voici le rapport OTscan
et merci d'avance
OTScanIt logfile created on: 10/06/2008 18:34:28
OTScanIt by OldTimer - Version 1.0.15.12 Folder =
C:\Documents and Settings\Nolwenn\Desktop\OTScanIt
Windows XP Media Center Edition Service Pack 2 (Version
= 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 0000040C | Country: France | Language: FRA |
Date Format: dd/MM/yyyy
511,48 Mb Total Physical Memory | 261,74 Mb Available
Physical Memory | 51,17% Memory free
1,22 Gb Paging File | 0,87 Gb Available in Paging File |
71,71% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS |
%ProgramFiles% = C:\Program Files
Drive C: | 76,32 Gb Total Space | 12,40 Gb Free Space |
16,24% Space Free | Partition Type: NTFS
Drive D: | 1002,05 Mb Total Space | 0,00 Mb Free Space |
0,00% Space Free | Partition Type: UDF
Unable to calculate disk information.
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: NOL
Current User Name: Nolwenn
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
[Processes - Non-Microsoft Only]
aswupdsv.exe -> %ProgramFiles%\Alwil
Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 17272 bytes | Modified Date =
16/05/2008 01:06:57 | Attr = ]
ashserv.exe -> %ProgramFiles%\Alwil
Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 144760 bytes | Modified Date =
16/05/2008 01:19:24 | Attr = ]
sched.exe -> %ProgramFiles%\Avira\AntiVir
PersonalEdition Classic\sched.exe -> Avira GmbH [Ver =
8.00.00.12 | Size = 68865 bytes | Modified Date =
07/03/2008 12:00:08 | Attr = ]
ashdisp.exe -> %ProgramFiles%\Alwil
Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 79224 bytes | Modified Date =
16/05/2008 01:19:31 | Attr = ]
wfwiz.exe -> %ProgramFiles%\WinFast\WFTVFM\WFWIZ.exe ->
Leadtek Research Inc. [Ver = 5.13.01.2003-1.67 | Size =
159744 bytes | Modified Date = 25/02/2004 10:23:28 |
Attr = ]
soundman.exe -> %SystemRoot%\soundman.exe -> Realtek
Semiconductor Corp. [Ver = 5, 1, 0, 58 | Size = 577536
bytes | Modified Date = 17/11/2006 05:42:52 | Attr = R
]
wkufind.exe -> %CommonProgramFiles%\Microsoft
Shared\Works Shared\WkUFind.exe -> Microsoft®
Corporation [Ver = 7.00.0724.0 | Size = 28672 bytes |
Modified Date = 24/07/2002 21:20:02 | Attr = ]
avgnt.exe -> %ProgramFiles%\Avira\AntiVir
PersonalEdition Classic\avgnt.exe -> Avira GmbH [Ver =
8.00.00.07 | Size = 262401 bytes | Modified Date =
12/02/2008 10:06:50 | Attr = ]
nmbgmonitor.exe ->
%CommonProgramFiles%\Ahead\Lib\NMBgMonitor.exe -> Nero
AG [Ver = 1, 2, 0, 6 | Size = 94208 bytes | Modified
Date = 21/04/2006 17:03:34 | Attr = ]
googletoolbarnotifier.exe ->
%ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolba
rNotifier.exe -> Google Inc. [Ver = 2, 0, 301, 1654 |
Size = 68856 bytes | Modified Date = 21/09/2007 18:11:33
| Attr = ]
teatimer.exe -> %ProgramFiles%\Spybot - Search &
Destroy\TeaTimer.exe -> Safer Networking Limited [Ver =
1, 5, 2, 16 | Size = 2097488 bytes | Modified Date =
28/01/2008 11:43:40 | Attr = RHS]
magicdisc.exe -> %ProgramFiles%\MagicDisc\MagicDisc.exe
-> [Ver = | Size = 534016 bytes | Modified Date =
26/09/2006 09:59:14 | Attr = ]
avguard.exe -> %ProgramFiles%\Avira\AntiVir
PersonalEdition Classic\avguard.exe -> Avira GmbH [Ver =
8.00.01.18 | Size = 147201 bytes | Modified Date =
10/06/2008 18:17:51 | Attr = ]
otscanit.exe ->
%UserProfile%\Desktop\OTScanIt\OTScanIt.exe -> OldTimer
Tools [Ver = 1.0.15.12 | Size = 397312 bytes | Modified
Date = 07/06/2008 11:09:00 | Attr = ]
[Win32 Services - Non-Microsoft Only]
(AntiVirScheduler) Avira AntiVir Personal – Free
Antivirus Scheduler [Win32_Own | Auto | Running] ->
%ProgramFiles%\Avira\AntiVir PersonalEdition
Classic\sched.exe -> Avira GmbH [Ver = 8.00.00.12 | Size
= 68865 bytes | Modified Date = 07/03/2008 12:00:08 |
Attr = ]
(AntiVirService) Avira AntiVir Personal – Free Antivirus
Guard [Win32_Own | Auto | Running] ->
%ProgramFiles%\Avira\AntiVir PersonalEdition
Classic\avguard.exe -> Avira GmbH [Ver = 8.00.01.18 |
Size = 147201 bytes | Modified Date = 10/06/2008
18:17:51 | Attr = ]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own |
Auto | Running] -> %ProgramFiles%\Alwil
Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 17272 bytes | Modified Date =
16/05/2008 01:06:57 | Attr = ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto |
Running] -> %ProgramFiles%\Alwil
Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 144760 bytes | Modified Date =
16/05/2008 01:19:24 | Attr = ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own |
On_Demand | Stopped] -> %ProgramFiles%\Alwil
Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 247160 bytes | Modified Date =
16/05/2008 01:19:00 | Attr = ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own |
On_Demand | Stopped] -> %ProgramFiles%\Alwil
Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4,
8, 1201, 0 | Size = 349560 bytes | Modified Date =
16/05/2008 01:16:59 | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service
[Win32_Shared | On_Demand | Stopped] ->
%SystemRoot%\system32\dmadmin.exe -> Microsoft Corp.,
Veritas Software [Ver = 2600.2180.503.0 | Size = 224768
bytes | Modified Date = 02/12/2004 11:00:00 | Attr =
]
(gusvc) Google Updater Service [Win32_Own | On_Demand |
Stopped] -> %ProgramFiles%\Google\Common\Google
Updater\GoogleUpdaterService.exe -> Google [Ver =
2.0.734.29932.beta | Size = 138168 bytes | Modified Date
= 17/09/2007 20:58:17 | Attr = ]
(IDriverT) InstallDriver Table Manager [Win32_Own |
On_Demand | Stopped] ->
%CommonProgramFiles%\InstallShield\Driver\1150\Intel
32\IDriverT.exe -> Macrovision Corporation [Ver =
11.50.42618 | Size = 69632 bytes | Modified Date =
14/11/2005 01:06:04 | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto
| Stopped] -> %SystemRoot%\system32\nvsvc32.exe ->
NVIDIA Corporation [Ver = 6.14.10.5306 | Size = 77824
bytes | Modified Date = 11/12/2003 13:10:00 | Attr =
]
[Registry - Non-Microsoft Only]
< Run [HKEY_LOCAL_MACHINE\] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Run ->
avast! -> %ProgramFiles%\Alwil
Software\Avast4\ashDisp.exe
[C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] -> ALWIL
Software [Ver = 4, 8, 1201, 0 | Size = 79224 bytes |
Modified Date = 16/05/2008 01:19:31 | Attr = ]
avgnt -> %ProgramFiles%\Avira\AntiVir PersonalEdition
Classic\avgnt.exe ["C:\Program Files\Avira\AntiVir
PersonalEdition Classic\avgnt.exe" /min] -> Avira GmbH
[Ver = 8.00.00.07 | Size = 262401 bytes | Modified Date
= 12/02/2008 10:06:50 | Attr = ]
BMab83a148 -> %SystemRoot%\system32\jcxqfpki.DLL
[Rundll32.exe "C:\WINDOWS\system32\jcxqfpki.dll",s] ->
File not found
Microsoft Works Update Detection ->
%CommonProgramFiles%\Microsoft Shared\Works
Shared\WkUFind.exe [C:\Program Files\Common
Files\Microsoft Shared\Works Shared\WkUFind.exe] ->
Microsoft® Corporation [Ver = 7.00.0724.0 | Size = 28672
bytes | Modified Date = 24/07/2002 21:20:02 | Attr =
]
NeroFilterCheck ->
%CommonProgramFiles%\Ahead\Lib\NeroCheck.exe [C:\Program
Files\Common Files\Ahead\Lib\NeroCheck.exe] -> Nero AG
[Ver = 1, 0, 0, 5 | Size = 155648 bytes | Modified Date
= 12/01/2006 16:40:44 | Attr = ]
NvCplDaemon -> %SystemRoot%\system32\nvcpl.dll
[RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup]
-> NVIDIA Corporation [Ver = 6.14.10.5306 | Size =
3022848 bytes | Modified Date = 11/12/2003 13:10:00 |
Attr = ]
nwiz -> %SystemRoot%\system32\nwiz.exe [nwiz.exe
/install] -> NVIDIA Corporation [Ver = 6.14.10.5306 |
Size = 753664 bytes | Modified Date = 11/12/2003
13:10:00 | Attr = ]
PinnacleDriverCheck ->
%SystemRoot%\system32\PSDrvCheck.exe
[C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg] -> [Ver
= 1.0.0.63 | Size = 406016 bytes | Modified Date =
10/03/2004 15:26:10 | Attr = ]
QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe
["C:\Program Files\QuickTime\qttask.exe" -atboottime] ->
Apple Computer, Inc. [Ver = 6.4 | Size = 77824 bytes |
Modified Date = 27/08/2007 16:25:49 | Attr = ]
Sony Ericsson PC Suite -> %ProgramFiles%\Sony
Ericsson\Mobile2\Application Launcher\Application
Launcher.exe ["C:\Program Files\Sony
Ericsson\Mobile2\Application Launcher\Application
Launcher.exe" /startoptions] -> [Ver = 2.0.10.129 |
Size = 593920 bytes | Modified Date = 28/03/2007
01:07:42 | Attr = R ]
SoundMan -> %SystemRoot%\soundman.exe [SOUNDMAN.EXE] ->
Realtek Semiconductor Corp. [Ver = 5, 1, 0, 58 | Size =
577536 bytes | Modified Date = 17/11/2006 05:42:52 |
Attr = R ]
SpybotSnD -> %ProgramFiles%\Spybot - Search &
Destroy\SpybotSD.exe ["C:\Program Files\Spybot - Search
& Destroy\SpybotSD.exe"] -> Safer Networking Limited
[Ver = 1, 5, 2, 20 | Size = 5146448 bytes | Modified
Date = 28/01/2008 11:43:36 | Attr = RHS]
WinFast Schedule ->
%ProgramFiles%\WinFast\WFTVFM\WFWIZ.exe [C:\Program
Files\WinFast\WFTVFM\WFWIZ.exe] -> Leadtek Research Inc.
