /Q C:\WINDOWS\system32\rdssrv.exe C:\WINDOWS\system32\rdshost.dll C:\WINDOWS\system32\hdfkt.dll GbPluginBb REG_SZ RunDll32.exe C:\PROGRA~1\GBPLUGIN\gbieh.dll,Gbieh HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce HKEY_USERS\.default\software\microsoft\windows\currentversion\run Power2GoExpress REG_SZ NA HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run Power2GoExpress REG_SZ NA HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce Error: Key: s-1-5-19\software\microsoft\windows\currentversion\run does not exist! HKEY_USERS\s-1-5-20\software\microsoft\windows\currentversion\run -------------------------------------------------------------------------- WinLogon Notify Registry Key: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb Asynchronous REG_DWORD 0 (0x0) DllName REG_SZ C:\PROGRA~1\GBPLUGIN\gbieh.dll Impersonate REG_DWORD 0 (0x0) MaxWait REG_DWORD 258 (0x102) Startup REG_SZ GbPluginEventStartup HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ crypt32.dll Logoff REG_SZ ChainWlxLogoffEvent HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ cryptnet.dll Logoff REG_SZ CryptnetWlxLogoffEvent HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll DLLName REG_SZ cscdll.dll Logon REG_SZ WinlogonLogonEvent Logoff REG_SZ WinlogonLogoffEvent ScreenSaver REG_SZ WinlogonScreenSaverEvent Startup REG_SZ WinlogonStartupEvent Shutdown REG_SZ WinlogonShutdownEvent StartShell REG_SZ WinlogonStartShellEvent Impersonate REG_DWORD 0 (0x0) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy Asynchronous REG_DWORD 1 (0x1) DllName REG_EXPAND_SZ %SystemRoot%\System32\dimsntfy.dll Startup REG_SZ WlDimsStartup Shutdown REG_SZ WlDimsShutdown Logon REG_SZ WlDimsLogon Logoff REG_SZ WlDimsLogoff StartShell REG_SZ WlDimsStartShell Lock REG_SZ WlDimsLock Unlock REG_SZ WlDimsUnlock HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ LMIinit.dll Impersonate REG_DWORD 0 (0x0) Lock REG_SZ WLEventLock Logoff REG_SZ WLEventLogoff Logon REG_SZ WLEventLogon Shutdown REG_SZ WLEventShutdown StartScreenSaver REG_SZ WLEventStartScreenSaver StartShell REG_SZ WLEventStartShell Startup REG_SZ WLEventStartup StopScreenSaver REG_SZ WLEventStopScreenSaver Unlock REG_SZ WLEventUnlock HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp DLLName REG_SZ wlnotify.dll Logon REG_SZ SCardStartCertProp Logoff REG_SZ SCardStopCertProp Lock REG_SZ SCardSuspendCertProp Unlock REG_SZ SCardResumeCertProp Enabled REG_DWORD 1 (0x1) Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ wlnotify.dll Impersonate REG_DWORD 0 (0x0) StartShell REG_SZ SchedStartShell Logoff REG_SZ SchedEventLogOff HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy Logoff REG_SZ WLEventLogoff Impersonate REG_DWORD 0 (0x0) Asynchronous REG_DWORD 1 (0x1) DllName REG_EXPAND_SZ sclgntfy.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn DLLName REG_SZ WlNotify.dll Lock REG_SZ SensLockEvent Logon REG_SZ SensLogonEvent Logoff REG_SZ SensLogoffEvent Safe REG_DWORD 1 (0x1) MaxWait REG_DWORD 600 (0x258) StartScreenSaver REG_SZ SensStartScreenSaverEvent StopScreenSaver REG_SZ SensStopScreenSaverEvent Startup REG_SZ SensStartupEvent Shutdown REG_SZ SensShutdownEvent StartShell REG_SZ SensStartShellEvent PostShell REG_SZ SensPostShellEvent Disconnect REG_SZ SensDisconnectEvent Reconnect REG_SZ SensReconnectEvent Unlock REG_SZ SensUnlockEvent Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ wlnotify.dll Impersonate REG_DWORD 0 (0x0) Logoff REG_SZ TSEventLogoff Logon REG_SZ TSEventLogon PostShell REG_SZ TSEventPostShell Shutdown REG_SZ TSEventShutdown StartShell REG_SZ TSEventStartShell Startup REG_SZ TSEventStartup MaxWait REG_DWORD 600 (0x258) Reconnect REG_SZ TSEventReconnect Disconnect REG_SZ TSEventDisconnect HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon Logon REG_SZ WLEventLogon Logoff REG_SZ WLEventLogoff Startup REG_SZ WLEventStartup Shutdown REG_SZ WLEventShutdown StartScreenSaver REG_SZ WLEventStartScreenSaver StopScreenSaver REG_SZ WLEventStopScreenSaver Lock REG_SZ WLEventLock Unlock REG_SZ WLEventUnlock StartShell REG_SZ WLEventStartShell PostShell REG_SZ WLEventPostShell Disconnect REG_SZ WLEventDisconnect Reconnect REG_SZ WLEventReconnect Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 0 (0x0) SafeMode REG_DWORD 1 (0x1) MaxWait REG_DWORD -1 (0xffffffff) DllName REG_EXPAND_SZ WgaLogon.dll Event REG_DWORD 0 (0x0) EulaAccepted REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings Data REG_BINARY 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000162411b5d870d4498d06740053922d8c04000000040000005300000003660000a800000010000000429ee918d4f9152098904fb456d1bdb20000000004800000a000000010000000e1810c9ce73d67da40e398cd7ae22798b0010000337d4e7387c1eceaee0ce119ad2d059024c6bc5bea72d893230ccdad1558b807b16993f7e15dd056d16db27d632b1de925ae667880aa5980338a951d84cc7707c15ff343bae8ce3a36d36a7eaefd76f1dcdc847f1426b3e41cc0a31f25cd4da0abfdaedeec79538842b87c2f9b4ca3c909f28c64f17543fecc76242b686b65cc094502ddfad2e8a89a53ff0b091d44156e3bbe251db1203f94744960895a1fea6005d1106c018097d04a2d6c7b93c20967f8c44c167720cc3dc0480dfa0aeee472b2c5e4b7fc77daedb72dd1b3ab4e0d01b746c6232b813a20096d5cf01301a45b7641553589567016604b49b5d171730fe922b47c435dfb5dcb70893b3c618861c15ec4e3eb6ecce10a7a00d071d5fce063c1f62144b4df15210ccfdc59a4c5f42d949a3c105dcca927e9ac93ee8d284ff72d30173931c4dde1847b5a479b269975504a815dde0016209e13b4ff937a5f814f93d3ee00e78f4d9a0f491a3d36f41cba4b2bd7df45272911bc696a8212109caffe45f7c8db4a794e8c8c2e670b38e338075f1eb3ebc4ec4af78be141233f179fafdc8118798b7c731c860623f05b9def3007b96a9f08b0d752ebd34e7a140000005af9b4d0caeafd34aa8d54b11823ed8f36eb968f HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon DLLName REG_SZ wlnotify.dll Logon REG_SZ RegisterTicketExpiredNotificationEvent Logoff REG_SZ UnregisterTicketExpiredNotificationEvent Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__GbPluginBb Asynchronous REG_DWORD 0 (0x0) DllName REG_SZ C:\PROGRAM FILES\GBPLUGIN\gbieh.dll Impersonate REG_DWORD 0 (0x0) MaxWait REG_DWORD 258 (0x102) Startup REG_SZ GbPluginEventStartup -------------------------------------------------------------------------- Shared Task Scheduler Registry Items: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler {438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Browseui preloader {8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Component Categories cache daemon -------------------------------------------------------------------------- Scheduled Tasks: -------------------------------------------------------------------------- Volume in drive C has no label. Volume Serial Number is 0CB9-684A Directory of C:\WINDOWS\tasks 17/12/2008 01:39 . 17/12/2008 01:39 .. 27/12/2008 16:53 284 AppleSoftwareUpdate.job 10/08/2004 13:00 65 desktop.ini 09/01/2005 17:48 4 FOLDER.TSX 01/01/2009 21:37 6 SA.DAT 4 File(s) 359 bytes Total Files Listed: 4 File(s) 359 bytes 2 Dir(s) 10.078.597.120 bytes free A C:\WINDOWS\tasks\AppleSoftwareUpdate.job HR C:\WINDOWS\tasks\desktop.ini A SH C:\WINDOWS\tasks\FOLDER.TSX A H C:\WINDOWS\tasks\SA.DAT ---------------------------------------------------------------------------- ShellExecuteHooks Registry Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ {E37CB5F0-51F5-4395-A808-5FA49E399F83} REG_SZ GbPlugin ShlObj ---------------------------------------------------------------------------- ShellServiceObjectDelayLoad Registry Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload PostBootReminder REG_SZ {7849596a-48ea-486e-8937-a2a3009f31a9} CDBurn REG_SZ {fbeb8a05-beee-4442-804e-409d6c4515e9} WebCheck REG_SZ {E6FB5E20-DE35-11CF-9C87-00AA005127ED} SysTray REG_SZ {35CEC8A3-2BE6-11D2-8773-92E220524153} WPDShServiceObj REG_SZ {AAA288BA-9A4C-45B0-95D7-94D524869DB5} ---------------------------------------------------------------------------- ModuleUsage Registry Keys: ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/CONFLICT.1/FP_AX_CAB_INSTALLER.exe .Owner REG_SZ {D27CDB6E-AE6D-11CF-96B8-444553540000} {D27CDB6E-AE6D-11CF-96B8-444553540000} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/CONFLICT.2/FP_AX_CAB_INSTALLER.exe .Owner REG_SZ {D27CDB6E-AE6D-11CF-96B8-444553540000} {D27CDB6E-AE6D-11CF-96B8-444553540000} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/driveragent.ocx .Owner REG_SZ {E8F628B5-259A-4734-97EE-BA914D7BE941} {E8F628B5-259A-4734-97EE-BA914D7BE941} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/FP_AX_CAB_INSTALLER.exe .Owner REG_SZ {D27CDB6E-AE6D-11CF-96B8-444553540000} {D27CDB6E-AE6D-11CF-96B8-444553540000} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/gbpdist.dll .Owner REG_SZ {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/LMIProxyHelper.exe .Owner REG_SZ {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/MsnPUpld.dll .Owner REG_SZ {4F1E5B1A-2A80-42CA-8532-2D05CB959537} {4F1E5B1A-2A80-42CA-8532-2D05CB959537} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/NvidiaSmartScan.ocx .Owner REG_SZ {74DBCB52-F298-4110-951D-AD2FF67BC8AB} {74DBCB52-F298-4110-951D-AD2FF67BC8AB} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/PURen-us.dll .Owner REG_SZ {4F1E5B1A-2A80-42CA-8532-2D05CB959537} {4F1E5B1A-2A80-42CA-8532-2D05CB959537} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/RACtrl.dll .Owner REG_SZ {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/sprthelper.exe .Owner REG_SZ {01113300-3E00-11D2-8470-0060089874ED} {01113300-3E00-11D2-8470-0060089874ED} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/tgctlcm.dll .Owner REG_SZ {01113300-3E00-11D2-8470-0060089874ED} {01113300-3E00-11D2-8470-0060089874ED} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/TriJinx.1.0.0.55.dll .Owner REG_SZ {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/atl.dll .Owner REG_SZ Unknown Owner {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/lnod32apiA.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/lnod32apiW.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/lnod32umc.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/lnod32upd.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/mfc42.dll .Owner REG_SZ Unknown Owner {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/msvcrt.dll .Owner REG_SZ Unknown Owner {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/olepro32.dll .Owner REG_SZ Unknown Owner {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/OnlineScanner.ocx .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/OnlineScannerDLLA.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/OnlineScannerDLLW.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/OnlineScannerLang.dll .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/OnlineScannerUninstaller.exe .Owner REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/ractrlkeyhook.dll .Owner REG_SZ {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/unicows.dll .Owner REG_SZ Unknown Owner {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} REG_SZ {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} REG_SZ ---------------------------------------------------------------------------- BHO Registry Keys: ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C41A1C0E-EA6C-11D4-B1B8-444553540000} REG_SZ G-Buster Browser Defense HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C} -------------------------------------------------------------------------- Select Policy Keys: -------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer NoDriveTypeAutoRun REG_DWORD 149 (0x95) LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0) HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system DisableRegistryTools REG_DWORD 0 (0x0) HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\Shell HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0) NoResolveSearch REG_DWORD 1 (0x1) NoCDBurning REG_DWORD 0 (0x0) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1) InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer NoDriveTypeAutoRun REG_DWORD 145 (0x91) HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\.default\software\microsoft\windows\currentversion\policies HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\Explorer HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer NoDriveTypeAutoRun REG_DWORD 145 (0x91) HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run ************************************************************************************ Checking File System for suspicious Files -------------------------------------------------------------------------- Items in the Root Directory: -------------------------------------------------------------------------- Locating all files created in C:\ Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all Backup files on C: -------------------------------------------------------------------------- Locating all *.BAK* files Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of Internet Explorer on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of beep.sy_ on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of beep.sys on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Locating all copies of Windows Explorer on C: -------------------------------------------------------------------------- Locating all copies of Windows Explorer Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in Document and Settings: -------------------------------------------------------------------------- Listing contents of C:\Documents and Settings Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Desktop Items: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Owner\Desktop within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Desktop\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Start Menu Items: -------------------------------------------------------------------------- Locating all files created inC:\Documents and Settings\Owner\Start Menu within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\Owner\Start Menu\Programs\Startup within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Start Menu within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Application Data Items: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Owner\Application Data\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\Owner\Local Settings\Application Data\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Documents and Settings\All Users\Application Data\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\Documents and Settings\Owner\Local Settings\TEMP: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Owner\Local Settings\TEMP within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in Templates Folder: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Owner\Templates Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in Program Files: -------------------------------------------------------------------------- Locating all files created in C:\Program Files\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Program Files\Common Files\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM Locating all files created in C:\Program Files\Common Files\Microsoft Shared\Web Folders within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- Items in the Windows Directory: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\Downloaded Program Files: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\Downloaded Program Files\ within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\PCHealth\HelpCtr\Binaries: -------------------------------------------------------------------------- Locating all files in C:\WINDOWS\PCHealth\HelpCtr\Binaries Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32 within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\com: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\com within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\components: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\components within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\drivers: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\drivers within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\system32\drivers\etc: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\drivers\etc within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM -------------------------------------------------------------------------- C:\WINDOWS\TEMP: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\TEMP within the last 90 days. Cannot execute C:\ISEEYOUXP\LOCATE.COM ************************************************************************************ Checking for .COM files to Delete. They will only print if