OTScanIt log
Again thanks,
All of the Exe files in the Windows directory weren't there previously as I recall. Additionally threatexpert.com [admittedly somewhat alarmist] associates all of these both with legitimate apps and a known rootkit: Trojan.NirCmd [PC Tools]. Also if it helps a Scheduled Task [named gcetnfqd] that I did not create appeared [set to run every hour] that called on system32\wvUonLCS.dll [hidden].
OTScanIt2 logfile created on: 1/16/2009 02:47:11 PM - Run 1
OTScanIt2 by OldTimer - Version 1.0.6.2 Folder = C:\Documents and Settings\Administrator.COMPUTER\My Documents\Anti-Smitfraud\OTScanIt2
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
958.46 Mb Total Physical Memory | 643.89 Mb Available Physical Memory | 67.18% Memory free
2.26 Gb Paging File | 2.05 Gb Available in Paging File | 90.92% Paging File free
Paging file location(s): C:\pagefile.sys 0 0;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.76 Gb Total Space | 77.06 Gb Free Space | 68.95% Space Free | Partition Type: FAT32
Drive D: | 465.65 Gb Total Space | 236.45 Gb Free Space | 50.78% Space Free | Partition Type: FAT32
Drive E: | 149.01 Gb Total Space | 130.79 Gb Free Space | 87.77% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: COMPUTER
Current User Name: Administrator
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 90 Days
[Processes - All]
alg.exe -> %SystemRoot%\System32\alg.exe -> [2004/08/04 01:00:00 | 00,044,544 | ---- | M] (Microsoft Corporation)
atwtusb.exe -> %SystemRoot%\system32\atwtusb.exe -> [2007/03/20 17:43:50 | 00,315,392 | ---- | M] ()
avgamsvr.exe -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe -> [2008/11/12 11:59:50 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.)
avgcc.exe -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe -> [2008/11/12 12:08:54 | 00,590,848 | ---- | M] (GRISOFT, s.r.o.)
avgemc.exe -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe -> [2008/11/12 11:59:50 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.)
avgupsvc.exe -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe -> [2008/11/12 11:52:56 | 00,049,664 | ---- | M] (GRISOFT, s.r.o.)
csrss.exe -> %SystemRoot%\system32\csrss.exe -> [2004/08/04 01:00:00 | 00,006,144 | ---- | M] (Microsoft Corporation)
explorer.exe -> %SystemRoot%\Explorer.EXE -> [2007/06/13 03:23:08 | 01,033,216 | ---- | M] (Microsoft Corporation)
lsass.exe -> %SystemRoot%\system32\lsass.exe -> [2004/08/04 01:00:00 | 00,013,312 | ---- | M] (Microsoft Corporation)
notepad.exe -> %SystemRoot%\system32\NOTEPAD.EXE -> [2004/08/04 01:00:00 | 00,069,120 | ---- | M] (Microsoft Corporation)
otscanit2.exe -> %UserProfile%\My Documents\Anti-Smitfraud\OTScanIt2\OTScanIt2.exe -> [2009/01/09 09:03:22 | 00,485,376 | ---- | M] (OldTimer
Tools)
services.exe -> %SystemRoot%\system32\services.exe -> [2004/08/04 01:00:00 | 00,108,032 | ---- | M] (Microsoft Corporation)
smss.exe -> %SystemRoot%\System32\smss.exe -> [2004/08/04 01:00:00 | 00,050,688 | ---- | M] (Microsoft Corporation)
soundman.exe -> %SystemRoot%\SOUNDMAN.EXE -> [2005/11/11 14:07:40 | 00,090,112 | ---- | M] (Realtek Semiconductor Corp.)