[Ver = 5.13.01.2003-1.67 | Size = 159744 bytes |
Modified Date = 25/02/2004 10:23:28 | Attr = ]
< RunOnceEx [HKEY_LOCAL_MACHINE\] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\RunOnceEx ->
Flag -> [] -> File not found
< Run [HKEY_CURRENT_USER\] > ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run ->
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} ->
%CommonProgramFiles%\Ahead\Lib\NMBgMonitor.exe
["C:\Program Files\Common
Files\Ahead\Lib\NMBgMonitor.exe"] -> Nero AG [Ver = 1,
2, 0, 6 | Size = 94208 bytes | Modified Date =
21/04/2006 17:03:34 | Attr = ]
NvMediaCenter -> %SystemRoot%\system32\nvmctray.dll
[RUNDLL32.EXE
C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit] ->
NVIDIA Corporation [Ver = 6.14.10.5306 | Size = 49152
bytes | Modified Date = 11/12/2003 13:10:00 | Attr =
]
SpybotSD TeaTimer -> %ProgramFiles%\Spybot - Search &
Destroy\TeaTimer.exe [C:\Program Files\Spybot - Search &
Destroy\TeaTimer.exe] -> Safer Networking Limited [Ver =
1, 5, 2, 16 | Size = 2097488 bytes | Modified Date =
28/01/2008 11:43:40 | Attr = RHS]
swg ->
%ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolba
rNotifier.exe [C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier
.exe] -> Google Inc. [Ver = 2, 0, 301, 1654 | Size =
68856 bytes | Modified Date = 21/09/2007 18:11:33 | Attr
= ]
WebSUpdater -> %ProgramFiles%\winvi\wupda.exe
["C:\Program Files\winvi\wupda.exe" /background] -> File
not found
WinUpdater -> %ProgramFiles%\winvi\update.exe
["C:\Program Files\winvi\update.exe" /background] ->
File not found
< All Users Startup Folder > -> C:\Documents and
Settings\All Users\Start Menu\Programs\Startup ->
< Nolwenn Startup Folder > -> C:\Documents and
Settings\Nolwenn\Start Menu\Programs\Startup ->
%UserProfile%\Start Menu\Programs\Startup\MagicDisc.lnk
-> %ProgramFiles%\MagicDisc\MagicDisc.exe -> [Ver = |
Size = 534016 bytes | Modified Date = 26/09/2006
09:59:14 | Attr = ]
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Explorer\ShellExecuteHooks ->
{F9DF827A-8FA7-48A3-B268-CA4DB563EA40}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\awTmNgdc.dll [] -> [Ver = | Size
= 52736 bytes | Modified Date = 11/05/2008 19:17:45 |
Attr = ]
< SecurityProviders [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secu
rityProviders\\SecurityProviders ->
< Winlogon settings [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_CURRENT_USER] > ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon ->
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\ ->
awTmNgdc -> %SystemRoot%\system32\awTmNgdc.dll -> [Ver
= | Size = 52736 bytes | Modified Date = 11/05/2008
19:17:45 | Attr = ]
< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] >
->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ActiveDesktop\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ActiveDesktop\\NoAddingComponents -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ActiveDesktop\\NoDeletingComponents -> 0
->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ActiveDesktop\\NoEditingComponents -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ActiveDesktop\\NoChangingWallpaper -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\ActiveDesktop\\NoActiveDesktopChanges -> 1
->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90A
B50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8E
F6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728
E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\shutdownwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\undockwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\InstallVisualStyle ->
%SystemRoot%\Resources\Themes\Royale\Royale.mss
[C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles] ->
File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\policies\system\\InstallTheme ->
%SystemRoot%\Resources\Themes\Royale.the
[C:\WINDOWS\Resources\Themes\Royale.theme] -> File not
found
< CurrentVersion Policy Settings [HKEY_CURRENT_USER] >
->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\ActiveDesktop\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\ActiveDesktop\\NoAddingComponents -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\ActiveDesktop\\NoEditingComponents -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\ActiveDesktop\\NoChangingWallpaper -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\policies\Explorer\\ForceActiveDesktopOn -> 0 ->
< CDROM Autorun Settings >
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cd
rom] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\ -> ->
*DependOnGroup* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\DependOnGroup ->
SCSI miniport -> -> File not found
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\Group -> SCSI CDROM Class ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\Start -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\Tag -> 2 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\Type -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\DisplayName -> CD-ROM Driver ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\ImagePath -> %SystemRoot%\system32\drivers\cdrom.sys
[system32\DRIVERS\cdrom.sys] -> Microsoft Corporation
[Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size =
49536 bytes | Modified Date = 02/12/2004 11:00:00 | Attr
= ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\AutoRun -> 1 ->
*AutoRunAlwaysDisable* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\\AutoRunAlwaysDisable ->
NEC MBR-7 -> -> File not found
NEC MBR-7.4 -> -> File not found
PIONEER CHANGR DRM-1804X -> -> File not found
PIONEER CD-ROM DRM-6324X -> -> File not found
PIONEER CD-ROM DRM-624X -> -> File not found
TORiSAN CD-ROM CDR_C36 -> -> File not found
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\Enum\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\Enum\\0 ->
IDE\CdRom_NEC_DVD_RW_ND-2510A____________________2.15___
_\5&1ba9decb&0&0.0.0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\Enum\\Count -> 3 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\Enum\\NextInstance -> 3 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\Enum\\1 ->
IDE\CdRomSAMSUNG_CD-ROM_SC-152G__________________C401___
_\5&1ba9decb&0&0.1.0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdr
om\Enum\\2 ->
SCSI\CdRom&Ven_MagicISO&Prod_Virtual_DVD-ROM&Rev_1.0A\1&
2afd7d61&0&0000 ->
< Drives - Autoruns > -> ->
AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ]
-> [Ver = | Size = 0 bytes | Modified Date =
19/08/2007 00:29:33 | Attr = ]
< HOSTS File > (238945 bytes) ->
C:\WINDOWS\System32\drivers\etc\Hosts ->
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > ->
->
HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&a
r=msnhome ->
HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL ->
http://www.google.com/ie ->
HKEY_LOCAL_MACHINE\: Main\\Local Page ->
%SystemRoot%\system32\blank.htm ->
HKEY_LOCAL_MACHINE\: Main\\Search Page ->
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesea
rch ->
HKEY_LOCAL_MACHINE\: Main\\Start Page ->
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&c
lcid={SUB_CLSID}&pver={SUB_PVER}&ar=home ->
HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch ->
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust
.htm ->
HKEY_LOCAL_MACHINE\: Search\\Default_Search_URL ->
http://www.google.com/ie ->
HKEY_LOCAL_MACHINE\: Search\\SearchAssistant ->
http://www.google.com/ie ->
< Internet Explorer Settings [HKEY_CURRENT_USER\] > ->
->
HKEY_CURRENT_USER\: Main\\Local Page ->
C:\WINDOWS\system32\blank.htm ->
HKEY_CURRENT_USER\: Main\\Search Bar ->
http://www.google.com/ie ->
HKEY_CURRENT_USER\: Main\\Search Page ->
http://www.google.com ->
HKEY_CURRENT_USER\: Main\\Start Page ->
http://www.google.fr/ ->
HKEY_CURRENT_USER\: Search\\SearchAssistant ->
http://www.google.com/ie ->
HKEY_CURRENT_USER\: SearchURL\\ ->
http://www.google.com/search?q=%s[gogl] ->
HKEY_CURRENT_USER\: ProxyEnable -> 0 ->
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Internet Settings\ZoneMap\Domains\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Internet Settings\ZoneMap\Domains\ -> [Key] 4423
domain(s) found. ->
33 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77
range(s) found. ->
< Trusted Sites Domains [HKEY_CURRENT_USER\] > ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Internet Settings\ZoneMap\Domains\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Internet Settings\ZoneMap\Domains\ -> [Key] 4422
domain(s) found. ->
32 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77
range(s) found. ->
< BHO's [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer
sion\Explorer\Browser Helper Objects\ ->
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
[HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Adobe\Acrobat
5.0\Reader\ActiveX\AcroIEHelper.ocx [AcroIEHlprObj
Class] -> [Ver = 1, 0, 0, 1 | Size = 37808 bytes |
Modified Date = 02/03/2001 12:02:04 | Attr = ]
{2166923B-DC40-4FDD-B8D5-56D16C2BAF3E}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\qOifeefd.dll [Reg Error: Value
does not exist or could not be read.] -> File not found
{3DAEA73C-010A-4580-B8A4-2512DC5E6770}
[HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or
could not be opened. [Reg Error: Key does not exist or
could not be opened.] -> File not found
{43772ae3-ea6e-42c6-9adb-10527b90cfd7}
[HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or
could not be opened. [Reg Error: Key does not exist or
could not be opened.] -> File not found
{53707962-6F74-2D53-2644-206D7942484F}
[HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search &
Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> Safer
Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256
bytes | Modified Date = 28/01/2008 11:43:28 | Attr =
]
{76489CEC-C772-49E4-94F2-2272D2008678}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\hgGwVlIY.dll [Reg Error: Value
does not exist or could not be read.] -> File not found
{7E200256-73B9-44A0-859F-C60E90CD58BD}
[HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or
could not be opened. [Reg Error: Key does not exist or
could not be opened.] -> File not found
{A585C407-ADDA-4F25-872B-2174E507CFA2}
[HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or
could not be opened. [Reg Error: Key does not exist or
could not be opened.] -> File not found
{AA58ED58-01DD-4d91-8333-CF10577473F7}
[HKEY_LOCAL_MACHINE] ->
%ProgramFiles%\Google\GoogleToolbar1.dll [Google Toolbar
Helper] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size =
2436160 bytes | Modified Date = 17/09/2007 20:58:16 |
Attr = R ]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
[HKEY_LOCAL_MACHINE] ->
%ProgramFiles%\Google\GoogleToolbarNotifier\2.0.301.7164
\swg.dll [Google Toolbar Notifier BHO] -> Google Inc.
[Ver = 2, 0, 301, 7164 | Size = 325048 bytes | Modified
Date = 21/09/2007 18:11:32 | Attr = ]
{c1a48912-69af-459e-b2cd-7e16c2be70b9}
[HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or
could not be opened. [Reg Error: Key does not exist or
could not be opened.] -> File not found
{E2AD6BDE-E3E5-4905-A79B-36BFF8CEF6AE}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\pmnmjGYo.dll [Reg Error: Value
does not exist or could not be read.] -> File not found
{E8A26038-AAB8-4080-B64E-9F46C84EE2E7}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\byXOhGYS.dll [Reg Error: Value
does not exist or could not be read.] -> File not found
{F0F34798-63D1-4BFD-9E2C-9324ABA97D35}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\rqRJYroO.dll [Reg Error: Value
does not exist or could not be read.] -> File not found
{F8F9FEDB-B70C-4420-9E06-3A4AED22CA83}
[HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or
could not be opened. [Reg Error: Key does not exist or
could not be opened.] -> File not found
{F9DF827A-8FA7-48A3-B268-CA4DB563EA40}
[HKEY_LOCAL_MACHINE] ->
%SystemRoot%\system32\awTmNgdc.dll [Reg Error: Value
does not exist or could not be read.] -> [Ver = | Size
= 52736 bytes | Modified Date = 11/05/2008 19:17:45 |
Attr = ]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\ToolBar ->
{2318C2B1-4965-11d4-9B18-009027A5CD4F}
[HKEY_LOCAL_MACHINE] ->
%ProgramFiles%\Google\GoogleToolbar1.dll [&Google] ->
Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2436160
bytes | Modified Date = 17/09/2007 20:58:16 | Attr = R
]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > ->
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Toolbar\ ->
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
[HKEY_LOCAL_MACHINE] ->
%ProgramFiles%\Google\GoogleToolbar1.dll [&Google] ->
Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2436160
bytes | Modified Date = 17/09/2007 20:58:16 | Attr = R
]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Extensions\ ->
{85d1f590-48f4-11d9-9669-0800200c9a66}:Exec ->
%SystemRoot%\bdoscandel.exe [Uninstall BitDefender
Online Scanner v8] -> [Ver = | Size = 53248 bytes |
Modified Date = 25/05/2006 01:22:06 | Attr = ]
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D
53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] ->
%ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll
[Spybot - Search & Destroy Configuration] -> Safer
Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256
bytes | Modified Date = 28/01/2008 11:43:28 | Attr =
]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > ->
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Extensions\ ->
CmdMapping\\{85d1f590-48f4-11d9-9669-0800200c9a66}
[HKEY_LOCAL_MACHINE] -> %SystemRoot%\bdoscandel.exe
[Uninstall BitDefender Online Scanner v8] -> [Ver = |
Size = 53248 bytes | Modified Date = 25/05/2006 01:22:06
| Attr = ]
CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}
[HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search &
Destroy\SDHelper.dll [Spybot - Search & Destroy
Configuration] -> Safer Networking Limited [Ver = 1, 5,
0, 11 | Size = 1554256 bytes | Modified Date =
28/01/2008 11:43:28 | Attr = ]
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Plugins\ ->
PluginsPageFriendlyName -> Microsoft ActiveX Gallery ->
PluginsPage ->
http://activex.microsoft.com/controls/find.asp?ext=%s&mi
me=%s ->
< User Agent Post Platform [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\Internet Settings\User Agent\Post Platform ->
SV1 -> ->
< DNS Name Servers [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcp
ip\Parameters\Adapters\ ->
{3C7F8D70-5ECF-4187-B1BB-C5F6375ABC13} -> (VIA
Compatable Fast Ethernet Adapter) ->
{81021D37-AF9F-4DDD-9218-0E130A5FEE0C} -> () ->
< Protocol Handlers [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
->
ipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
msdaipp: [HKEY_LOCAL_MACHINE] -> No CLSID value
< Downloaded Program Files > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store
Database\Distribution Units\ ->
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75}[HKEY_LOCAL_MACHIN
E] -> [Reg Error: Key does not exist or could not be
opened.] ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}[HKEY_LOCAL_MACHIN
E] ->
http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab[BDSCA
NONLINE Control] ->
{D27CDB6E-AE6D-11CF-96B8-444553540000}[HKEY_LOCAL_MACHIN
E] ->
http://download.macromedia.com/pub/shockwave/cabs/flash/
swflash.cab[Shockwave Flash Object] ->
< Module Usage Keys [HKEY_LOCAL_MACHINE] > ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/bdoscandel.exe\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/bdoscandel.exe\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/bdoscandel.exe\\{5D86DDB5-BD
F9-441B-9E9E-D4730F4EE499} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/bdoscandellang.ini\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/bdoscandellang.ini\\.Owner
-> {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/bdoscandellang.ini\\{5D86DDB
5-BDF9-441B-9E9E-D4730F4EE499} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/bdcore.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/bdcore.dll\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/bdcore.dll\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/bdupd.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/bdupd.dll\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/bdupd.dll\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/ipsupd.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/ipsupd.dll\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/ipsupd.dll\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/lang.ini\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/lang.ini\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/lang.ini\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/libfn.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/libfn.dll\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/libfn.dll\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/live.ini\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/live.ini\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/live.ini\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/oscan8.ocx\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/oscan8.ocx\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/oscan8.ocx\\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/scanoptions.tsi\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/scanoptions.tsi\\.Owner ->
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVer
sion\ModuleUsage\C:/WINDOWS/Downloaded Program
Files/scanoptions.tsi\\{5D86DDB5-BDF9-441B-9E9E-D4730F4E
E499} -> ->
[Registry - Additional Scans - Non-Microsoft Only]
< BotCheck > -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\DefaultLaunch
Permission -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\MachineLaunch
Restriction -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\MachineAccess
Restriction -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\EnableDCOM ->
Y ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ ->
->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\Acti
vationSecurityCheckExemptionList\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\Acti
vationSecurityCheckExemptionList\\{A50398B8-9075-4FBF-A7
A1-456BF21937AD} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\Acti
vationSecurityCheckExemptionList\\{AD65A69D-3831-40D7-96
29-9B0B50A93843} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\Acti
vationSecurityCheckExemptionList\\{0040D221-54A1-11D1-9D
E0-006097042D69} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\Acti
vationSecurityCheckExemptionList\\{2A6D72F1-6E7E-4702-B9
9C-E40D3DED33C3} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST\ ->
->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST\\Sys
tem.EnterpriseServices.Thunk.dll -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\
-> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\\FirstRunDisabled -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\\AntiVirusDisableNotify -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\\FirewallDisableNotify -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\\UpdatesDisableNotify -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\\AntiVirusOverride -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\\FirewallOverride -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\AhnlabAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\ComputerAssociatesAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\KasperskyAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\McAfeeAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\McAfeeFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\PandaAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\PandaFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\SophosAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\SymantecAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\SymantecFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\TinyFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\TrendAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\TrendFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\Monitoring\ZoneLabsFirewall\ -> ->
Reg Error: Key
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\W
indowsUpdate\ not found. -> ->
Reg Error: Key
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFi
rewall\DomainProfile\ not found. -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
-> ->
*Authentication Packages* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\Authentication Packages ->
msv1_0 -> %SystemRoot%\system32\msv1_0.dll -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 129536 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
C:\WINDOWS\system32\byXOhGYS -> -> File not found
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\Bounds -> 0 [binary data] ->
*Security Packages* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\Security Packages ->
kerberos -> %SystemRoot%\system32\kerberos.dll ->
Microsoft Corporation [Ver = 5.1.2600.2698
(xpsp_sp2_gdr.050614-1522) | Size = 295936 bytes |