deleted! Locating .COM files in the C:\WINDOWS\System32 folder Cannot execute C:\ISEEYOUXP\LOCATE.COM ************************************************************************************ Miscellaneous Malware Detections: ------------------------------------------------------------------------------------ **** Delfin Media {31EE3286-D785-4E3F-95FC-51D00FDABC01} NOT FOUND by this tool! **** **** SmitFraud {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! **** **** SpywareStrike {C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D} NOT FOUND by this tool! **** **** SpywareStrike {C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C} NOT FOUND by this tool! **** **** SpywareStrike {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} NOT FOUND by this tool! **** **** SpyAxe {A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! **** **** SpyFalcon {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! **** **** SpyFalcon {C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D} NOT FOUND by this tool! **** **** SpyFalcon {CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E} NOT FOUND by this tool! **** **** SpyFalcon {35a88e51-b53d-43e9-b8a7-75d4c31b4676} NOT FOUND by this tool! **** **** SpyFalcon {64ba30a2-811a-4597-b0af-d551128be340} NOT FOUND by this tool! **** **** SpyFalcon {89aef01d-d237-49c7-84dc-4e1904c1fd31} NOT FOUND by this tool! **** **** SpyFalcon {e04408db-4812-4478-8d4d-e46edcffd3b6} NOT FOUND by this tool! **** **** SpyFalcon {336ec37f-54bf-4f13-8237-03f64fa591e7} NOT FOUND by this tool! **** **** SpyFalcon {5bc82bdb-bc03-4671-9a78-3ef2b68449de} NOT FOUND by this tool! **** **** SpyFalcon {24c60b9b-26b5-4201-9f7a-fb9219356ae9} NOT FOUND by this tool! **** **** SpyFalcon {a0c51615-738a-4542-801a-5af61614e182} NOT FOUND by this tool! **** **** SpyFalcon {70fbd528-2d3c-4a00-9b8c-bbf441e534be} NOT FOUND by this tool! **** **** SpyFalcon {a566f298-05a6-4b3d-b672-da7c27316430} NOT FOUND by this tool! **** **** SpyFalcon {f5947202-e9cb-4a72-88e7-22f2cbd2b124} NOT FOUND by this tool! **** **** SpyFalcon {5aaf6542-f4ba-4df4-873d-4902ecbe794c} NOT FOUND by this tool! **** **** SpyFalcon {3e4155b8-5a4a-4e95-83b2-ab032da9acbc} NOT FOUND by this tool! **** **** SpyFalcon {9952355f-fefb-4764-bcd7-a993d03dd7e2} NOT FOUND by this tool! **** **** SpyFalcon {55059d4f-a1ac-4837-ae07-4859101f598d} NOT FOUND by this tool! **** **** SpyFalcon {c3786a8d-6426-4c29-a23f-f36e47b31e0c} NOT FOUND by this tool! **** **** SpyLocked {25b7d2fd-4f71-46d1-801a-7de323e4ec82} NOT FOUND by this tool! **** **** SpyLocked {4233AC08-A2C4-4742-A0B4-83719613D62C} NOT FOUND by this tool! **** **** SpyLocked {716002DB-288C-4BF0-80CD-A467E78D8B55} NOT FOUND by this tool! **** **** SpyLocked {735E980D-45D2-4777-AF82-9923D3C8D3AE} NOT FOUND by this tool! **** **** SpyLocked {B23DC537-3E13-44C7-BF67-D8405EB377F7} NOT FOUND by this tool! **** **** SpyLocked {B292EC9F-A074-4115-8342-1F459702D8D2} NOT FOUND by this tool! **** **** SpyLocked {CECA6F2B-247B-4ECE-9B7A-D0135C8036FC} NOT FOUND by this tool! **** **** SpyLocked {DA3B49F6-8C54-4429-A275-21A86DCCA413} NOT FOUND by this tool! **** **** SpyLocked {EDE8BED5-92CF-4482-8F51-A01CD9B3EA37} NOT FOUND by this tool! **** **** SpyLocked {FA4FBF53-C766-4622-8011-A87A805EEBF0} NOT FOUND by this tool! **** **** SpywareLocked {0E4E5110-A772-4C4A-A7DC-137FE10ABD6E} NOT FOUND by this tool! **** **** SpywareLocked {07A582E8-BAE3-457D-9D29-2048DE45A369} NOT FOUND by this tool! **** **** SpywareLocked {3BAA1AD8-EE49-4772-BF0B-F55083E0F7AA} NOT FOUND by this tool! **** **** SpywareLocked {9D6FAC42-A7BE-4702-87EF-75D8DC14249E} NOT FOUND by this tool! **** **** SpywareLocked {ABEF791F-947E-4CDF-83C3-E72A240AFB67} NOT FOUND by this tool! **** **** SpywareLocked {BD0FC212-0A36-4232-83CC-2063FB9282E0} NOT FOUND by this tool! **** **** SpywareLocked {B0DED443-5E68-4001-A81B-0A0001621AB8} NOT FOUND by this tool! **** **** SpywareLocked {F38B1B2B-4976-46DD-9FE5-60FDE72F0B4D} NOT FOUND by this tool! **** **** SpywareQuake {0c7416f0-dd23-420f-97f5-aae352ea2bf1} NOT FOUND by this tool! **** **** SpywareQuake {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} NOT