spoolsv.exe -> %SystemRoot%\system32\spoolsv.exe -> [2005/06/10 16:53:32 | 00,057,856 | ---- | M] (Microsoft Corporation)
svchost.exe -> %SystemRoot%\system32\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH] -> [2004/08/04 01:00:00 | 00,014,336 | ---- | M]
(Microsoft Corporation)
-> %SystemRoot%\system32\rpcss.dll [DcomLaunch] -> [2005/07/25 21:39:50 | 00,397,824 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\termsrv.dll [TermService] -> [2004/08/04 01:00:00 | 00,295,424 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\regsvc.dll [RemoteRegistry] -> [2004/08/04 01:00:00 | 00,059,904 | ---- | M] (Microsoft Corporation)
svchost.exe -> %SystemRoot%\system32\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS] -> [2004/08/04 01:00:00 | 00,014,336 | ---- | M]
(Microsoft Corporation)
-> %SystemRoot%\System32\rpcss.dll [RpcSs] -> [2005/07/25 21:39:50 | 00,397,824 | ---- | M] (Microsoft Corporation)
svchost.exe -> %SystemRoot%\system32\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC] -> [2004/08/04 01:00:00 | 00,014,336 | ---- | M]
(Microsoft Corporation)
-> %SystemRoot%\system32\wiaservc.dll [stisvc] -> [2006/12/19 11:16:48 | 00,333,824 | ---- | M] (Microsoft Corporation)
svchost.exe -> %SystemRoot%\system32\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE] -> [2004/08/04 01:00:00 | 00,014,336 | ----
| M] (Microsoft Corporation)
-> %SystemRoot%\system32\alrsvc.dll [Alerter] -> [2004/08/04 01:00:00 | 00,017,408 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\lmhsvc.dll [LmHosts] -> [2004/08/04 01:00:00 | 00,013,824 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\regsvc.dll [RemoteRegistry] -> [2004/08/04 01:00:00 | 00,059,904 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\ssdpsrv.dll [SSDPSRV] -> [2004/08/04 01:00:00 | 00,071,680 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\upnphost.dll [upnphost] -> [2007/02/05 13:17:02 | 00,185,344 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\webclnt.dll [WebClient] -> [2006/01/03 20:35:06 | 00,068,096 | ---- | M] (Microsoft Corporation)
svchost.exe -> %SystemRoot%\System32\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS] -> [2004/08/04 01:00:00 | 00,014,336 | ---- | M]
(Microsoft Corporation)
-> %SystemRoot%\System32\appmgmts.dll [AppMgmt] -> [2004/08/04 01:00:00 | 00,167,936 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\audiosrv.dll [AudioSrv] -> [2004/08/04 01:00:00 | 00,042,496 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\qmgr.dll [BITS] -> [2004/08/04 01:00:00 | 00,382,464 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\browser.dll [Browser] -> [2004/08/04 01:00:00 | 00,077,312 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\cryptsvc.dll [CryptSvc] -> [2004/08/04 01:00:00 | 00,060,416 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\dhcpcsvc.dll [Dhcp] -> [2006/05/19 05:59:42 | 00,111,616 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\dmserver.dll [dmserver] -> [2004/08/04 01:00:00 | 00,023,552 | ---- | M] (Microsoft Corp.)
-> %SystemRoot%\System32\ersvc.dll [ERSvc] -> [2004/08/04 01:00:00 | 00,023,040 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\es.dll [EventSystem] -> [2008/07/07 14:32:22 | 00,253,952 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\shsvcs.dll [FastUserSwitchingCompatibility] -> [2006/12/19 14:52:18 | 00,134,656 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\PCHealth\HelpCtr\Binaries\pchsvc.dll [helpsvc] -> [2004/08/04 01:00:00 | 00,038,912 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\hidserv.dll [HidServ] -> File not found
-> %SystemRoot%\System32\srvsvc.dll [lanmanserver] -> [2004/12/07 12:32:34 | 00,096,768 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\wkssvc.dll [lanmanworkstation] -> [2006/08/17 05:28:28 | 00,132,096 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\msgsvc.dll [Messenger] -> [2004/08/04 01:00:00 | 00,033,792 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\netman.dll [Netman] -> [2005/08/22 11:29:46 | 00,197,632 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\mswsock.dll [Nla] -> [2008/06/20 11:41:10 | 00,245,248 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\ntmssvc.dll [NtmsSvc] -> [2004/08/04 01:00:00 | 00,435,200 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\rasauto.dll [RasAuto] -> [2004/08/04 01:00:00 | 00,089,088 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\rasmans.dll [RasMan] -> [2006/06/22 03:47:18 | 00,181,248 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\mprdim.dll [RemoteAccess] -> [2004/08/04 01:00:00 | 00,049,152 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\schedsvc.dll [Schedule] -> [2004/08/04 01:00:00 | 00,190,976 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\seclogon.dll [seclogon] -> [2004/08/04 01:00:00 | 00,018,944 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\sens.dll [SENS] -> [2004/08/04 01:00:00 | 00,038,912 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\ipnathlp.dll [SharedAccess] -> [2004/08/04 01:00:00 | 00,331,264 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\shsvcs.dll [ShellHWDetection] -> [2006/12/19 14:52:18 | 00,134,656 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\srsvc.dll [srservice] -> [2004/08/04 01:00:00 | 00,170,496 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\tapisrv.dll [TapiSrv] -> [2005/07/08 09:27:56 | 00,249,344 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\shsvcs.dll [Themes] -> [2006/12/19 14:52:18 | 00,134,656 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\trkwks.dll [TrkWks] -> [2004/08/04 01:00:00 | 00,090,624 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\w32time.dll [W32Time] -> [2004/08/04 01:00:00 | 00,174,592 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\wbem\WMIsvc.dll [winmgmt] -> [2004/08/04 01:00:00 | 00,144,896 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\advapi32.dll [Wmi] -> [2004/08/04 01:00:00 | 00,616,960 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\wscsvc.dll [wscsvc] -> [2004/08/04 01:00:00 | 00,081,408 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\system32\wuauserv.dll [wuauserv] -> [2004/08/04 01:00:00 | 00,006,656 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\wzcsvc.dll [WZCSVC] -> [2004/08/04 01:00:00 | 00,359,936 | ---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\xmlprov.dll [xmlprov] -> [2004/08/04 01:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation)
svchost.exe -> %SystemRoot%\system32\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE] -> [2004/08/04 01:00:00 | 00,014,336 |
---- | M] (Microsoft Corporation)
-> %SystemRoot%\System32\dnsrslvr.dll [Dnscache] -> [2008/02/19 23:32:44 | 00,045,568 | ---- | M] (Microsoft Corporation)
tblmouse.exe -> %SystemRoot%\system32\TBLMOUSE.EXE -> [2007/01/30 09:52:42 | 00,065,184 | ---- | M] (WALTOP International Corp.)
winlogon.exe -> %SystemRoot%\system32\winlogon.exe -> [2004/08/04 01:00:00 | 00,502,272 | ---- | M] (Microsoft Corporation)
[Win32 Services - Safe List]
(AcrSch2Svc) Acronis Scheduler2 Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Seagate\Schedule2\schedul2.exe -> [2007/04/19
21:29:44 | 00,411,168 | ---- | M] (Acronis)
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe ->
[2007/10/24 01:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation)
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\guard.exe ->
[2008/03/25 19:48:26 | 00,312,880 | ---- | M] (GRISOFT s.r.o.)