Modified Date = 15/06/2005 19:49:30 | Attr = ]
msv1_0 -> %SystemRoot%\system32\msv1_0.dll -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 129536 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
schannel -> %SystemRoot%\system32\schannel.dll ->
Microsoft Corporation [Ver = 5.1.2600.3126
(xpsp_sp2_gdr.070425-0226) | Size = 144896 bytes |
Modified Date = 25/04/2007 16:21:15 | Attr = ]
wdigest -> %SystemRoot%\system32\wdigest.dll ->
Microsoft Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 49152 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\ImpersonatePrivilegeUpgradeToolHasRun -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\LsaPid -> 704 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\SecureBoot -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\auditbaseobjects -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\crashonauditfail -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\disabledomaincreds -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\everyoneincludesanonymous -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\fipsalgorithmpolicy -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\forceguest -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\fullprivilegeauditing -> [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\limitblankpassworduse -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\lmcompatibilitylevel -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\nodefaultadminowner -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\nolmhash -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\restrictanonymous -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\restrictanonymoussam -> 1 ->
*Notification Packages* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
\Notification Packages ->
scecli -> %SystemRoot%\system32\scecli.dll -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 180224 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
AccessProviders\ -> ->
*ProviderOrder* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
AccessProviders\\ProviderOrder ->
Windows NT Access Provider -> -> File not found
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
AccessProviders\Windows NT Access Provider\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
AccessProviders\Windows NT Access Provider\\ProviderPath
-> %SystemRoot%\system32\ntmarta.dll
[%SystemRoot%\system32\ntmarta.dll] -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 118784 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Audit\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Audit\PerUserAuditing\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Audit\PerUserAuditing\System\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Data\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Data\\Pattern -> F4 F8 05 0B B5 C6 F4 A9 E8 E4 C3 F7 17
47 50 6C 32 61 61 38 65 35 37 39 00 FD 07 00 5D CD 00 00
34 FA 07 00 56 82 7C 75 20 FA 07 00 40 FD 07 00 4C FD 07
00 0C 74 4D 6B 38 0C A8 0A 25 FA 51 2A [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
GBG\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
GBG\\GrafBlumGroup -> 68 C1 00 3B 8E E1 C6 10 B4
[binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
JD\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
JD\\Lookup -> 0F 28 D1 7F 0F 6C [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Kerberos\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Kerberos\Domains\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Kerberos\SidCache\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
MSV1_0\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
MSV1_0\\Auth132 -> %SystemRoot%\system32\iissuba.dll
[IISSUBA] -> Microsoft Corporation [Ver = 6.0.2600.0
(xpclient.010817-1148) | Size = 9216 bytes | Modified
Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
MSV1_0\\ntlmminclientsec -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
MSV1_0\\ntlmminserversec -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Skew1\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Skew1\\SkewMatrix -> 86 97 86 4E C0 AF 43 52 81 4B 16 86
DC FD 95 51 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SSO\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SSO\Passport1.4\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SSO\Passport1.4\\SSOURL -> http://www.passport.com ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\\Time -> 28 53 31 71 F2 E4 C7 01 [binary
data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\Name -> Digest ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\Comment -> Digest SSPI
Authentication Package ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\Capabilities -> 16464 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\RpcId -> 65535 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\Version -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\TokenSize -> 65535 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\Time -> 00 A8 A5 4D 4D D8 C4 01
[binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\digest.dll\\Type -> 49 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\Name -> DPA ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\Comment -> DPA Security Package
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\Capabilities -> 55 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\RpcId -> 17 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\Version -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\TokenSize -> 768 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\Time -> 00 A8 A5 4D 4D D8 C4 01
[binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msapsspc.dll\\Type -> 49 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\Name -> MSN ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\Comment -> MSN Security Package
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\Capabilities -> 55 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\RpcId -> 18 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\Version -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\TokenSize -> 768 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\Time -> 00 A8 A5 4D 4D D8 C4 01
[binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
SspiCache\msnsspc.dll\\Type -> 49 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\DependOnGroup -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\DependOnService -> Netman;WinMgmt; ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\Description -> Provides network address
translation, addressing, name resolution and/or
intrusion prevention services for a home or small office
network. ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\DisplayName -> Windows Firewall/Internet
Connection Sharing (ICS) ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\ImagePath ->
%SystemRoot%\system32\svchost.exe
[%SystemRoot%\system32\svchost.exe -k netsvcs] ->
Microsoft Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\ObjectName -> LocalSystem ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\Start -> 2 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\\Type -> 32 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Epoch\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Epoch\\Epoch -> 1753 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\\ServiceDll ->
%SystemRoot%\system32\ipnathlp.dll
[%SystemRoot%\System32\ipnathlp.dll] -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 331264 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\DomainProfile\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\DomainProfile\Author
izedApplications\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\DomainProfile\Author
izedApplications\List\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\DomainProfile\Author
izedApplications\List\\%windir%\system32\sessmgr.exe ->
%SystemRoot%\system32\sessmgr.exe
[%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-
22019] -> Microsoft Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 140800 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\DomainProfile\Author
izedApplications\List\\C:\Program Files\MSN
Messenger\msnmsgr.exe -> %ProgramFiles%\MSN
Messenger\msnmsgr.exe [C:\Program Files\MSN
Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
8.1] -> Microsoft Corporation [Ver = 8.1.0178.00 | Size
= 5674352 bytes | Modified Date = 19/01/2007 12:55:02 |
Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\DomainProfile\Author
izedApplications\List\\C:\Program Files\MSN
Messenger\livecall.exe -> %ProgramFiles%\MSN
Messenger\livecall.exe [C:\Program Files\MSN
Messenger\livecall.exe:*:Enabled:Windows Live Messenger
8.1 (Phone)] -> Microsoft Corporation [Ver = 1.1.161.0 |
Size = 297752 bytes | Modified Date = 04/01/2007
16:10:02 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\ ->
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\\Ena
bleFirewall -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\\DoN
otAllowExceptions -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\\Dis
ableNotifications -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\%windir%\system32\sessmgr.exe
-> %SystemRoot%\system32\sessmgr.exe
[%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-
22019] -> Microsoft Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 140800 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\Microsoft
Office\Office12\OUTLOOK.EXE -> %ProgramFiles%\Microsoft
Office\Office12\OUTLOOK.EXE [C:\Program Files\Microsoft
Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office
Outlook] -> Microsoft Corporation [Ver = 12.0.4518.1014
| Size = 12813096 bytes | Modified Date = 27/10/2006
15:16:48 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\Kodak\KODAK
Software Updater\7288971\Program\Kodak Software
Updater.exe -> %ProgramFiles%\Kodak\KODAK Software
Updater\7288971\Program\Kodak Software Updater.exe
[C:\Program Files\Kodak\KODAK Software
Updater\7288971\Program\Kodak Software
Updater.exe:*:Enabled:Kodak Software Updater] -> File
not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\Kodak
EasyShare software\bin\EasyShare.exe ->
%ProgramFiles%\Kodak EasyShare
software\bin\EasyShare.exe [C:\Program Files\Kodak
EasyShare
