[Closed] auto run... msi\fghij.pif

OTScanIt2 logfile created on: 3/24/2009 11:10:48 AM - Run 1
OTScanIt2 by OldTimer - Version 1.0.9.0 Folder = C:\Documents and Settings\erson\Desktop\OTScanIt2
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.25 Gb Total Physical Memory | 0.95 Gb Available Physical Memory | 76.33% Memory free
1.86 Gb Paging File | 1.63 Gb Available in Paging File | 87.80% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48.83 Gb Total Space | 30.07 Gb Free Space | 61.59% Space Free | Partition Type: NTFS
Drive D: | 25.69 Gb Total Space | 23.57 Gb Free Space | 91.73% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ERSON
Current User Name: erson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days

[Processes - Safe List]
abcde.pif -> %SystemDrive%\msi\abcde.pif -> [2008/08/04 05:42:10 | 00,382,459 | -HS- | M] ()
avesvc.exe -> %ProgramFiles%\Avira Premium Security Suite\avesvc.exe -> [2007/02/26 11:33:11 | 00,045,096 | —- | M] (Avira GmbH)
avfwsvc.exe -> %ProgramFiles%\Avira Premium Security Suite\avfwsvc.exe -> [2007/04/04 12:02:16 | 00,274,472 | —- | M] (Avira GmbH)
avguard.exe -> %ProgramFiles%\Avira Premium Security Suite\avguard.exe -> [2007/03/28 12:58:19 | 00,204,840 | —- | M] (Avira GmbH)
avmailc.exe -> %ProgramFiles%\Avira Premium Security Suite\avmailc.exe -> [2007/04/04 11:57:00 | 00,143,400 | —- | M] (Avira GmbH)
bcdef.pif -> %SystemDrive%\msi\bcdef.pif -> [2008/08/04 05:42:10 | 00,382,459 | -HS- | M] ()
bndmss.exe -> %SystemRoot%\system32\bndmss.exe -> [2008/11/07 08:35:57 | 00,030,720 | —- | M] ()
cdefg.pif -> %SystemDrive%\msi\cdefg.pif -> [2008/08/04 05:42:10 | 00,382,459 | -HS- | M] ()
defgh.pif -> %SystemDrive%\msi\defgh.pif -> [2008/08/04 05:42:10 | 00,382,459 | -HS- | M] ()
explorer.exe -> %SystemRoot%\explorer.exe -> [2006/01/13 01:46:46 | 01,075,200 | —- | M] (Microsoft Corporation)
jqs.exe -> %ProgramFiles%\Java\jre6\bin\jqs.exe -> [2008/11/10 05:43:40 | 00,152,984 | —- | M] (Sun Microsystems, Inc.)
nvsvc32.exe -> %SystemRoot%\system32\nvsvc32.exe -> [2005/11/11 12:47:00 | 00,131,139 | —- | M] (NVIDIA Corporation)
otscanit2.exe -> %UserProfile%\Desktop\OTScanIt2\OTScanIt2.exe -> [2009/03/22 18:23:22 | 00,491,520 | —- | M] (OldTimer Tools)
sched.exe -> %ProgramFiles%\Avira Premium Security Suite\sched.exe -> [2007/04/16 15:32:56 | 00,057,896 | —- | M] (Avira GmbH)
sdaemon.exe -> %SystemRoot%\sdaemon.exe -> [2005/04/18 21:57:14 | 00,111,104 | —- | M] (Tropical Software)
svchost.exe -> %SystemDrive%\heap41a\svchost.exe -> [2007/02/07 23:04:50 | 00,239,104 | R— | M] ()
winsersec.exe -> %SystemRoot%\system32\winsersec.exe -> [2005/04/13 22:37:32 | 00,053,248 | —- | M] ()
winwd.exe -> %SystemRoot%\winwd.exe -> [2005/04/18 21:56:41 | 00,026,624 | —- | M] ()

[Win32 Services - Safe List]
(AntiVirFirewallService) Avira Premium Security Suite Firewall [Win32_Own | Auto | Running] -> %ProgramFiles%\Avira Premium Security Suite\avfwsvc.exe -> [2007/04/04 12:02:16 | 00,274,472 | —- | M] (Avira GmbH)
(AntiVirMailService) Avira Premium Security Suite MailGuard [Win32_Own | Auto | Running] -> %ProgramFiles%\Avira Premium Security Suite\avmailc.exe -> [2007/04/04 11:57:00 | 00,143,400 | —- | M] (Avira GmbH)
(AntiVirScheduler) Avira Premium Security Suite Scheduler [Win32_Own | Auto | Running] -> %ProgramFiles%\Avira Premium Security Suite\sched.exe -> [2007/04/16 15:32:56 | 00,057,896 | —- | M] (Avira GmbH)
(AntiVirService) Avira Premium Security Suite Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\Avira Premium Security Suite\avguard.exe -> [2007/03/28 12:58:19 | 00,204,840 | —- | M] (Avira GmbH)