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe -> [2008/11/12
11:59:50 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.)
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe -> [2008/11/12 11:52:56 |
00,049,664 | ---- | M] (GRISOFT, s.r.o.)
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe -> [2008/11/12 11:59:50 |
00,406,528 | ---- | M] (GRISOFT, s.r.o.)
(clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] ->
%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2007/10/24 01:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation)
(FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | On_Demand | Stopped] ->
%SystemRoot%\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -> [2007/10/09 12:58:12 | 00,036,864 | ---- | M] (Microsoft
Corporation)
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\1050\Intel
32\IDriverT.exe -> [2004/10/22 03:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation)
(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v3.0\Windows Communication
Foundation\infocard.exe -> [2007/10/11 09:55:10 | 00,864,256 | ---- | M] (Microsoft Corporation)
(NBService) NBService [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Nero\Nero 7\Nero BackItUp\NBService.exe -> [2007/03/14 19:19:10 |
00,779,824 | ---- | M] (Nero AG)
(NetTcpPortSharing) Net.Tcp Port Sharing Service [Win32_Shared | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v3.0\Windows
Communication Foundation\SMSvcHost.exe -> [2007/10/11 09:55:14 | 00,122,880 | ---- | M] (Microsoft Corporation)
(NMIndexingService) NMIndexingService [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Ahead\Lib\NMIndexingService.exe -> [2007/03/12
13:49:46 | 00,271,920 | ---- | M] (Nero AG)
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Disabled | Stopped] -> %SystemRoot%\system32\nvsvc32.exe -> [2007/09/17 01:07:00 |
00,155,716 | ---- | M] (NVIDIA Corporation)
(UMWdf) Windows User Mode Driver Framework [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\system32\wdfmgr.exe -> [2005/01/28 13:44:28 |
00,038,912 | ---- | M] (Microsoft Corporation)
[Driver Services - Safe List]
(aiptektp) Pen Pad [Kernel | System | Running] -> %SystemRoot%\system32\DRIVERS\aiptektp.sys -> [2006/06/06 09:51:06 | 00,022,528 | ---- | M]
(WALTOP International Corp.)
(ALCXWDM) Service for Realtek AC97 Audio (WDM) [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\ALCXWDM.SYS -> [2005/12/02
14:11:40 | 03,841,856 | ---- | M] (Realtek Semiconductor Corp.)
(AVG Anti-Rootkit) AVG Anti-Rootkit [Kernel | Boot | Running] -> %SystemRoot%\System32\DRIVERS\avgarkt.sys -> [2007/01/31 06:33:46 | 00,005,632
| ---- | M] (GRISOFT, s.r.o.)
(AVG Anti-Spyware Driver) AVG Anti-Spyware Driver [Kernel | System | Running] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\guard.sys ->
[2008/03/25 19:48:24 | 00,011,000 | ---- | M] ()
(Avg7Core) AVG7 Kernel [Kernel | System | Running] -> %SystemRoot%\System32\Drivers\avg7core.sys -> [2008/11/12 11:59:46 | 00,821,856 | ---- |
M] (GRISOFT, s.r.o.)
(Avg7RsW) AVG7 Wrap Driver [Kernel | System | Running] -> %SystemRoot%\System32\Drivers\avg7rsw.sys -> [2008/11/12 11:52:58 | 00,004,224 | ----
| M] (GRISOFT, s.r.o.)
(Avg7RsXP) AVG7 Resident Driver XP [Kernel | System | Running] -> %SystemRoot%\System32\Drivers\avg7rsxp.sys -> [2008/11/12 11:59:46 |
00,027,776 | ---- | M] (GRISOFT, s.r.o.)
(AvgArCln) Avg Anti-Rootkit Clean Driver [Kernel | System | Running] -> %SystemRoot%\System32\DRIVERS\AvgArCln.sys -> [2007/01/18 05:00:28 |
00,003,968 | ---- | M] (GRISOFT, s.r.o.)
(AvgAsCln) AVG Anti-Spyware Clean Driver [Kernel | System | Running] -> %SystemRoot%\System32\DRIVERS\AvgAsCln.sys -> [2006/09/06 00:03:16 |
00,003,968 | ---- | M] (GRISOFT, s.r.o.)
(AvgClean) AVG7 Clean Driver [Kernel | System | Running] -> %SystemRoot%\System32\Drivers\avgclean.sys -> [2008/11/12 11:59:54 | 00,010,760 |
---- | M] (GRISOFT, s.r.o.)