software\bin\EasyShare.exe:*:Enabled:EasyShare] -> File
not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program
Files\Freeplayer\vlc\vlc.exe ->
%ProgramFiles%\Freeplayer\vlc\vlc.exe [C:\Program
Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player]
-> [Ver = | Size = 6415360 bytes | Modified Date =
02/09/2005 21:24:01 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\Nero\Nero
7\Nero ShowTime\ShowTime.exe -> %ProgramFiles%\Nero\Nero
7\Nero ShowTime\ShowTime.exe [C:\Program Files\Nero\Nero
7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime] ->
Nero AG [Ver = 3, 0, 0, 1 | Size = 3739648 bytes |
Modified Date = 23/03/2006 16:44:06 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program
Files\uTorrent\uTorrent.exe ->
%ProgramFiles%\uTorrent\uTorrent.exe [C:\Program
Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent] -> [Ver
= | Size = 219952 bytes | Modified Date = 23/02/2008
10:38:21 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\Nokia\Nokia
Software Updater\nsu_ui_client.exe ->
%ProgramFiles%\Nokia\Nokia Software
Updater\nsu_ui_client.exe [C:\Program Files\Nokia\Nokia
Software Updater\nsu_ui_client.exe:*:Enabled:Nokia
Software Updater] -> File not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\Common
Files\Nokia\Service Layer\A\nsl_host_process.exe ->
%CommonProgramFiles%\Nokia\Service
Layer\A\nsl_host_process.exe [C:\Program Files\Common
Files\Nokia\Service
Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service
Layer Host Process ] -> File not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program
Files\eMule\emule.exe -> %ProgramFiles%\eMule\emule.exe
[C:\Program Files\eMule\emule.exe:*:Disabled:eMule] ->
File not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\MSN
Messenger\msnmsgr.exe -> %ProgramFiles%\MSN
Messenger\msnmsgr.exe [C:\Program Files\MSN
Messenger\msnmsgr.exe:*:Disabled:Windows Live Messenger
8.1] -> Microsoft Corporation [Ver = 8.1.0178.00 | Size
= 5674352 bytes | Modified Date = 19/01/2007 12:55:02 |
Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program Files\MSN
Messenger\livecall.exe -> %ProgramFiles%\MSN
Messenger\livecall.exe [C:\Program Files\MSN
Messenger\livecall.exe:*:Disabled:Windows Live Messenger
8.1 (Phone)] -> Microsoft Corporation [Ver = 1.1.161.0 |
Size = 297752 bytes | Modified Date = 04/01/2007
16:10:02 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Auth
orizedApplications\List\\C:\Program
Files\Messenger\msmsgs.exe ->
%ProgramFiles%\Messenger\msmsgs.exe [C:\Program
Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger]
-> Microsoft Corporation [Ver = 4.7.3001 | Size =
1694208 bytes | Modified Date = 13/10/2004 18:24:37 |
Attr = HS]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\1900:UDP ->
1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\2869:TCP ->
2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\3389:TCP ->
3389:TCP:*:Enabled:@xpsp2res.dll,-22009 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\139:TCP ->
139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\445:TCP ->
445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\137:UDP ->
137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Parameters\FirewallPolicy\StandardProfile\Glob
allyOpenPorts\List\\138:UDP ->
138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Setup\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Setup\\ServiceUpgrade -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Setup\InterfacesUnfirewalledAtUpdate\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Setup\InterfacesUnfirewalledAtUpdate\\All -> 1
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Enum\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Enum\\0 -> Root\LEGACY_SHAREDACCESS\0000 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Enum\\Count -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sha
redAccess\Enum\\NextInstance -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\Type -> 32 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\Start -> 2 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\ImagePath -> %SystemRoot%\system32\svchost.exe
[%systemroot%\system32\svchost.exe -k netsvcs] ->
Microsoft Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\DisplayName -> Automatic Updates ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\ObjectName -> LocalSystem ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\\Description -> Enables the download and
installation of Windows updates. If this service is
disabled, this computer will not be able to use the
Automatic Updates feature or the Windows Update Web
site. ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Parameters\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Parameters\\ServiceDll ->
%SystemRoot%\system32\wuauserv.dll
[C:\WINDOWS\system32\wuauserv.dll] -> Microsoft
Corporation [Ver = 5.4.3790.2180
(xpsp_sp2_rtm.040803-2158) | Size = 6656 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Security\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Security\\Security -> [Binary data over 100 bytes]
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Enum\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Enum\\0 -> Root\LEGACY_WUAUSERV\0000 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Enum\\Count -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wua
userv\Enum\\NextInstance -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\Description -> Enables remote users to
modify registry settings on this computer. If this
service is stopped, the registry can be modified only by
users on this computer. If this service is disabled, any
services that explicitly depend on it will fail to
start. ->
*DependOnService* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\DependOnService ->
RPCSS -> %SystemRoot%\system32\rpcss.dll -> Microsoft
Corporation [Ver = 5.1.2600.2726
(xpsp_sp2_gdr.050725-1528) | Size = 397824 bytes |
Modified Date = 26/07/2005 06:39:49 | Attr = ]
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\DisplayName -> Remote Registry ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\ImagePath ->
%SystemRoot%\system32\svchost.exe
[%SystemRoot%\system32\svchost.exe -k LocalService] ->
Microsoft Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\ObjectName -> NT AUTHORITY\LocalService ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\Group -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\Start -> 2 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\Type -> 32 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\\FailureActions -> 00 00 00 00 00 00 00 00
00 00 00 00 01 00 00 00 E0 AD 08 00 01 00 00 00 E8 03 00
00 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Parameters\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Parameters\\ServiceDll ->
%SystemRoot%\system32\regsvc.dll
[%SystemRoot%\system32\regsvc.dll] -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 59904 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Security\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Security\\Security -> [Binary data over 100
bytes] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Enum\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Enum\\0 -> Root\LEGACY_REMOTEREGISTRY\0000
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Enum\\Count -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rem
oteRegistry\Enum\\NextInstance -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\Type -> 16 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\Start -> 4 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\ImagePath -> %SystemRoot%\system32\tlntsvr.exe
[C:\WINDOWS\system32\tlntsvr.exe] -> Microsoft
Corporation [Ver = 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158) | Size = 73216 bytes |
Modified Date = 02/12/2004 11:00:00 | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\DisplayName -> Telnet ->
*DependOnService* ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\DependOnService ->
RPCSS -> %SystemRoot%\system32\rpcss.dll -> Microsoft
Corporation [Ver = 5.1.2600.2726
(xpsp_sp2_gdr.050725-1528) | Size = 397824 bytes |
Modified Date = 26/07/2005 06:39:49 | Attr = ]
TCPIP -> -> File not found
NTLMSSP -> -> File not found
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\DependOnGroup -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\ObjectName -> LocalSystem ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\\Description -> Enables a remote user to log on to
this computer and run programs, and supports various
TCP/IP Telnet clients, including UNIX-based and
Windows-based computers. If this service is stopped,
remote user access to programs might be unavailable. If
this service is disabled, any services that explicitly
depend on it will fail to start. ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\Security\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tln
tSvr\Security\\Security -> [Binary data over 100 bytes]
->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware
Profiles\Current\Software\Microsoft\windows\CurrentVersi
on\Internet Settings\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware
Profiles\Current\Software\Microsoft\windows\CurrentVersi
on\Internet Settings\\ProxyEnable -> 0 ->
[Files/Folders - Created Within 30 days]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = |
Size = 536399872 bytes | Created Date = 10/06/2008
08:09:52 | Attr = HS]
sqmdata16.sqm -> %SystemDrive%\sqmdata16.sqm -> [Ver =
| Size = 232 bytes | Created Date = 20/05/2008 21:17:43
| Attr = H ]
sqmdata17.sqm -> %SystemDrive%\sqmdata17.sqm -> [Ver =
| Size = 232 bytes | Created Date = 20/05/2008 21:19:43
| Attr = H ]
sqmdata18.sqm -> %SystemDrive%\sqmdata18.sqm -> [Ver =
| Size = 232 bytes | Created Date = 20/05/2008 21:24:05
| Attr = H ]
sqmnoopt16.sqm -> %SystemDrive%\sqmnoopt16.sqm -> [Ver
= | Size = 244 bytes | Created Date = 20/05/2008
21:17:42 | Attr = H ]
sqmnoopt17.sqm -> %SystemDrive%\sqmnoopt17.sqm -> [Ver
= | Size = 244 bytes | Created Date = 20/05/2008
21:19:43 | Attr = H ]
sqmnoopt18.sqm -> %SystemDrive%\sqmnoopt18.sqm -> [Ver
= | Size = 244 bytes | Created Date = 20/05/2008
21:24:05 | Attr = H ]
Temp -> %SystemDrive%\Temp -> [Folder | Created Date =
11/05/2008 19:17:44 | Attr = ]
aswFsBlk.sys ->