FOUND by this tool! **** **** SpywareQuake {AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E} NOT FOUND by this tool! **** **** SpywareQuake {CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A} NOT FOUND by this tool! **** **** SpywareQuake {EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E} NOT FOUND by this tool! **** **** SpywareQuake {e5b1e382-817e-4b74-8a96-ec78751e6acf} NOT FOUND by this tool! **** **** SpywareQuake {a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb} NOT FOUND by this tool! **** **** SpywareQuake {cbb430e6-5b1b-474a-9d7e-160d4fe74bea} NOT FOUND by this tool! **** **** SpywareQuake {62eb0924-19d2-4226-b4b9-8ad1f70904c1} NOT FOUND by this tool! **** **** SpywareQuake {6c69e319-0d03-47da-997a-36586cbc53b3} NOT FOUND by this tool! **** **** SpywareQuake {aea3d2df-2b2c-4d7b-81a0-d975c6dc088e} NOT FOUND by this tool! **** **** SpywareSheriff {1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E} NOT FOUND by this tool! **** **** VirusBurster {9d635a36-6b3c-4146-8625-f3aaf507bbf8} NOT FOUND by this tool! **** **** TrustCleaner {24E27EA9-FCF3-444F-BD80-20543BA5D946} NOT FOUND by this tool! **** **** Troj/Small-ER {4F141CBA-1457-6CCA-03A7-7AA21B61EA0F} NOT FOUND by this tool! **** **** Troj/Spabot-E {429F4BB8-7BF7-4152-8011-3C6F9EB7E892} NOT FOUND by this tool! **** **** Troj/Dloader-OF {203B1C4D9-BC71-8916-38AD-9DEA5D213614} NOT FOUND by this tool! **** **** Troj/Crafted-A {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! **** **** Troj/Agent-FG {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} NOT FOUND by this tool! **** **** TX 4 BrowserAd adware {8e99f990-b75a-4568-b3c8-24cbc8cbbfc1} NOT FOUND by this tool! **** **** Trojan-Proxy.Win32.Small {87A3E824-A726-4CF4-8A66-6314B11BDA0C} NOT FOUND by this tool! **** **** Trojan-Downloader.Win32.Delf.ks {786C369D-409A-456f-A13C-971EADA850C6} NOT FOUND by this tool! **** **** W32/Almanahe.a Worm NOT FOUND by this tool! **** **** msctl32.dll SpamBot NOT FOUND by this tool! **** **** KeyLogger NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR BOT-TYPE WORMS: -------------------------------------------------------------------------- **** W32/Sdbot Worm NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR KNOWN ROOTKIT STEALTHING AGENTS: -------------------------------------------------------------------------- **** i386p.* Stealthing Agent NOT FOUND by this tool! **** **** ErrorSafe erssdd.* Stealthing Agent NOT FOUND by this tool! **** **** VUNDO DP.* Stealthing Agent NOT FOUND by this tool! **** **** Troj/NTRootK-BP main.* Stealthing Agent NOT FOUND by this tool! **** **** W32/Almanahe.sys RioDrvrs.* Stealthing Agent NOT FOUND by this tool! **** **** W32/Almanahe.sys DKIS6.* Stealthing Agent NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR VISIBLE ROOTKIT-TYPE REGISTRY KEYS: -------------------------------------------------------------------------- **** Rustock.B trojan, PE386 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, huy32 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, lzx32 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, msguard rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, xpdt.sy_ rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, xpdt.sys rootkit NOT FOUND by this tool! **** **** CmdService adware NOT FOUND by this tool! **** **** Network_Monitor adware NOT FOUND by this tool! **** **** Trojan.Peacomm NOT FOUND by this tool! **** **** Trojan.Peacomm windev NOT FOUND by this tool! **** **** AVPE Haxdoor NOT FOUND by this tool! **** **** MEMLOW Haxdoor NOT FOUND by this tool! **** **** VDMT Haxdoor NOT FOUND by this tool! **** **** YCSVGA Haxdoor NOT FOUND by this tool! **** **** PPTP Haxdoor NOT FOUND by this tool! **** **** DVB Haxdoor NOT FOUND by this tool! **** **** YVBB Haxdoor NOT FOUND by this tool! **** **** YVPP Haxdoor NOT FOUND by this tool! **** **** NKGFS Haxdoor NOT FOUND by this tool! **** **** XMSK Haxdoor NOT FOUND by this tool! **** **** AVPX Haxdoor NOT FOUND by this tool! **** **** MMXF Haxdoor NOT FOUND by this tool! **** **** DP1112 Vundo Rootkit NOT FOUND by this tool! **** **** SYSBUS32 