(AvgTdi) AVG Network Redirector [Kernel | Auto | Running] -> %SystemRoot%\System32\Drivers\avgtdi.sys -> [2008/11/12 11:53:00 | 00,004,960 |
---- | M] (GRISOFT, s.r.o.)
(BCMNTIO) BCMNTIO [Kernel | Auto | Running] -> %SystemDrive%\PROGRA~1\CHECKIT\DIAGNO~1\BCMNTIO.sys -> [2004/03/05 17:09:00 | 00,003,744 | ----
| M] ()
(ElbyCDIO) ElbyCDIO Driver [Kernel | System | Running] -> %SystemRoot%\System32\Drivers\ElbyCDIO.sys -> [2007/08/07 12:48:34 | 00,025,160 |
---- | M] (Elaborate Bytes AG)
(ElbyDelay) ElbyDelay [Kernel | On_Demand | Running] -> %SystemRoot%\System32\Drivers\ElbyDelay.sys -> [2007/02/15 17:56:50 | 00,011,984 | ----
| M] (Elaborate Bytes AG)
(gmer) gmer [Kernel | On_Demand | Stopped] -> %SystemRoot%\System32\DRIVERS\gmer.sys -> [2009/01/11 12:25:06 | 00,085,969 | ---- | M] (GMER)
(MAPMEM) MAPMEM [Kernel | Auto | Running] -> %SystemDrive%\PROGRA~1\CHECKIT\DIAGNO~1\MAPMEM.sys -> [2004/03/05 17:09:02 | 00,003,904 | ---- |
M] ()
(nv) nv [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\nv4_mini.sys -> [2007/09/17 01:07:00 | 06,853,088 | ---- | M] (NVIDIA
Corporation)
(NVENETFD) NVIDIA nForce Networking Controller Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\NVENETFD.sys ->
[2006/02/17 11:28:30 | 00,034,176 | ---- | M] (NVIDIA Corporation)
(nvnetbus) NVIDIA Network Bus Enumerator [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\nvnetbus.sys -> [2006/02/17 11:28:32 |
00,013,056 | ---- | M] (NVIDIA Corporation)
(Pnp680r) Silicon Image SiI 0680 Medley Raid Controller [Kernel | Boot | Running] -> %SystemRoot%\system32\DRIVERS\pnp680r.sys -> [2002/05/31
01:35:02 | 00,076,976 | R--- | M] (Silicon Image, Inc)
(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\ptilink.sys -> [2004/08/04 01:00:00 |
00,017,792 | ---- | M] (Parallel Technologies, Inc.)
(Secdrv) Secdrv [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\DRIVERS\secdrv.sys -> [2007/11/13 03:25:54 | 00,020,480 | ---- | M]
(Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
(VClone) VClone [Kernel | System | Running] -> %SystemRoot%\system32\DRIVERS\VClone.sys -> [2007/06/16 14:16:40 | 00,031,616 | ---- | M]
(Elaborate Bytes AG)
[Registry - All]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> ->
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" ->
http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" ->
http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\windows\system32\blank.htm ->
HKEY_LOCAL_MACHINE\: Main\\"Search Page" ->
http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home ->
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKEY_LOCAL_MACHINE\: Search\\"Default_Search_URL" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> ->
HKEY_CURRENT_USER\: Main\\"Default_Search_URL" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\windows\system32\blank.htm ->
HKEY_CURRENT_USER\: Main\\"Page_Transitions" -> ->
HKEY_CURRENT_USER\: Main\\"Search Page" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_CURRENT_USER\: Main\\"Start Page" -> about:blank ->
HKEY_CURRENT_USER\: SearchURL\\"" ->
http://home.microsoft.com/access/autosearch.asp?p=%s ->
HKEY_CURRENT_USER\: SearchURL\\"provider" -> ->
HKEY_CURRENT_USER\: URLSearchHooks\\"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" [HKLM] -> %SystemRoot%\system32\shdocvw.dll [Microsoft Url Search
Hook] -> [2008/10/16 03:37:04 | 01,494,528 | ---- | M] (Microsoft Corporation)
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> ->
HKEY_USERS\.DEFAULT\: Main\\"Search Page" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_USERS\.DEFAULT\: Main\\"Start Page" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome ->
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> ->
HKEY_USERS\S-1-5-18\: Main\\"Search Page" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_USERS\S-1-5-18\: Main\\"Start Page" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome ->
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\] > -> ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: Main\\"Default_Search_URL" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: Main\\"Local Page" -> C:\windows\system32\blank.htm ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: Main\\"Page_Transitions" -> ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: Main\\"Search Page" ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: Main\\"Start Page" -> about:blank ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: SearchURL\\"" ->
http://home.microsoft.com/access/autosearch.asp?p=%s ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: SearchURL\\"provider" -> ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: URLSearchHooks\\"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" [HKLM] ->
%SystemRoot%\system32\shdocvw.dll [Microsoft Url Search Hook] -> [2008/10/16 03:37:04 | 01,494,528 | ---- | M] (Microsoft Corporation)
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\: "ProxyEnable" -> 0 ->
< FireFox Settings [Default Profile] > -> C:\Documents and Settings\Administrator.COMPUTER\Application
Data\Mozilla\FireFox\Profiles\bvvl5608.default\prefs.js ->
browser.search.selectedEngine -> "Google" ->
browser.startup.homepage -> "about:blank" ->
browser.startup.homepage_override.mstone -> "rv:1.8.1.16" ->
< HOSTS File > (290065 bytes and 10041 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts ->
First 25 entries...