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -> [2005/09/23 07:28:32 | 00,029,896 | —- | M] (Microsoft Corporation)
(AVEService) Avira Premium Security Suite MailGuard helper service [Win32_Own | Auto | Running] -> %ProgramFiles%\Avira Premium Security Suite\avesvc.exe -> [2007/02/26 11:33:11 | 00,045,096 | —- | M] (Avira GmbH)
(BNDMSS) Windows Network Data Management System Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\bndmss.exe -> [2008/11/07 08:35:57 | 00,030,720 | —- | M] ()
(clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2005/09/23 07:28:56 | 00,066,240 | —- | M] (Microsoft Corporation)
(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> %SystemRoot%\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2006/01/13 01:30:46 | 00,038,912 | —- | M] (Microsoft Corporation)
(JavaQuickStarterService) Java Quick Starter [Win32_Own | Auto | Running] -> %ProgramFiles%\Java\jre6\bin\jqs.exe -> [2008/11/10 05:43:40 | 00,152,984 | —- | M] (Sun Microsystems, Inc.)
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\nvsvc32.exe -> [2005/11/11 12:47:00 | 00,131,139 | —- | M] (NVIDIA Corporation)
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE -> [2003/07/28 12:28:22 | 00,089,136 | —- | M] (Microsoft Corporation)
(ServiceLayer) ServiceLayer [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\PC Connectivity Solution\ServiceLayer.exe -> [2008/05/30 11:32:16 | 00,572,416 | —- | M] (Nokia.)
(UMWdf) Windows User Mode Driver Framework [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\system32\wdfmgr.exe -> [2006/01/13 01:13:18 | 00,038,912 | —- | M] (Microsoft Corporation)
(winser) winser [Win32_Own | Auto | Running] -> %SystemRoot%\system32\winsersec.exe -> [2005/04/13 22:37:32 | 00,053,248 | —- | M] ()

[Driver Services - Safe List]
(avfwim) AvFw Packet Filter Miniport [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\avfwim.sys -> [2007/03/12 11:38:14 | 00,053,504 | —- | M] (Avira GmbH)
(avfwot) avfwot [Kernel | System | Running] -> %SystemRoot%\system32\drivers\avfwot.sys -> [2007/03/27 17:05:53 | 00,057,344 | —- | M] (Avira GmbH)
(avgio) avgio [Kernel | System | Running] -> %ProgramFiles%\Avira Premium Security Suite\avgio.sys -> [2007/02/27 15:25:10 | 00,011,840 | —- | M] (Avira GmbH)
(avgntflt) avgntflt [File_System | On_Demand | Running] -> %ProgramFiles%\Avira Premium Security Suite\avgntflt.sys -> [2007/04/10 10:30:30 | 00,047,680 | —- | M] (Avira GmbH)
(avipbb) avipbb [Kernel | System | Running] -> %SystemRoot%\system32\DRIVERS\avipbb.sys -> [2007/03/20 09:55:45 | 00,043,584 | —- | M] (Avira GmbH)
(cmuda) C-Media WDM Audio Interface [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\cmuda.sys -> [2005/12/15 12:57:46 | 01,368,000 | —- | M] (C-Media Inc)
(DBKDRVR54) DBKDRVR54 [Kernel | On_Demand | Stopped] -> %ProgramFiles%\Cheat Engine\dbk32.sys -> [2009/01/27 18:43:54 | 00,036,096 | —- | M] ()
(FETND5BV) VIA Rhine-Family Fast Ethernet Adapter Driver Service [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\fetnd5bv.sys -> [2005/03/18 13:39:04 | 00,042,496 | —- | M] (VIA Technologies, Inc. )
(nmwcd) Nokia USB Phone Parent [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\ccdcmb.sys -> [2008/05/07 06:38:20 | 00,017,536 | —- | M] (Nokia)
(nmwcdc) Nokia USB Generic [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\ccdcmbo.sys -> [2008/05/07 06:38:20 | 00,020,864 | —- | M] (Nokia)
(NPPTNT2) NPPTNT2 [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\npptNT2.sys -> [2005/01/04 18:43:08 | 00,004,682 | —- | M] (INCA Internet Co., Ltd.)