Rootkit Driver NOT FOUND by this tool! **** **** I386P Rootkit Driver NOT FOUND by this tool! **** **** ERSSDD Rootkit NOT FOUND by this tool! **** **** GencTurK RootKit NOT FOUND by this tool! **** **** Troj/NTRootK-BP RootKit NOT FOUND by this tool! **** **** W32/Almanahe.sys NOT FOUND by this tool! **** ************************************************************************************ Dumping HKLM Uninstall Programs list DisplayName REG_SZ Apple Mobile Device Support DisplayName REG_SZ Apple Software Update DisplayName REG_SZ Arquivo do WinRAR DisplayName REG_SZ Assistente de Conexo do Windows Live DisplayName REG_SZ AVI Extractor Version 1.0 DisplayName REG_SZ AviSynth 2.5 DisplayName REG_SZ ConvertXtoDVD 3.1.2.34 DisplayName REG_SZ Creative Software AutoUpdate DisplayName REG_SZ Creative WebCam Center DisplayName REG_SZ Creative WebCam Vista/Live! Cam Chat Driver (1.02.02.00) DisplayName REG_SZ DivX Web Player DisplayName REG_SZ Free Video to Mp3 Converter version 3.1 DisplayName REG_SZ HijackThis 2.0.2 DisplayName REG_SZ Hotfix for Windows Internet Explorer 7 (KB947864) DisplayName REG_SZ Hotfix for Windows Media Format 11 SDK (KB929399) DisplayName REG_SZ Hotfix for Windows Media Player 10 (KB903157) DisplayName REG_SZ Hotfix for Windows Media Player 10 (KB910393) DisplayName REG_SZ Hotfix for Windows Media Player 11 (KB939683) DisplayName REG_SZ Hotfix for Windows XP (KB932716-v2) DisplayName REG_SZ Hotfix for Windows XP (KB952287) DisplayName REG_SZ Java(TM) 6 Update 10 DisplayName REG_SZ K-Lite Mega Codec Pack 4.0.0 DisplayName REG_SZ Malwarebytes' Anti-Malware DisplayName REG_SZ Microsoft .NET Framework 1.1 DisplayName REG_SZ Microsoft .NET Framework 1.1 DisplayName REG_SZ Microsoft .NET Framework 1.1 Hotfix (KB928366) DisplayName REG_SZ Microsoft .NET Framework 2.0 Service Pack 1 DisplayName REG_SZ Microsoft Application Error Reporting DisplayName REG_SZ Microsoft Compression Client Pack 1.0 for Windows XP DisplayName REG_SZ Microsoft Digital Image Library 9 - Blocker DisplayName REG_SZ Microsoft Digital Image Starter Edition 2006 DisplayName REG_SZ Microsoft Digital Image Starter Edition 2006 Editor DisplayName REG_SZ Microsoft Digital Image Starter Edition 2006 Library DisplayName REG_SZ Microsoft Internationalized Domain Names Mitigation APIs DisplayName REG_SZ Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 DisplayName REG_SZ Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 DisplayName REG_SZ Microsoft National Language Support Downlevel APIs DisplayName REG_SZ Microsoft Office Standard Edition 2003 DisplayName REG_SZ Microsoft Silverlight DisplayName REG_SZ Microsoft SQL Server 2005 Compact Edition [ENU] DisplayName REG_SZ Microsoft User-Mode Driver Framework Feature Pack 1.7 DisplayName REG_SZ Microsoft Visual C++ 2005 Redistributable DisplayName REG_SZ Microsoft WinUsb 1.0 DisplayName REG_SZ Microsoft Works DisplayName REG_SZ Microsoft XML Parser DisplayName REG_SZ Mozilla Firefox (3.0.5) DisplayName REG_SZ MSN DisplayName REG_SZ MSXML 4.0 SP2 (KB925672) DisplayName REG_SZ MSXML 4.0 SP2 (KB927978) DisplayName REG_SZ MSXML 4.0 SP2 (KB936181) DisplayName REG_SZ MSXML 4.0 SP2 (KB954430) DisplayName REG_SZ MSXML 6.0 Parser (KB933579) DisplayName REG_SZ MV AntiSpy 4.0 DisplayName REG_SZ MV RegClean 5.5 DisplayName REG_SZ Nero OEM DisplayName REG_SZ NVIDIA Drivers DisplayName REG_SZ PC Wizard 2008.1.871 DisplayName REG_SZ Portinho 3.0a DisplayName REG_SZ QuickTime DisplayName REG_SZ Realtek AC'97 Audio DisplayName REG_SZ Samsung Master DisplayName REG_SZ Samsung USB Driver DisplayName REG_SZ Security Update for CAPICOM (KB931906) DisplayName REG_SZ Security Update for CAPICOM (KB931906) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB937143) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB938127) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB939653) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB942615) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB944533) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB950759) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB953838) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB956390) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB958215) DisplayName