127.0.0.1 localhost
127.0.0.1
www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1
www.008k.com
127.0.0.1 008k.com
127.0.0.1
www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1
www.032439.com
127.0.0.1 032439.com
127.0.0.1
www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1
www.1000gratisproben.com
127.0.0.1
www.1001namen.com
127.0.0.1 1001namen.com
127.0.0.1
www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1
www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1
www.10sek.com
127.0.0.1 10sek.com
127.0.0.1
www.1-2005-search.com
127.0.0.1 1-2005-search.com
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} [HKLM] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [Adobe PDF Link Helper] ->
[2008/06/11 22:33:16 | 00,075,128 | ---- | M] (Adobe Systems Incorporated)
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %SystemDrive%\PROGRA~1\SPYBOT~1\SDHelper.dll [Spybot-S&D IE Protection] -> [2008/09/15
14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre6\bin\ssv.dll [Java(tm) Plug-In SSV Helper] -> [2009/01/12 08:26:14 |
00,320,920 | ---- | M] (Sun Microsystems, Inc.)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> %ProgramFiles%\Java\jre6\bin\jp2ssv.dll [Java(tm) Plug-In 2 SSV Helper] -> [2009/01/12
08:26:14 | 00,034,816 | ---- | M] (Sun Microsystems, Inc.)
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ ->
ShellBrowser\\"{01E04581-4EEE-11D0-BFE9-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\browseui.dll [&Address] -> [2008/10/16 03:37:04 |
01,023,488 | ---- | M] (Microsoft Corporation)
ShellBrowser\\"{0E5CBF21-D15F-11D0-8301-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\SHELL32.dll [&Links] -> [2007/10/25 20:36:52 |
08,454,656 | ---- | M] (Microsoft Corporation)
WebBrowser\\"{01E04581-4EEE-11D0-BFE9-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\browseui.dll [&Address] -> [2008/10/16 03:37:04 |
01,023,488 | ---- | M] (Microsoft Corporation)
WebBrowser\\"{0E5CBF21-D15F-11D0-8301-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\SHELL32.dll [&Links] -> [2007/10/25 20:36:52 | 08,454,656
| ---- | M] (Microsoft Corporation)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\Software\Microsoft\Internet Explorer\Toolbar\ ->
ShellBrowser\\"{01E04581-4EEE-11D0-BFE9-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\browseui.dll [&Address] -> [2008/10/16 03:37:04 |
01,023,488 | ---- | M] (Microsoft Corporation)
ShellBrowser\\"{0E5CBF21-D15F-11D0-8301-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\SHELL32.dll [&Links] -> [2007/10/25 20:36:52 |
08,454,656 | ---- | M] (Microsoft Corporation)
WebBrowser\\"{01E04581-4EEE-11D0-BFE9-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\browseui.dll [&Address] -> [2008/10/16 03:37:04 |
01,023,488 | ---- | M] (Microsoft Corporation)
WebBrowser\\"{0E5CBF21-D15F-11D0-8301-00AA005B4383}" [HKLM] -> %SystemRoot%\system32\SHELL32.dll [&Links] -> [2007/10/25 20:36:52 | 08,454,656
| ---- | M] (Microsoft Corporation)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"atwtusb" -> %SystemRoot%\system32\atwtusb.exe [atwtusb.exe] -> [2007/03/20 17:43:50 | 00,315,392 | ---- | M] ()
"AVG7_CC" -> [C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP] -> File not found
"NeroFilterCheck" -> %CommonProgramFiles%\Ahead\Lib\NeroCheck.exe [C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe] -> [2007/03/09
18:53:56 | 00,153,136 | ---- | M] (Nero AG)
"nwiz" -> %SystemRoot%\system32\nwiz.exe [nwiz.exe /install] -> [2007/09/17 01:07:00 | 01,626,112 | ---- | M] ()
"SoundMan" -> %SystemRoot%\SOUNDMAN.EXE [SOUNDMAN.EXE] -> [2005/11/11 14:07:40 | 00,090,112 | ---- | M] (Realtek Semiconductor Corp.)
"Tweak UI" -> %SystemRoot%\system32\TWEAKUI.CPL [RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp] -> [1997/11/08 00:00:00 | 00,087,312 | ---- | M]
(Microsoft Corporation)
< Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"AVG7_Run" -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe [C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE] -> [2008/11/12 11:59:52 |
00,219,136 | ---- | M] (GRISOFT, s.r.o.)
< Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"AVG7_Run" -> %SystemDrive%\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe [C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE] -> [2008/11/12 11:59:52 |
00,219,136 | ---- | M] (GRISOFT, s.r.o.)
< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup ->
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup ->
%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk ->
%CommonProgramFiles%\Adobe\Calibration\Adobe Gamma Loader.exe -> [2000/10/11 18:08:00 | 00,113,664 | ---- | M] (Adobe Systems, Inc.)