(NTProcDrv) Process creation detector for NT. [Kernel | On_Demand | Stopped] -> %UserProfile%\Desktop\Speed Hack\CabalBotPH1.11\NtProcDrv.sys -> [2005/02/23 15:08:16 | 00,003,584 | —- | M] ()
(nv) nv [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\nv4_mini.sys -> [2005/11/11 12:47:00 | 03,532,928 | —- | M] (NVIDIA Corporation)
(pccsmcfd) PCCS Mode Change Filter Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\DRIVERS\pccsmcfd.sys -> [2007/09/17 14:53:26 | 00,021,632 | —- | M] (Nokia)
(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\ptilink.sys -> [2006/01/13 02:03:47 | 00,017,792 | —- | M] (Parallel Technologies, Inc.)
(PxHelp20) PxHelp20 [Kernel | Boot | Running] -> %SystemRoot%\System32\Drivers\PxHelp20.sys -> [2008/11/06 16:37:28 | 00,043,528 | —- | M] (Sonic Solutions)
(Secdrv) Secdrv [Kernel | Auto | Running] -> %SystemRoot%\system32\DRIVERS\secdrv.sys -> [2006/01/13 01:14:52 | 00,163,644 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
(sfdrv01) StarForce Protection Environment Driver (version 1.x) [Kernel | Boot | Running] -> %SystemRoot%\System32\drivers\sfdrv01.sys -> [2005/08/10 12:44:04 | 00,050,688 | —- | M] (Protection Technology)
(sfhlp02) StarForce Protection Helper Driver (version 2.x) [Kernel | Boot | Running] -> %SystemRoot%\System32\drivers\sfhlp02.sys -> [2005/05/16 13:20:39 | 00,006,656 | —- | M] (Protection Technology)
(sfsync02) StarForce Protection Synchronization Driver (version 2.x) [Kernel | Boot | Running] -> %SystemRoot%\System32\drivers\sfsync02.sys -> [2005/08/10 14:06:28 | 00,019,968 | —- | M] (Protection Technology)
(sfvfs02) StarForce Protection VFS Driver (version 2.x) [Kernel | Boot | Running] -> %SystemRoot%\System32\drivers\sfvfs02.sys -> [2005/09/29 17:01:51 | 00,066,048 | —- | M] (Protection Technology)
(ssmdrv) ssmdrv [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\DRIVERS\ssmdrv.sys -> [2007/03/01 10:34:36 | 00,028,352 | —- | M] (Avira GmbH)
(viaagp1) VIA AGP Filter [Kernel | Boot | Running] -> %SystemRoot%\system32\DRIVERS\viaagp1.sys -> [2003/07/02 03:42:00 | 00,027,904 | —- | M] (VIA Technologies, Inc.)
(WINSEC) WINSEC [File_System | Boot | Running] -> %SystemRoot%\system32\drivers\WINSEC.SYS -> [2005/04/18 21:57:28 | 00,020,352 | —- | M] (Tropical Software)

[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> ->
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome ->
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com ->
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm ->
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com ->
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home ->
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKEY_LOCAL_MACHINE\: Search\\"CustomSearch" -> http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html ->
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> ->
HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm ->
HKEY_CURRENT_USER\: Main\\"Page_Transitions" -> Reg Error: Invalid data type. ->
HKEY_CURRENT_USER\: Main\\"Search Page" -> http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com ->
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.yahoo.com/ ->
HKEY_CURRENT_USER\: SearchURL\\"" -> http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com ->
HKEY_CURRENT_USER\: SearchURL\\"provider" -> ->
HKEY_CURRENT_USER\: URLSearchHooks\\"{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" [HKLM] -> %ProgramFiles%\Search Settings\kb127\SearchSettings.dll [SearchSettings Class] -> [2008/06/12 16:57:18 | 01,111,904 | —- | M] (Vendio Services, Inc.)