REG_SZ Security Update for Windows Internet Explorer 7 (KB960714) DisplayName REG_SZ Security Update for Windows Media Encoder (KB954156) DisplayName REG_SZ Security Update for Windows Media Player (KB952069) DisplayName REG_SZ Security Update for Windows Media Player 10 (KB917734) DisplayName REG_SZ Security Update for Windows Media Player 11 (KB936782) DisplayName REG_SZ Security Update for Windows Media Player 11 (KB954154) DisplayName REG_SZ Security Update for Windows XP (KB938464) DisplayName REG_SZ Security Update for Windows XP (KB941569) DisplayName REG_SZ Security Update for Windows XP (KB946648) DisplayName REG_SZ Security Update for Windows XP (KB950760) DisplayName REG_SZ Security Update for Windows XP (KB950762) DisplayName REG_SZ Security Update for Windows XP (KB950974) DisplayName REG_SZ Security Update for Windows XP (KB951066) DisplayName REG_SZ Security Update for Windows XP (KB951376-v2) DisplayName REG_SZ Security Update for Windows XP (KB951376) DisplayName REG_SZ Security Update for Windows XP (KB951698) DisplayName REG_SZ Security Update for Windows XP (KB951748) DisplayName REG_SZ Security Update for Windows XP (KB952954) DisplayName REG_SZ Security Update for Windows XP (KB953839) DisplayName REG_SZ Security Update for Windows XP (KB954211) DisplayName REG_SZ Security Update for Windows XP (KB954459) DisplayName REG_SZ Security Update for Windows XP (KB954600) DisplayName REG_SZ Security Update for Windows XP (KB955069) DisplayName REG_SZ Security Update for Windows XP (KB956391) DisplayName REG_SZ Security Update for Windows XP (KB956802) DisplayName REG_SZ Security Update for Windows XP (KB956803) DisplayName REG_SZ Security Update for Windows XP (KB956841) DisplayName REG_SZ Security Update for Windows XP (KB957095) DisplayName REG_SZ Security Update for Windows XP (KB957097) DisplayName REG_SZ Security Update for Windows XP (KB958644) DisplayName REG_SZ Smart Defrag 1.03 DisplayName REG_SZ Soft Data Fax Modem with SmartCP DisplayName REG_SZ Sonic Encoders DisplayName REG_SZ STDU Viewer version 1.4.13.0 DisplayName REG_SZ Symantec Network Drivers Update DisplayName REG_SZ Update for Windows Media Player 10 (KB913800) DisplayName REG_SZ Update for Windows Media Player 10 (KB926251) DisplayName REG_SZ Update for Windows XP (KB951072-v2) DisplayName REG_SZ Update for Windows XP (KB951978) DisplayName REG_SZ Update for Windows XP (KB953356) DisplayName REG_SZ Update for Windows XP (KB955839) DisplayName REG_SZ Update Rollup 2 for Windows XP Media Center Edition 2005 DisplayName REG_SZ Verizon Online Help and Support DisplayName REG_SZ Viewpoint Media Player DisplayName REG_SZ WebFldrs XP DisplayName REG_SZ WinAVI Video Converter DisplayName REG_SZ WinAVI Video Converter 9.0 DisplayName REG_SZ Windows Backup Utility DisplayName REG_SZ Windows Live installer DisplayName REG_SZ Windows Live OneCare safety scanner DisplayName REG_SZ Windows Live Toolbar DisplayName REG_SZ Windows Media Encoder 9 Series DisplayName REG_SZ Windows Media Encoder 9 Series DisplayName REG_SZ Windows Media Format 11 runtime DisplayName REG_SZ Windows Media Format 11 runtime DisplayName REG_SZ Windows Media Player 11 DisplayName REG_SZ Windows Media Player 11 DisplayName REG_SZ Windows Media Player Firefox Plugin DisplayName REG_SZ Windows XP Media Center Edition 2005 KB925766 DisplayName REG_SZ Windows XP Service Pack 3 DisplayName REG_SZ Zune DisplayName REG_SZ Zune DisplayName REG_SZ Zune Language Pack (ES) DisplayName REG_SZ Zune Language Pack (FR) ParentDisplayName REG_SZ ParentDisplayName REG_SZ ParentDisplayName REG_SZ CAPICOM ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows Internet Explorer 7 - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP - Software Updates ParentDisplayName REG_SZ Windows XP Media Center Edition 2005 ParentDisplayName REG_SZ Windows XP Media Center Edition 2005 QuietDisplayName REG_SZ Shockwave Flash ##################################################################################################### -- All DONE! :) ~ ShadowPuterDude ~