< montyl Startup Folder > -> C:\Documents and Settings\montyl\Start Menu\Programs\Startup ->
< Default User.WINDOWS Startup Folder > -> C:\Documents and Settings\Default User.WINDOWS\Start Menu\Programs\Startup ->
< All Users.WINDOWS Startup Folder > -> C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup ->
-> %AllUsersProfile%\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk.disabled -> [2009/01/12 12:31:42 | 00,000,794 | ---- | M] ()
< Administrator.COMPUTER Startup Folder > -> C:\Documents and Settings\Administrator.COMPUTER\Start Menu\Programs\Startup ->
< Software Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer ->
< Software Policy Settings [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Policies\Microsoft\Internet Explorer ->
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveAutoRun" -> [67108863] -> File not found
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDrives" -> [0] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" -> [0] -> File not found
\\"legalnoticecaption" -> [] -> File not found
\\"legalnoticetext" -> [] -> File not found
\\"shutdownwithoutlogon" -> [1] -> File not found
\\"undockwithoutlogon" -> [1] -> File not found
\\"DisableRegistryTools" -> [0] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoLogoff" -> [01 00 00 00 [binary data]] -> File not found
\\"NoRecentDocsMenu" -> [01 00 00 00 [binary data]] -> File not found
\\"NoRecentDocsHistory" -> [01 00 00 00 [binary data]] -> File not found
\\"NoRecentDocsNetHood" -> [01 00 00 00 [binary data]] -> File not found
\\"NoSMMyDocs" -> [01 00 00 00 [binary data]] -> File not found
\\"NoSMMyPictures" -> [01 00 00 00 [binary data]] -> File not found
\\"NoNetworkConnections" -> [01 00 00 00 [binary data]] -> File not found
\\"NoUserNameInStartMenu" -> [01 00 00 00 [binary data]] -> File not found
\\"ForceClassicControlPanel" -> [1] -> File not found
\\"NoDrives" -> [0] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
->
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [323] -> File not found
\\"NoLogoff" -> [01 00 00 00 [binary data]] -> File not found
\\"NoRecentDocsMenu" -> [01 00 00 00 [binary data]] -> File not found
\\"NoRecentDocsHistory" -> [01 00 00 00 [binary data]] -> File not found
\\"NoRecentDocsNetHood" -> [01 00 00 00 [binary data]] -> File not found
\\"NoSMMyDocs" -> [01 00 00 00 [binary data]] -> File not found
\\"NoSMMyPictures" -> [01 00 00 00 [binary data]] -> File not found
\\"NoNetworkConnections" -> [01 00 00 00 [binary data]] -> File not found
\\"NoUserNameInStartMenu" -> [01 00 00 00 [binary data]] -> File not found
\\"ForceClassicControlPanel" -> [1] -> File not found
\\"NoDrives" -> [0] -> File not found
\\"NoDriveAutoRun" -> [67108863] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ ->
Save Flash -> %ProgramFiles%\SWF-Get\Flash Saving Plugin\FlashSButton.dll [res://C:\Program Files\SWF-Get\Flash Saving
Plugin\FlashSButton.dll/210] -> [2005/04/30 14:53:32 | 00,180,224 | ---- | M] (UnH Solutions)
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\Software\Microsoft\Internet Explorer\MenuExt\ ->
Save Flash -> %ProgramFiles%\SWF-Get\Flash Saving Plugin\FlashSButton.dll [res://C:\Program Files\SWF-Get\Flash Saving
Plugin\FlashSButton.dll/210] -> [2005/04/30 14:53:32 | 00,180,224 | ---- | M] (UnH Solutions)
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %SystemDrive%\PROGRA~1\SPYBOT~1\SDHelper.dll [Menu:
Spybot - Search & Destroy Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ ->
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"ButtonText" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"CLSID" [HKLM] -> [{0000031A-0000-0000-C000-000000000046}] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"ClsidExtension" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"Default Visible" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"HotIcon" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"Icon" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value does not exist or could not be read.] -> File not found
CmdMapping\\"{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}" [HKLM] -> [Reg Error: Value does not exist or could not be read.] -> File not found
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %SystemDrive%\PROGRA~1\SPYBOT~1\SDHelper.dll [Spybot - Search & Destroy
Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
< Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value does not exist or could not be read.] -> File not found
< Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value does not exist or could not be read.] -> File not found
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\Software\Microsoft\Internet Explorer\Extensions\ ->
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"ButtonText" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"CLSID" [HKLM] -> [{0000031A-0000-0000-C000-000000000046}] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"ClsidExtension" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"Default Visible" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"HotIcon" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}\\"Icon" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value does not exist or could not be read.] -> File not found
CmdMapping\\"{43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA}" [HKLM] -> [Reg Error: Value does not exist or could not be read.] -> File not found
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %SystemDrive%\PROGRA~1\SPYBOT~1\SDHelper.dll [Spybot - Search & Destroy
Configuration] -> [2008/09/15 14:25:44 | 01,562,960 | RHS- | M] (Safer Networking Limited)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> [Reg Error: Key does not exist or could not be opened.] -> File not found