%SystemRoot%\System32\drivers\aswFsBlk.sys -> ALWIL
Software [Ver = 4.8.1201.0 | Size = 20560 bytes |
Created Date = 11/05/2008 21:14:55 | Attr = ]
aswSP.sys -> %SystemRoot%\System32\drivers\aswSP.sys ->
ALWIL Software [Ver = 4.8.1201.0 | Size = 78416 bytes |
Created Date = 11/05/2008 21:14:55 | Attr = ]
avgntdd.sys -> %SystemRoot%\System32\drivers\avgntdd.sys
-> Avira GmbH [Ver = 6.39.00.30 | Size = 41792 bytes |
Created Date = 09/06/2008 17:40:43 | Attr = ]
avgntmgr.sys ->
%SystemRoot%\System32\drivers\avgntmgr.sys -> Avira GmbH
[Ver = 6.37.01.02 | Size = 22336 bytes | Created Date =
09/06/2008 17:40:43 | Attr = ]
avipbb.sys -> %SystemRoot%\System32\drivers\avipbb.sys
-> Avira GmbH [Ver = 1.00.02.22 | Size = 79424 bytes |
Created Date = 09/06/2008 17:40:40 | Attr = ]
ssmdrv.sys -> %SystemRoot%\System32\drivers\ssmdrv.sys
-> Avira GmbH [Ver = 7.0.1.1 | Size = 28352 bytes |
Created Date = 09/06/2008 17:40:43 | Attr = ]
20467 -> %SystemRoot%\System32\20467 -> [Folder |
Created Date = 11/05/2008 19:18:02 | Attr = ]
3 C:\WINDOWS\System32\*.tmp files ->
C:\WINDOWS\System32\*.tmp ->
appmgmt -> %SystemRoot%\System32\appmgmt -> [Folder |
Created Date = 18/05/2008 13:35:51 | Attr = ]
awTmNgdc.dll -> %SystemRoot%\System32\awTmNgdc.dll ->
[Ver = | Size = 52736 bytes | Created Date = 11/05/2008
19:17:45 | Attr = ]
bkEur01 -> %SystemRoot%\System32\bkEur01 -> [Folder |
Created Date = 11/05/2008 19:17:46 | Attr = ]
dfeefiOq.ini -> %SystemRoot%\System32\dfeefiOq.ini ->
[Ver = | Size = 198110 bytes | Created Date =
11/05/2008 19:23:15 | Attr = HS]
dfeefiOq.ini2 -> %SystemRoot%\System32\dfeefiOq.ini2 ->
[Ver = | Size = 198110 bytes | Created Date =
11/05/2008 19:23:15 | Attr = HS]
dwdxycbi.ini -> %SystemRoot%\System32\dwdxycbi.ini ->
[Ver = | Size = 1604260 bytes | Created Date =
12/05/2008 10:35:53 | Attr = HS]
fnwumdav.ini -> %SystemRoot%\System32\fnwumdav.ini ->
[Ver = | Size = 1604647 bytes | Created Date =
18/05/2008 09:42:15 | Attr = HS]
lqyuxovi.ini -> %SystemRoot%\System32\lqyuxovi.ini ->
[Ver = | Size = 1505163 bytes | Created Date =
11/05/2008 19:29:48 | Attr = HS]
mBL -> %SystemRoot%\System32\mBL -> [Folder | Created
Date = 11/05/2008 19:18:07 | Attr = ]
OorYJRqr.ini -> %SystemRoot%\System32\OorYJRqr.ini ->
[Ver = | Size = 412451 bytes | Created Date =
12/05/2008 16:51:54 | Attr = HS]
OorYJRqr.ini2 -> %SystemRoot%\System32\OorYJRqr.ini2 ->
[Ver = | Size = 412451 bytes | Created Date =
12/05/2008 16:51:56 | Attr = HS]
oYGjmnmp.ini -> %SystemRoot%\System32\oYGjmnmp.ini ->
[Ver = | Size = 290 bytes | Created Date = 16/05/2008
17:48:13 | Attr = HS]
oYGjmnmp.ini2 -> %SystemRoot%\System32\oYGjmnmp.ini2 ->
[Ver = | Size = 705284 bytes | Created Date =
16/05/2008 17:48:14 | Attr = HS]
PreInstall -> %SystemRoot%\System32\PreInstall ->
[Folder | Created Date = 08/06/2008 16:27:46 | Attr =
]
sikrjmrr.ini -> %SystemRoot%\System32\sikrjmrr.ini ->
[Ver = | Size = 1990628 bytes | Created Date =
18/05/2008 20:58:14 | Attr = HS]
SoftwareDistribution ->
%SystemRoot%\System32\SoftwareDistribution -> [Folder |
Created Date = 08/06/2008 16:06:40 | Attr = ]
sX1 -> %SystemRoot%\System32\sX1 -> [Folder | Created
Date = 11/05/2008 19:17:56 | Attr = ]
SYGhOXyb.ini -> %SystemRoot%\System32\SYGhOXyb.ini ->
[Ver = | Size = 352379 bytes | Created Date =
18/05/2008 20:52:12 | Attr = HS]
SYGhOXyb.ini2 -> %SystemRoot%\System32\SYGhOXyb.ini2 ->
[Ver = | Size = 352379 bytes | Created Date =
18/05/2008 20:52:12 | Attr = HS]
YIlVwGgh.ini -> %SystemRoot%\System32\YIlVwGgh.ini ->
[Ver = | Size = 199229 bytes | Created Date =
12/05/2008 09:05:50 | Attr = HS]
YIlVwGgh.ini2 -> %SystemRoot%\System32\YIlVwGgh.ini2 ->
[Ver = | Size = 199229 bytes | Created Date =
12/05/2008 09:05:50 | Attr = HS]
$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Created
Date = 08/06/2008 16:27:42 | Attr = H ]
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
BDOSCAN8 -> %SystemRoot%\BDOSCAN8 -> [Folder | Created
Date = 18/05/2008 10:50:20 | Attr = ]
BMab83a148.xml -> %SystemRoot%\BMab83a148.xml -> [Ver =
| Size = 109807 bytes | Created Date = 11/05/2008
19:25:20 | Attr = ]
cookies.ini -> %SystemRoot%\cookies.ini -> [Ver = |
Size = 219 bytes | Created Date = 18/05/2008 10:48:34 |
Attr = ]
pskt.ini -> %SystemRoot%\pskt.ini -> [Ver = | Size =
22 bytes | Created Date = 11/05/2008 19:25:20 | Attr =
]
[Files Created - Additional Folder Scans - Non-Microsoft
Only]
Avira -> %AllUsersProfile%\Application Data\Avira ->
[Folder | Created Date = 09/06/2008 17:40:30 | Attr =
]
Lavasoft -> %AllUsersProfile%\Application Data\Lavasoft
-> [Folder | Created Date = 18/05/2008 11:41:52 | Attr
= ]
Sony Ericsson -> %AllUsersProfile%\Application Data\Sony
Ericsson -> [Folder | Created Date = 08/06/2008
17:09:31 | Attr = ]
Spybot - Search & Destroy ->
%AllUsersProfile%\Application Data\Spybot - Search &
Destroy -> [Folder | Created Date = 11/05/2008 19:37:15
| Attr = ]
AntiVir PE Classic.lnk ->
%AllUsersProfile%\Desktop\AntiVir PE Classic.lnk ->
[Ver = | Size = 1851 bytes | Created Date = 09/06/2008
17:41:15 | Attr = ]
ATF-Cleaner.exe -> %UserProfile%\Desktop\ATF-Cleaner.exe
-> Atribune.org [Ver = 3.00.0002 | Size = 50688 bytes |
Created Date = 10/06/2008 18:26:13 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\ATF-Cleaner.exe:Zone.Identifier
install_Avira AntiVir Personal_.exe ->
%UserProfile%\Desktop\install_Avira AntiVir
Personal_.exe -> [Ver = | Size = 99383 bytes | Created
Date = 09/06/2008 17:06:45 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\install_Avira AntiVir
Personal_.exe:Zone.Identifier
Lavasoft_Adaware2007_fr.exe ->
%UserProfile%\Desktop\Lavasoft_Adaware2007_fr.exe ->
[Ver = | Size = 21364592 bytes | Created Date =
18/05/2008 11:39:59 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\Lavasoft_Adaware2007_fr.exe:Zone.I
dentifier
OTScanIt -> %UserProfile%\Desktop\OTScanIt -> [Folder |
Created Date = 10/06/2008 18:28:09 | Attr = ]
OTScanIt.exe -> %UserProfile%\Desktop\OTScanIt.exe ->
[Ver = | Size = 568544 bytes | Created Date =
10/06/2008 18:26:56 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\OTScanIt.exe:Zone.Identifier
Procédure_de.doc ->
%UserProfile%\Desktop\Procédure_de.doc -> [Ver = |
Size = 33812 bytes | Created Date = 09/06/2008 17:37:44
| Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\Procédure_de.doc:Zone.Identifier
Spybot - Search & Destroy.lnk ->
%UserProfile%\Desktop\Spybot - Search & Destroy.lnk ->
[Ver = | Size = 963 bytes | Created Date = 11/05/2008
19:37:24 | Attr = ]
Sony Ericsson Shared -> %CommonProgramFiles%\Sony
Ericsson Shared -> [Folder | Created Date = 08/06/2008
17:10:18 | Attr = ]
AntiSpywareMaster -> %ProgramFiles%\AntiSpywareMaster ->
[Folder | Created Date = 11/05/2008 19:23:00 | Attr =
]
Avira -> %ProgramFiles%\Avira -> [Folder | Created Date
= 09/06/2008 17:40:30 | Attr = ]
Lavasoft -> %ProgramFiles%\Lavasoft -> [Folder |
Created Date = 18/05/2008 11:41:56 | Attr = ]
MSXML 4.0 -> %ProgramFiles%\MSXML 4.0 -> [Folder |
Created Date = 08/06/2008 17:11:17 | Attr = ]
Spybot - Search & Destroy -> %ProgramFiles%\Spybot -
Search & Destroy -> [Folder | Created Date = 11/05/2008
19:37:15 | Attr = ]
winvi -> %ProgramFiles%\winvi -> [Folder | Created Date
= 11/05/2008 19:18:08 | Attr = ]
[Files/Folders - Modified Within 30 days]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = |
Size = 536399872 bytes | Modified Date = 10/06/2008
18:13:16 | Attr = HS]
Program Files -> %ProgramFiles% -> [Folder | Modified
Date = 09/06/2008 21:01:39 | Attr = R ]
sqmdata16.sqm -> %SystemDrive%\sqmdata16.sqm -> [Ver =
| Size = 232 bytes | Modified Date = 20/05/2008 21:17:43
| Attr = H ]
sqmdata17.sqm -> %SystemDrive%\sqmdata17.sqm -> [Ver =
| Size = 232 bytes | Modified Date = 20/05/2008 21:19:43
| Attr = H ]
sqmdata18.sqm -> %SystemDrive%\sqmdata18.sqm -> [Ver =
| Size = 232 bytes | Modified Date = 20/05/2008 21:24:05
| Attr = H ]
sqmnoopt16.sqm -> %SystemDrive%\sqmnoopt16.sqm -> [Ver
= | Size = 244 bytes | Modified Date = 20/05/2008
21:17:42 | Attr = H ]
sqmnoopt17.sqm -> %SystemDrive%\sqmnoopt17.sqm -> [Ver
= | Size = 244 bytes | Modified Date = 20/05/2008
21:19:43 | Attr = H ]
sqmnoopt18.sqm -> %SystemDrive%\sqmnoopt18.sqm -> [Ver
= | Size = 244 bytes | Modified Date = 20/05/2008
21:24:05 | Attr = H ]
Temp -> %SystemDrive%\Temp -> [Folder | Modified Date =
18/05/2008 11:07:45 | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date =
10/06/2008 18:20:42 | Attr = ]
aavmker4.sys ->
%SystemRoot%\System32\drivers\aavmker4.sys -> ALWIL
Software [Ver = 4.8.1201.0 | Size = 26944 bytes |
Modified Date = 16/05/2008 01:13:26 | Attr = ]
aswFsBlk.sys ->
%SystemRoot%\System32\drivers\aswFsBlk.sys -> ALWIL
Software [Ver = 4.8.1201.0 | Size = 20560 bytes |
Modified Date = 16/05/2008 01:16:06 | Attr = ]
aswmon2.sys -> %SystemRoot%\System32\drivers\aswmon2.sys
-> ALWIL Software [Ver = 4.8.1201.0 | Size = 94416 bytes
| Modified Date = 16/05/2008 01:18:33 | Attr = ]
aswRdr.sys -> %SystemRoot%\System32\drivers\aswRdr.sys
-> ALWIL Software [Ver = 4.8.1201.0 | Size = 23152 bytes
| Modified Date = 16/05/2008 01:15:29 | Attr = ]
aswSP.sys -> %SystemRoot%\System32\drivers\aswSP.sys ->
ALWIL Software [Ver = 4.8.1201.0 | Size = 78416 bytes |
Modified Date = 16/05/2008 01:20:32 | Attr = ]
aswTdi.sys -> %SystemRoot%\System32\drivers\aswTdi.sys
-> ALWIL Software [Ver = 4.8.1201.0 | Size = 42912 bytes
| Modified Date = 16/05/2008 01:14:11 | Attr = ]
etc -> %SystemRoot%\System32\drivers\etc -> [Folder |
Modified Date = 08/06/2008 12:43:45 | Attr = ]
hosts -> %SystemRoot%\System32\drivers\etc\hosts ->
[Ver = | Size = 238945 bytes | Modified Date =
08/06/2008 12:43:45 | Attr = R ]
hosts.20080608-124345.backup ->
%SystemRoot%\System32\drivers\etc\hosts.20080608-124345.
backup -> [Ver = | Size = 238945 bytes | Modified Date
= 12/05/2008 17:21:59 | Attr = R ]
hosts.ics -> %SystemRoot%\System32\drivers\etc\hosts.ics
-> [Ver = | Size = 431 bytes | Modified Date =
18/05/2008 20:40:37 | Attr = ]
20467 -> %SystemRoot%\System32\20467 -> [Folder |
Modified Date = 11/05/2008 19:18:07 | Attr = ]
3 C:\WINDOWS\System32\*.tmp files ->
C:\WINDOWS\System32\*.tmp ->
appmgmt -> %SystemRoot%\System32\appmgmt -> [Folder |
Modified Date = 18/05/2008 13:35:51 | Attr = ]
aswBoot.exe -> %SystemRoot%\System32\aswBoot.exe ->