HKEY_CURRENT_USER\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> ->
HKEY_USERS\.DEFAULT\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> ->
HKEY_USERS\S-1-5-18\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> ->
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: Main\\"Page_Transitions" -> Reg Error: Invalid data type. ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: Main\\"Search Page" -> http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: Main\\"Start Page" -> http://www.yahoo.com/ ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: SearchURL\\"" -> http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: SearchURL\\"provider" -> ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: URLSearchHooks\\"{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" [HKLM] -> %ProgramFiles%\Search Settings\kb127\SearchSettings.dll [SearchSettings Class] -> [2008/06/12 16:57:18 | 01,111,904 | —- | M] (Vendio Services, Inc.)
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\: "ProxyEnable" -> 0 ->
< FireFox Settings [Prefs.js] > -> C:\Documents and Settings\erson\Application Data\Mozilla\FireFox\Profiles\28caqifa.default\prefs.js ->
browser.search.defaultenginename -> "Yahoo" ->
browser.search.defaulturl -> "http://search.yahoo.com/search?fr=ffsp1&p=" ->
browser.search.selectedEngine -> "Search" ->
browser.startup.homepage -> "http://www.google.com/" ->
extensions.enabledItems -> {463F6CA5-EE3C-4be1-B7E6-7FEE11953374}:3.0.3.1 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11 ->
extensions.enabledItems -> [removed]:1.0 ->
extensions.enabledItems -> {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.0.20080712 ->
extensions.enabledItems -> {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.1 ->
keyword.URL -> "http://search.yahoo.com/search?fr=ffds1&p=" ->
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\extensions -> ->
HKLM\software\mozilla\Firefox\extensions\\[removed] -> %ProgramFiles%\JAVA\JRE6\LIB\DEPLOY\JQS\FF [C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF] -> [2004/02/01 21:52:00 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions -> ->
HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components -> %ProgramFiles%\MOZILLA FIREFOX\COMPONENTS [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2004/02/19 20:21:15 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins -> %ProgramFiles%\MOZILLA FIREFOX\PLUGINS [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2009/03/02 20:33:18 | 00,000,000 | —D | M]
< FireFox Extensions [User Folders] > ->
-> C:\Documents and Settings\erson\Application Data\mozilla\Extensions -> [2009/02/03 03:38:21 | 00,000,000 | —D | M]
-> C:\Documents and Settings\erson\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} -> [2009/02/03 03:38:21 | 00,000,000 | —D | M]
-> C:\Documents and Settings\erson\Application Data\mozilla\Firefox\Profiles\28caqifa.default\extensions -> [2009/02/05 00:42:29 | 00,097,654 | —- | M] ()
-> C:\Documents and Settings\erson\Application Data\mozilla\Firefox\Profiles\28caqifa.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} -> [2009/02/05 00:42:29 | 00,097,654 | —- | M] ()
< FireFox SearchPlugins [User Folders] > ->
C:\Documents and Settings\erson\Application Data\Mozilla\FireFox\Profiles\28caqifa.default\searchplugins\ -> C:\Documents and Settings\erson\Application Data\Mozilla\FireFox\Profiles\28caqifa.default\searchplugins -> [2004/01/20 02:48:20 | 00,000,000 | —D | M]
search.xml -> C:\Documents and Settings\erson\Application Data\Mozilla\FireFox\Profiles\28caqifa.default\searchplugins\search.xml -> [2004/01/20 02:48:35 | 00,000,274 | —- | M] ()
< FireFox Extensions [Program Folders] > ->
-> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions -> [2008/07/03 01:52:44 | 09,704,960 | —- | M] (Mozilla Foundation)
-> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} -> [2008/07/03 01:52:44 | 09,704,960 | —- | M] (Mozilla Foundation)
-> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} -> [2008/07/03 01:52:44 | 09,704,960 | —- | M] (Mozilla Foundation)
-> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} -> [2008/07/03 01:52:44 | 09,704,960 | —- | M] (Mozilla Foundation)
-> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} -> [2008/07/03 01:52:44 | 09,704,960 | —- | M] (Mozilla Foundation)
-> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} -> [2008/07/03 01:52:44 | 09,704,960 | —- | M] (Mozilla Foundation)
< FireFox Components [Program Folders] > ->
C:\PROGRAM FILES\MOZILLA FIREFOX\components\ -> C:\PROGRAM FILES\MOZILLA FIREFOX\components -> [2004/02/19 20:21:15 | 00,000,000 | —D | M]
browserdirprovider.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\components\browserdirprovider.dll -> [2008/07/03 01:52:45 | 00,023,040 | —- | M] (Mozilla Foundation)
brwsrcmp.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\components\brwsrcmp.dll -> [2008/07/03 01:52:46 | 00,134,144 | —- | M] (Mozilla Foundation)
< FireFox Plugins [Program Folders] > ->
C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\ -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins -> [2009/03/02 20:33:18 | 00,000,000 | —D | M]
np32dsw.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\np32dsw.dll -> [2009/01/16 19:17:04 | 00,114,688 | —- | M] (Adobe Systems, Inc.)
npdeploytk.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npdeploytk.dll -> [2008/11/10 05:43:30 | 00,410,984 | —- | M] (Sun Microsystems, Inc.)
npdivx32.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npdivx32.dll -> [2008/11/06 16:33:48 | 01,332,224 | —- | M] (DivX,Inc.)
npdivx32.xpt -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npdivx32.xpt -> [2008/11/06 16:33:50 | 00,001,607 | —- | M] ()
npDivxPlayerPlugin.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npDivxPlayerPlugin.dll -> [2008/12/11 00:33:34 | 00,098,304 | —- | M] (DivX, Inc)
npnul32.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npnul32.dll -> [2008/07/03 01:52:47 | 00,065,536 | —- | M] (mozilla.org)
nsIDivxPlayerPlugin.xpt -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\nsIDivxPlayerPlugin.xpt -> [2008/11/06 16:34:08 | 00,000,297 | —- | M] ()
ShockwavePlugin.class -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\ShockwavePlugin.cla -> [2009/01/16 18:41:58 | 00,001,144 | —- | M] ()
< FireFox SearchPlugins [Program Folders] > ->
C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\ -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins -> [2004/01/20 11:08:38 | 00,000,000 | —D | M]
amazondotcom.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\amazondotcom.xml -> [2008/07/02 16:31:38 | 00,001,394 | —- | M] ()
answers.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\answers.xml -> [2008/07/02 16:31:38 | 00,002,193 | —- | M] ()
creativecommons.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\creativecommons.xml -> [2008/07/02 16:31:38 | 00,001,534 | —- | M] ()
eBay.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\eBay.xml -> [2008/07/02 16:31:38 | 00,002,642 | —- | M] ()
google.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\google.xml -> [2008/07/02 16:31:38 | 00,001,706 | —- | M] ()
wikipedia.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\wikipedia.xml -> [2008/07/02 16:31:38 | 00,001,178 | —- | M] ()
yahoo.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\yahoo.xml -> [2008/07/02 16:31:38 | 00,000,792 | —- | M] ()
< HOSTS File > (302820 bytes and 10481 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts ->
First 25 entries…
Reset Hosts
127.0.0.1 localhost
61.110.88.200 nprotect.co.kr
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1001namen.com
127.0.0.1 1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{02478D38-C3F9-4efb-9B51-7695ECA05670} [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [&Yahoo! Toolbar Helper] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %ProgramFiles%\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> [2005/09/23 17:12:08 | 00,063,136 | —- | M] (Adobe Systems Incorporated)
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2009/01/26 15:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2007/12/12 22:09:42 | 00,222,448 | —- | M] (Yahoo! Inc.)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre6\bin\ssv.dll [Java™ Plug-In SSV Helper] -> [2008/11/10 05:43:31 | 00,320,920 | —- | M] (Sun Microsystems, Inc.)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> %ProgramFiles%\Java\jre6\bin\jp2ssv.dll [Java™ Plug-In 2 SSV Helper] -> [2008/11/10 05:43:16 | 00,034,816 | —- | M] (Sun Microsystems, Inc.)