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ ->
PluginsPageFriendlyName -> Microsoft ActiveX Gallery ->
PluginsPage ->
http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s ->
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
5248 domain(s) found. ->
50 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Ranges\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77 range(s) found. ->
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 7832 domain(s) found. ->
55 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 5254 domain(s) found. ->
49 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Ranges\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 5254 domain(s) found. ->
49 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 4107 domain(s) found. ->
32 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 4107 domain(s) found. ->
32 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
7832 domain(s) found. ->
55 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\] > ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-21-1454471165-1979792683-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 77
range(s) found. ->
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} [HKLM] -> http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab [CKAVWebScan Object] ->
{6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] ->
http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1206762645578 [WUWebControl Class] ->
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab [Java Plug-in 1.6.0_11] ->
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab [Java Plug-in 1.6.0_11] ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab [Java Plug-in 1.6.0_11] ->
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab [Shockwave Flash Object]
->
IE Styles -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell ->
Explorer.exe -> %SystemRoot%\Explorer.exe -> [2007/06/13 03:23:08 | 01,033,216 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit ->
C:\WINDOWS\system32\userinit.exe -> %SystemRoot%\system32\userinit.exe -> [2004/08/04 01:00:00 | 00,024,576 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
*UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost ->
logonui.exe -> %SystemRoot%\system32\logonui.exe -> [2004/08/04 01:00:00 | 00,514,560 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->
rundll32 shell32 -> %SystemRoot%\System32\shell32.dll -> [2007/10/25 20:36:52 | 08,454,656 | ---- | M] (Microsoft Corporation)
Control_RunDLL "sysdm.cpl" -> %SystemRoot%\system32\sysdm.cpl -> [2004/08/04 01:00:00 | 00,298,496 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
crypt32chain -> %SystemRoot%\system32\crypt32.dll -> [2004/08/04 01:00:00 | 00,597,504 | ---- | M] (Microsoft Corporation)
cryptnet -> %SystemRoot%\system32\cryptnet.dll -> [2004/08/04 01:00:00 | 00,063,488 | ---- | M] (Microsoft Corporation)
cscdll -> %SystemRoot%\system32\cscdll.dll -> [2004/08/04 01:00:00 | 00,101,888 | ---- | M] (Microsoft Corporation)
ScCertProp -> %SystemRoot%\system32\wlnotify.dll -> [2004/08/04 01:00:00 | 00,092,672 | ---- | M] (Microsoft Corporation)
Schedule -> %SystemRoot%\system32\wlnotify.dll -> [2004/08/04 01:00:00 | 00,092,672 | ---- | M] (Microsoft Corporation)
sclgntfy -> %SystemRoot%\system32\sclgntfy.dll -> [2004/08/04 01:00:00 | 00,020,992 | ---- | M] (Microsoft Corporation)
SensLogn -> %SystemRoot%\system32\WlNotify.dll -> [2004/08/04 01:00:00 | 00,092,672 | ---- | M] (Microsoft Corporation)
termsrv -> %SystemRoot%\system32\wlnotify.dll -> [2004/08/04 01:00:00 | 00,092,672 | ---- | M] (Microsoft Corporation)
WgaLogon -> %SystemRoot%\system32\WgaLogon.dll -> [2007/04/10 14:00:46 | 00,236,928 | ---- | M] (Microsoft Corporation)
wlballoon -> %SystemRoot%\system32\wlnotify.dll -> [2004/08/04 01:00:00 | 00,092,672 | ---- | M] (Microsoft Corporation)
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad ->
"{fbeb8a05-beee-4442-804e-409d6c4515e9}" [HKLM] -> %SystemRoot%\system32\SHELL32.dll [CDBurn] -> [2007/10/25 20:36:52 | 08,454,656 | ---- | M]
(Microsoft Corporation)
"{7849596a-48ea-486e-8937-a2a3009f31a9}" [HKLM] -> %SystemRoot%\system32\SHELL32.dll [PostBootReminder] -> [2007/10/25 20:36:52 | 08,454,656 |
---- | M] (Microsoft Corporation)
"{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKLM] -> %SystemRoot%\system32\stobject.dll [SysTray] -> [2004/08/04 01:00:00 | 00,121,856 | ---- |
M] (Microsoft Corporation)
"{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKLM] -> %SystemRoot%\system32\upnpui.dll [UPnPMonitor] -> [2004/08/04 01:00:00 | 00,239,616 | ---- |
M] (Microsoft Corporation)
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> %SystemRoot%\system32\webcheck.dll [WebCheck] -> [2004/08/04 01:00:00 | 00,276,480 | ---- |
M] (Microsoft Corporation)
< SharedTaskScheduler [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler ->
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}" [HKLM] -> %SystemRoot%\system32\browseui.dll [Browseui preloader] -> [2008/10/16 03:37:04 | 01,023,488
| ---- | M] (Microsoft Corporation)
"{8C7461EF-2B13-11d2-BE35-3078302C2030}" [HKLM] -> %SystemRoot%\system32\browseui.dll [Component Categories cache daemon] -> [2008/10/16
03:37:04 | 01,023,488 | ---- | M] (Microsoft Corporation)
< IFEO [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ ->
Your Image File Name Here without a path -> %SystemRoot%\System32\ntsd.exe [Debugger] -> [2004/08/04 01:00:00 | 00,031,744 | ---- | M]
(Microsoft Corporation)
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks ->
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" [HKLM] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] ->
[2008/03/25 19:48:24 | 00,079,408 | ---- | M] (GRISOFT s.r.o.)