ALWIL Software [Ver = 4, 8, 1201, 0 | Size = 1152888
bytes | Modified Date = 16/05/2008 01:24:43 | Attr =
]
AvastSS.scr -> %SystemRoot%\System32\AvastSS.scr ->
ALWIL Software [Ver = 4, 8, 1201, 0 | Size = 95608 bytes
| Modified Date = 16/05/2008 01:12:36 | Attr = ]
awTmNgdc.dll -> %SystemRoot%\System32\awTmNgdc.dll ->
[Ver = | Size = 52736 bytes | Modified Date =
11/05/2008 19:17:45 | Attr = ]
bkEur01 -> %SystemRoot%\System32\bkEur01 -> [Folder |
Modified Date = 18/05/2008 12:10:09 | Attr = ]
CatRoot -> %SystemRoot%\System32\CatRoot -> [Folder |
Modified Date = 08/06/2008 17:01:55 | Attr = ]
CatRoot2 -> %SystemRoot%\System32\CatRoot2 -> [Folder |
Modified Date = 10/06/2008 18:14:42 | Attr = ]
color -> %SystemRoot%\System32\color -> [Folder |
Modified Date = 08/06/2008 12:53:56 | Attr = ]
Com -> %SystemRoot%\System32\Com -> [Folder | Modified
Date = 09/06/2008 17:14:23 | Attr = ]
CONFIG.NT -> %SystemRoot%\System32\CONFIG.NT -> [Ver =
| Size = 2626 bytes | Modified Date = 08/06/2008
16:07:34 | Attr = ]
dfeefiOq.ini -> %SystemRoot%\System32\dfeefiOq.ini ->
[Ver = | Size = 198110 bytes | Modified Date =
12/05/2008 01:01:58 | Attr = HS]
dfeefiOq.ini2 -> %SystemRoot%\System32\dfeefiOq.ini2 ->
[Ver = | Size = 198110 bytes | Modified Date =
12/05/2008 00:59:06 | Attr = HS]
dllcache -> %SystemRoot%\System32\dllcache -> [Folder |
Modified Date = 10/06/2008 08:22:02 | Attr = RHS]
drivers -> %SystemRoot%\System32\drivers -> [Folder |
Modified Date = 09/06/2008 21:16:25 | Attr = ]
DRVSTORE -> %SystemRoot%\System32\DRVSTORE -> [Folder |
Modified Date = 08/06/2008 16:20:57 | Attr = ]
dwdxycbi.ini -> %SystemRoot%\System32\dwdxycbi.ini ->
[Ver = | Size = 1604260 bytes | Modified Date =
18/05/2008 09:39:14 | Attr = HS]
FNTCACHE.DAT -> %SystemRoot%\System32\FNTCACHE.DAT ->
[Ver = | Size = 290888 bytes | Modified Date =
10/06/2008 08:29:31 | Attr = ]
fnwumdav.ini -> %SystemRoot%\System32\fnwumdav.ini ->
[Ver = | Size = 1604647 bytes | Modified Date =
18/05/2008 20:47:46 | Attr = HS]
lqyuxovi.ini -> %SystemRoot%\System32\lqyuxovi.ini ->
[Ver = | Size = 1505163 bytes | Modified Date =
12/05/2008 10:29:55 | Attr = HS]
mBL -> %SystemRoot%\System32\mBL -> [Folder | Modified
Date = 18/05/2008 12:10:09 | Attr = ]
OorYJRqr.ini -> %SystemRoot%\System32\OorYJRqr.ini ->
[Ver = | Size = 412451 bytes | Modified Date =
13/05/2008 06:25:16 | Attr = HS]
OorYJRqr.ini2 -> %SystemRoot%\System32\OorYJRqr.ini2 ->
[Ver = | Size = 412451 bytes | Modified Date =
13/05/2008 06:22:30 | Attr = HS]
oYGjmnmp.ini -> %SystemRoot%\System32\oYGjmnmp.ini ->
[Ver = | Size = 290 bytes | Modified Date = 18/05/2008
13:25:05 | Attr = HS]
oYGjmnmp.ini2 -> %SystemRoot%\System32\oYGjmnmp.ini2 ->
[Ver = | Size = 705284 bytes | Modified Date =
18/05/2008 13:24:34 | Attr = HS]
perfc009.dat -> %SystemRoot%\System32\perfc009.dat ->
[Ver = | Size = 46252 bytes | Modified Date =
09/06/2008 17:55:33 | Attr = ]
perfh009.dat -> %SystemRoot%\System32\perfh009.dat ->
[Ver = | Size = 366638 bytes | Modified Date =
09/06/2008 17:55:34 | Attr = ]
PerfStringBackup.INI ->
%SystemRoot%\System32\PerfStringBackup.INI -> [Ver = |
Size = 418662 bytes | Modified Date = 09/06/2008
17:55:32 | Attr = ]
PreInstall -> %SystemRoot%\System32\PreInstall ->
[Folder | Modified Date = 08/06/2008 16:27:46 | Attr =
]
Restore -> %SystemRoot%\System32\Restore -> [Folder |
Modified Date = 08/06/2008 16:17:59 | Attr = ]
sikrjmrr.ini -> %SystemRoot%\System32\sikrjmrr.ini ->
[Ver = | Size = 1990628 bytes | Modified Date =
20/05/2008 19:08:34 | Attr = HS]
SoftwareDistribution ->
%SystemRoot%\System32\SoftwareDistribution -> [Folder |
Modified Date = 08/06/2008 16:06:40 | Attr = ]
sX1 -> %SystemRoot%\System32\sX1 -> [Folder | Modified
Date = 11/05/2008 19:18:01 | Attr = ]
SYGhOXyb.ini -> %SystemRoot%\System32\SYGhOXyb.ini ->
[Ver = | Size = 352379 bytes | Modified Date =
08/06/2008 14:37:36 | Attr = HS]
SYGhOXyb.ini2 -> %SystemRoot%\System32\SYGhOXyb.ini2 ->
[Ver = | Size = 352379 bytes | Modified Date =
08/06/2008 14:35:17 | Attr = HS]
wpa.dbl -> %SystemRoot%\System32\wpa.dbl -> [Ver = |
Size = 2206 bytes | Modified Date = 09/06/2008 16:57:21
| Attr = ]
YIlVwGgh.ini -> %SystemRoot%\System32\YIlVwGgh.ini ->
[Ver = | Size = 199229 bytes | Modified Date =
12/05/2008 14:26:40 | Attr = HS]
YIlVwGgh.ini2 -> %SystemRoot%\System32\YIlVwGgh.ini2 ->
[Ver = | Size = 199229 bytes | Modified Date =
12/05/2008 14:26:01 | Attr = HS]
$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified
Date = 09/06/2008 17:33:55 | Attr = H ]
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
assembly -> %SystemRoot%\assembly -> [Folder | Modified
Date = 08/06/2008 17:16:30 | Attr = R S]
BDOSCAN8 -> %SystemRoot%\BDOSCAN8 -> [Folder | Modified
Date = 18/05/2008 11:35:27 | Attr = ]
BMab83a148.xml -> %SystemRoot%\BMab83a148.xml -> [Ver =
| Size = 109807 bytes | Modified Date = 20/05/2008
19:07:58 | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = |
Size = 2048 bytes | Modified Date = 10/06/2008 18:13:17
| Attr = S]
cookies.ini -> %SystemRoot%\cookies.ini -> [Ver = |
Size = 219 bytes | Modified Date = 18/05/2008 10:48:40 |
Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded
Program Files -> [Folder | Modified Date = 18/05/2008
13:36:46 | Attr = S]
Help -> %SystemRoot%\Help -> [Folder | Modified Date =
08/06/2008 16:07:27 | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size
= 1374 bytes | Modified Date = 10/06/2008 08:21:43 |
Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date =
10/06/2008 08:22:15 | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder |
Modified Date = 09/06/2008 21:16:32 | Attr = HS]
msagent -> %SystemRoot%\msagent -> [Folder | Modified
Date = 10/06/2008 08:19:12 | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified
Date = 10/06/2008 18:33:19 | Attr = ]
pskt.ini -> %SystemRoot%\pskt.ini -> [Ver = | Size =
22 bytes | Modified Date = 20/05/2008 19:10:14 | Attr =
]
Registration -> %SystemRoot%\Registration -> [Folder |
Modified Date = 10/06/2008 18:14:39 | Attr = ]
SoftwareDistribution ->
%SystemRoot%\SoftwareDistribution -> [Folder | Modified
Date = 08/06/2008 16:07:30 | Attr = ]
system32 -> %SystemRoot%\system32 -> [Folder | Modified
Date = 10/06/2008 08:29:07 | Attr = ]
Temp -> %SystemRoot%\Temp -> [Folder | Modified Date =
10/06/2008 18:33:10 | Attr = ]
Web -> %SystemRoot%\Web -> [Folder | Modified Date =
18/05/2008 13:31:26 | Attr = R ]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 798
bytes | Modified Date = 12/05/2008 00:52:29 | Attr =
]
wininit.ini -> %SystemRoot%\wininit.ini -> [Ver = |
Size = 383 bytes | Modified Date = 18/05/2008 13:18:20 |
Attr = ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified
Date = 09/06/2008 17:20:49 | Attr = ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size =
6 bytes | Modified Date = 10/06/2008 18:13:30 | Attr =
H ]
C:\Documents and Settings\All Users\Application
Data\Microsoft\eHome\logs\ -> C:\Documents and
Settings\All Users\Application Data\Microsoft\eHome\logs
-> [Folder | Modified Date = 10/06/2008 18:13:50 | Attr
= ]
eHomeLog-0.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-0.dat -> [Ver = |
Size = 268 bytes | Modified Date = 18/05/2008 20:32:53 |
Attr = H ]
eHomeLog-1.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-1.dat -> [Ver = |
Size = 268 bytes | Modified Date = 18/05/2008 20:48:34 |
Attr = H ]
eHomeLog-10.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-10.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 15:37:16 |
Attr = H ]
eHomeLog-11.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-11.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 15:59:55 |
Attr = H ]
eHomeLog-12.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-12.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 16:00:18 |
Attr = H ]
eHomeLog-13.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-13.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 16:23:58 |
Attr = H ]
eHomeLog-14.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-14.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 16:25:40 |
Attr = H ]
eHomeLog-15.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-15.dat -> [Ver = |
Size = 268 bytes | Modified Date = 09/06/2008 18:27:54 |
Attr = H ]
eHomeLog-16.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-16.dat -> [Ver = |
Size = 0 bytes | Modified Date = 09/06/2008 18:33:03 |
Attr = H ]
eHomeLog-17.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-17.dat -> [Ver = |
Size = 268 bytes | Modified Date = 09/06/2008 18:45:57 |
Attr = H ]
eHomeLog-18.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-18.dat -> [Ver = |
Size = 268 bytes | Modified Date = 09/06/2008 20:09:14 |
Attr = H ]
eHomeLog-19.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-19.dat -> [Ver = |
Size = 268 bytes | Modified Date = 10/06/2008 08:10:59 |
Attr = H ]
eHomeLog-2.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-2.dat -> [Ver = |
Size = 268 bytes | Modified Date = 20/05/2008 19:58:18 |
Attr = H ]
eHomeLog-20.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-20.dat -> [Ver = |
Size = 268 bytes | Modified Date = 10/06/2008 08:12:41 |
Attr = H ]
eHomeLog-21.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-21.dat -> [Ver = |
Size = 268 bytes | Modified Date = 10/06/2008 08:30:20 |
Attr = H ]
eHomeLog-22.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-22.dat -> [Ver = |
Size = 268 bytes | Modified Date = 10/06/2008 08:31:45 |
Attr = H ]
eHomeLog-23.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-23.dat -> [Ver = |
Size = 268 bytes | Modified Date = 10/06/2008 18:14:53 |
Attr = H ]
eHomeLog-24.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-24.dat -> [Ver = |
Size = 268 bytes | Modified Date = 10/06/2008 18:16:33 |
Attr = H ]
eHomeLog-25.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-25.dat -> [Ver = |
Size = 268 bytes | Modified Date = 27/04/2008 21:10:19 |
Attr = H ]
eHomeLog-26.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-26.dat -> [Ver = |
Size = 268 bytes | Modified Date = 28/04/2008 18:48:23 |
Attr = H ]
eHomeLog-27.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-27.dat -> [Ver = |
Size = 268 bytes | Modified Date = 28/04/2008 21:02:19 |
Attr = H ]
eHomeLog-28.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-28.dat -> [Ver = |