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}" [HKLM] -> %SystemRoot%\system32\shell32.dll [] -> [2007/10/25 20:36:52 | 08,454,656 | ---- | M]
(Microsoft Corporation)
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->
*SecurityProviders* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->
msapsspc.dll -> %SystemRoot%\system32\msapsspc.dll -> [2004/08/04 01:00:00 | 00,086,016 | ---- | M] (Microsoft Corporation)
schannel.dll -> %SystemRoot%\system32\schannel.dll -> [2007/04/25 07:21:16 | 00,144,896 | ---- | M] (Microsoft Corporation)
digest.dll -> %SystemRoot%\system32\digest.dll -> [2004/08/04 01:00:00 | 00,068,608 | ---- | M] (Microsoft Corporation)
msnsspc.dll -> %SystemRoot%\system32\msnsspc.dll -> [2004/08/04 01:00:00 | 00,290,816 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
< LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages ->
*LSA Authentication Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages ->
msv1_0 -> %SystemRoot%\System32\msv1_0.dll -> [2004/08/04 01:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
< LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages ->
*LSA Security Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages ->
kerberos -> %SystemRoot%\System32\kerberos.dll -> [2005/06/15 10:49:30 | 00,295,936 | ---- | M] (Microsoft Corporation)
msv1_0 -> %SystemRoot%\System32\msv1_0.dll -> [2004/08/04 01:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation)
schannel -> %SystemRoot%\System32\schannel.dll -> [2007/04/25 07:21:16 | 00,144,896 | ---- | M] (Microsoft Corporation)
wdigest -> %SystemRoot%\System32\wdigest.dll -> [2004/08/04 01:00:00 | 00,049,152 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
< Domain Profile Authorized Applications List > ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List ->
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled
xpsp2res.dll,-22019] ->
[2004/08/04 01:00:00 | 00,140,800 | ---- | M] (Microsoft Corporation)
< Standard Profile Authorized Applications List > ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ->
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019] ->
[2004/08/04 01:00:00 | 00,140,800 | ---- | M] (Microsoft Corporation)
"C:\Program Files\Grisoft\AVG Free\avgamsvr.exe" -> C:\Program Files\Grisoft\AVG Free\avgamsvr.exe [C:\Program Files\Grisoft\AVG
Free\avgamsvr.exe:*:Enabled:avgamsvr.exe] -> [2008/11/12 11:59:50 | 00,418,816 | ---- | M] (GRISOFT, s.r.o.)
"C:\Program Files\Grisoft\AVG Free\avgcc.exe" -> C:\Program Files\Grisoft\AVG Free\avgcc.exe [C:\Program Files\Grisoft\AVG
Free\avgcc.exe:*:Enabled:avgcc.exe] -> [2008/11/12 12:08:54 | 00,590,848 | ---- | M] (GRISOFT, s.r.o.)
"C:\Program Files\Grisoft\AVG Free\avgemc.exe" -> C:\Program Files\Grisoft\AVG Free\avgemc.exe [C:\Program Files\Grisoft\AVG
Free\avgemc.exe:*:Enabled:avgemc.exe] -> [2008/11/12 11:59:50 | 00,406,528 | ---- | M] (GRISOFT, s.r.o.)
"C:\Program Files\Grisoft\AVG Free\avginet.exe" -> C:\Program Files\Grisoft\AVG Free\avginet.exe [C:\Program Files\Grisoft\AVG
Free\avginet.exe:*:Enabled:avginet.exe] -> [2008/11/12 12:08:56 | 00,514,560 | ---- | M] (GRISOFT, s.r.o.)
"C:\Program Files\uTorrent\uTorrent.exe" -> C:\Program Files\uTorrent\uTorrent.exe [C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent]
-> [2009/01/14 04:20:16 | 00,270,128 | ---- | M] (BitTorrent, Inc.)
"C:\WINDOWS\System32\mmc.exe" -> C:\WINDOWS\System32\mmc.exe [C:\WINDOWS\System32\mmc.exe:*
isabled:Microsoft Management Console] ->
[2004/08/04 01:00:00 | 00,815,104 | ---- | M] (Microsoft Corporation)
"C:\WINDOWS\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [C:\WINDOWS\system32\sessmgr.exe:*isabledxpsp2res.dll,-22019] ->
[2004/08/04 01:00:00 | 00,140,800 | ---- | M] (Microsoft Corporation)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot ->
"AlternateShell" -> cmd.exe ->
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 ->
"DisplayName" -> CD-ROM Driver ->
"ImagePath" -> %SystemRoot%\system32\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2004/08/04 01:00:00 | 00,049,536 | ---- | M] (Microsoft
Corporation)
< Drives with AutoRun files > -> ->
C:\AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ FAT32 ] -> [2007/10/23 00:49:12 | 00,000,000 | ---- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ->
Log too long for 1 reply
, on 1/11/2009