Size = 268 bytes | Modified Date = 28/04/2008 21:03:02 |
Attr = H ]
eHomeLog-29.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-29.dat -> [Ver = |
Size = 268 bytes | Modified Date = 30/04/2008 21:16:07 |
Attr = H ]
eHomeLog-3.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-3.dat -> [Ver = |
Size = 268 bytes | Modified Date = 26/05/2008 11:00:56 |
Attr = H ]
eHomeLog-30.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-30.dat -> [Ver = |
Size = 268 bytes | Modified Date = 01/05/2008 10:44:06 |
Attr = H ]
eHomeLog-31.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-31.dat -> [Ver = |
Size = 268 bytes | Modified Date = 02/05/2008 16:12:39 |
Attr = H ]
eHomeLog-32.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-32.dat -> [Ver = |
Size = 268 bytes | Modified Date = 03/05/2008 09:41:32 |
Attr = H ]
eHomeLog-33.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-33.dat -> [Ver = |
Size = 268 bytes | Modified Date = 04/05/2008 18:46:14 |
Attr = H ]
eHomeLog-34.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-34.dat -> [Ver = |
Size = 268 bytes | Modified Date = 04/05/2008 21:29:38 |
Attr = H ]
eHomeLog-35.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-35.dat -> [Ver = |
Size = 268 bytes | Modified Date = 11/05/2008 18:49:35 |
Attr = H ]
eHomeLog-36.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-36.dat -> [Ver = |
Size = 268 bytes | Modified Date = 11/05/2008 19:29:15 |
Attr = H ]
eHomeLog-37.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-37.dat -> [Ver = |
Size = 268 bytes | Modified Date = 11/05/2008 22:45:48 |
Attr = H ]
eHomeLog-38.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-38.dat -> [Ver = |
Size = 268 bytes | Modified Date = 11/05/2008 22:46:56 |
Attr = H ]
eHomeLog-39.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-39.dat -> [Ver = |
Size = 268 bytes | Modified Date = 12/05/2008 09:01:33 |
Attr = H ]
eHomeLog-4.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-4.dat -> [Ver = |
Size = 268 bytes | Modified Date = 26/05/2008 11:01:34 |
Attr = H ]
eHomeLog-40.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-40.dat -> [Ver = |
Size = 268 bytes | Modified Date = 12/05/2008 16:47:34 |
Attr = H ]
eHomeLog-41.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-41.dat -> [Ver = |
Size = 268 bytes | Modified Date = 12/05/2008 17:54:08 |
Attr = H ]
eHomeLog-42.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-42.dat -> [Ver = |
Size = 268 bytes | Modified Date = 16/05/2008 17:44:04 |
Attr = H ]
eHomeLog-43.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-43.dat -> [Ver = |
Size = 268 bytes | Modified Date = 16/05/2008 18:28:58 |
Attr = H ]
eHomeLog-44.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-44.dat -> [Ver = |
Size = 268 bytes | Modified Date = 16/05/2008 18:41:33 |
Attr = H ]
eHomeLog-45.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-45.dat -> [Ver = |
Size = 268 bytes | Modified Date = 18/05/2008 12:16:31 |
Attr = H ]
eHomeLog-46.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-46.dat -> [Ver = |
Size = 268 bytes | Modified Date = 18/05/2008 13:21:33 |
Attr = H ]
eHomeLog-47.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-47.dat -> [Ver = |
Size = 268 bytes | Modified Date = 18/05/2008 20:23:45 |
Attr = H ]
eHomeLog-5.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-5.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 10:26:18 |
Attr = H ]
eHomeLog-6.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-6.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 10:34:28 |
Attr = H ]
eHomeLog-7.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-7.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 13:01:08 |
Attr = H ]
eHomeLog-8.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-8.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 14:00:04 |
Attr = H ]
eHomeLog-9.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\eHome\logs\eHomeLog-9.dat -> [Ver = |
Size = 268 bytes | Modified Date = 08/06/2008 15:23:17 |
Attr = H ]
C:\Documents and Settings\All Users\Application
Data\Microsoft\HTML Help\ -> C:\Documents and
Settings\All Users\Application Data\Microsoft\HTML Help
-> [Folder | Modified Date = 05/09/2007 14:52:10 | Attr
= ]
hhcolreg.dat -> C:\Documents and Settings\All
Users\Application Data\Microsoft\HTML Help\hhcolreg.dat
-> [Ver = | Size = 1345 bytes | Modified Date =
05/09/2007 14:52:10 | Attr = ]
C:\Documents and Settings\All Users\Application
Data\Microsoft\Network\Downloader\ -> C:\Documents and
Settings\All Users\Application
Data\Microsoft\Network\Downloader -> [Folder | Modified
Date = 08/06/2008 16:13:39 | Attr = ]
qmgr0.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\Network\Downloader\qmgr0.dat -> [Ver =
| Size = 5484 bytes | Modified Date = 10/06/2008
18:15:04 | Attr = ]
qmgr1.dat -> C:\Documents and Settings\All
Users\Application
Data\Microsoft\Network\Downloader\qmgr1.dat -> [Ver =
| Size = 5484 bytes | Modified Date = 10/06/2008
18:15:04 | Attr = ]
C:\Documents and Settings\All Users\Application
Data\Microsoft\OFFICE\DATA\ -> C:\Documents and
Settings\All Users\Application
Data\Microsoft\OFFICE\DATA -> [Folder | Modified Date =
11/09/2007 21:08:22 | Attr = ]
opa12.dat -> C:\Documents and Settings\All
Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat
-> [Ver = | Size = 8206 bytes | Modified Date =
11/09/2007 21:08:22 | Attr = ]
C:\Documents and Settings\Nolwenn\Local Settings\Temp\
-> C:\Documents and Settings\Nolwenn\Local Settings\Temp
-> [Folder | Modified Date = 10/06/2008 18:29:27 | Attr
= ]
ose00000.exe -> C:\Documents and Settings\Nolwenn\Local
Settings\Temp\ose00000.exe -> Microsoft Corporation [Ver
= 12.0.4518.1014 | Size = 145184 bytes | Modified Date =
28/10/2006 02:58:26 | Attr = R ]
C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp -> [Folder |
Modified Date = 10/06/2008 18:33:10 | Attr = ]
alcrmv.exe -> C:\WINDOWS\Temp\alcrmv.exe -> Realtek
Semiconductor Corp. [Ver = 2, 0, 0, 4 | Size = 217088
bytes | Modified Date = 31/07/2006 11:27:30 | Attr = R
]
alcupd.exe -> C:\WINDOWS\Temp\alcupd.exe -> Realtek
Semiconductor Corp. [Ver = 2, 2, 0, 3 | Size = 315392
bytes | Modified Date = 31/07/2006 11:19:24 | Attr = R
]
ChCfg.exe -> C:\WINDOWS\Temp\ChCfg.exe -> [Ver = |
Size = 49152 bytes | Modified Date = 01/08/2006 15:02:32
| Attr = R ]
RTLCPL.exe -> C:\WINDOWS\Temp\RTLCPL.exe -> Realtek
Semiconductor Corp. [Ver = 1.0.1.66 | Size = 10528768
bytes | Modified Date = 08/12/2006 15:20:14 | Attr = R
]
soundman.exe -> C:\WINDOWS\Temp\soundman.exe -> Realtek
Semiconductor Corp. [Ver = 5, 1, 0, 58 | Size = 577536
bytes | Modified Date = 17/11/2006 05:42:52 | Attr = R
]
C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp -> [Folder |
Modified Date = 10/06/2008 18:33:10 | Attr = ]
RtlCPAPI.dll -> C:\WINDOWS\Temp\RtlCPAPI.dll -> [Ver =
1, 0, 1, 4 | Size = 147456 bytes | Modified Date =
18/10/2006 02:53:26 | Attr = R ]
C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp -> [Folder |
Modified Date = 10/06/2008 18:33:10 | Attr = ]
Perflib_Perfdata_5d8.dat ->
C:\WINDOWS\Temp\Perflib_Perfdata_5d8.dat -> [Ver = |
Size = 16384 bytes | Modified Date = 08/06/2008 16:23:16
| Attr = ]
[Files Modified - Additional Folder Scans -
Non-Microsoft Only]
Avira -> %AllUsersProfile%\Application Data\Avira ->
[Folder | Modified Date = 09/06/2008 17:40:30 | Attr =
]
Kodak -> %AllUsersProfile%\Application Data\Kodak ->
[Folder | Modified Date = 08/06/2008 13:00:25 | Attr =
]
Lavasoft -> %AllUsersProfile%\Application Data\Lavasoft
-> [Folder | Modified Date = 18/05/2008 11:44:17 | Attr
= ]
Sony Ericsson -> %AllUsersProfile%\Application Data\Sony
Ericsson -> [Folder | Modified Date = 08/06/2008
17:09:49 | Attr = ]
Spybot - Search & Destroy ->
%AllUsersProfile%\Application Data\Spybot - Search &
Destroy -> [Folder | Modified Date = 12/05/2008
00:48:47 | Attr = ]
Teleca -> %AllUsersProfile%\Application Data\Teleca ->
[Folder | Modified Date = 08/06/2008 17:09:13 | Attr =
]
GDIPFONTCACHEV1.DAT -> %UserProfile%\Local
Settings\Application Data\GDIPFONTCACHEV1.DAT -> [Ver =
| Size = 80888 bytes | Modified Date = 18/05/2008
13:37:53 | Attr = ]
IconCache.db -> %UserProfile%\Local Settings\Application
Data\IconCache.db -> [Ver = | Size = 4322572 bytes |
Modified Date = 10/06/2008 08:52:10 | Attr = H ]
AntiVir PE Classic.lnk ->
%AllUsersProfile%\Desktop\AntiVir PE Classic.lnk ->
[Ver = | Size = 1851 bytes | Modified Date = 09/06/2008
17:41:17 | Attr = ]
ATF-Cleaner.exe -> %UserProfile%\Desktop\ATF-Cleaner.exe
-> Atribune.org [Ver = 3.00.0002 | Size = 50688 bytes |
Modified Date = 10/06/2008 18:26:17 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\ATF-Cleaner.exe:Zone.Identifier
install_Avira AntiVir Personal_.exe ->
%UserProfile%\Desktop\install_Avira AntiVir
Personal_.exe -> [Ver = | Size = 99383 bytes |
Modified Date = 09/06/2008 17:07:14 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\install_Avira AntiVir
Personal_.exe:Zone.Identifier
Lavasoft_Adaware2007_fr.exe ->
%UserProfile%\Desktop\Lavasoft_Adaware2007_fr.exe ->
[Ver = | Size = 21364592 bytes | Modified Date =
18/05/2008 11:40:18 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\Lavasoft_Adaware2007_fr.exe:Zone.I
dentifier
OTScanIt -> %UserProfile%\Desktop\OTScanIt -> [Folder |
Modified Date = 10/06/2008 18:28:10 | Attr = ]
OTScanIt.exe -> %UserProfile%\Desktop\OTScanIt.exe ->
[Ver = | Size = 568544 bytes | Modified Date =
10/06/2008 18:26:57 | Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\OTScanIt.exe:Zone.Identifier
Procédure_de.doc ->
%UserProfile%\Desktop\Procédure_de.doc -> [Ver = |
Size = 33812 bytes | Modified Date = 09/06/2008 17:37:45
| Attr = ]
@Alternate Data Stream - 26 bytes ->
%UserProfile%\Desktop\Procédure_de.doc:Zone.Identifier
Spybot - Search & Destroy.lnk ->
%UserProfile%\Desktop\Spybot - Search & Destroy.lnk ->
[Ver = | Size = 963 bytes | Modified Date = 18/05/2008
20:37:09 | Attr = ]
Sony Ericsson Shared -> %CommonProgramFiles%\Sony
Ericsson Shared -> [Folder | Modified Date = 08/06/2008
17:10:22 | Attr = ]
System -> %CommonProgramFiles%\System -> [Folder |
Modified Date = 09/06/2008 17:15:45 | Attr = ]
Teleca Shared -> %CommonProgramFiles%\Teleca Shared ->
[Folder | Modified Date = 08/06/2008 17:10:28 | Attr =
]
< End of report >