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} [HKLM] -> %ProgramFiles%\Search Settings\kb127\SearchSettings.dll [SearchSettings Class] -> [2008/06/12 16:57:18 | 01,111,904 | —- | M] (Vendio Services, Inc.)
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} [HKLM] -> %ProgramFiles%\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [JQSIEStartDetectorImpl Class] -> [2008/11/10 05:43:17 | 00,073,728 | —- | M] (Sun Microsystems, Inc.)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar ->
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\"{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\"{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/05/15 19:40:40 | 00,817,936 | —- | M] (Yahoo! Inc.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"Cmaudio" -> [RunDll32 cmicnfg.cpl,CMICtrlWnd] -> File not found
"fghij" -> %SystemDrive%\msi\fghij.pif [C:\msi\fghij.pif] -> [2008/08/04 13:35:32 | 00,655,096 | -HS- | M] ()
"NvCplDaemon" -> %SystemRoot%\system32\NvCpl.DLL [RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup] -> [2005/11/11 12:47:00 | 07,311,360 | —- | M] (NVIDIA Corporation)
"NvMediaCenter" -> %SystemRoot%\system32\NvMcTray.DLL [RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit] -> [2005/11/11 12:47:00 | 00,086,016 | —- | M] (NVIDIA Corporation)
"nwiz" -> %SystemRoot%\system32\nwiz.exe [nwiz.exe /install] -> [2005/11/11 12:47:00 | 01,519,616 | —- | M] ()
"SDaemon" -> %SystemRoot%\sdaemon.exe [C:\WINDOWS\sdaemon.exe] -> [2005/04/18 21:57:14 | 00,111,104 | —- | M] (Tropical Software)
"SWd" -> %SystemRoot%\winwd.exe [C:\WINDOWS\winwd.exe] -> [2005/04/18 21:56:41 | 00,026,624 | —- | M] ()
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"fghij" -> %SystemDrive%\msi\fghij.pif [C:\msi\fghij.pif] -> [2008/08/04 13:35:32 | 00,655,096 | -HS- | M] ()
"SpybotSD TeaTimer" -> %ProgramFiles%\Spybot - Search & Destroy\TeaTimer.exe [C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe] -> [2009/01/26 15:31:16 | 02,144,088 | RHS- | M] (Safer Networking Limited)
< Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"msnsc" -> %SystemRoot%\system32\msnsc.exe [C:\WINDOWS\system32\msnsc.exe] -> [2006/01/13 01:36:08 | 00,062,054 | —- | M] (dgelwin )
< RunOnce [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ->
"nlsf" -> %SystemRoot%\system32\cmd.exe [cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"] -> [2006/01/13 01:49:10 | 00,388,608 | —- | M] (Microsoft Corporation)
"tscuninstall" -> %SystemRoot%\system32\tscupgrd.exe [%systemroot%\system32\tscupgrd.exe] -> [2006/01/13 01:25:59 | 00,044,544 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"msnsc" -> %SystemRoot%\system32\msnsc.exe [C:\WINDOWS\system32\msnsc.exe] -> [2006/01/13 01:36:08 | 00,062,054 | —- | M] (dgelwin )
< RunOnce [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ->
"nlsf" -> %SystemRoot%\system32\cmd.exe [cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"] -> [2006/01/13 01:49:10 | 00,388,608 | —- | M] (Microsoft Corporation)
"tscuninstall" -> %SystemRoot%\system32\tscupgrd.exe [%systemroot%\system32\tscupgrd.exe] -> [2006/01/13 01:25:59 | 00,044,544 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"msnsc" -> %SystemRoot%\system32\msnsc.exe [C:\WINDOWS\system32\msnsc.exe] -> [2006/01/13 01:36:08 | 00,062,054 | —- | M] (dgelwin )
< RunOnce [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ->
"nlsf" -> %SystemRoot%\system32\cmd.exe [cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"] -> [2006/01/13 01:49:10 | 00,388,608 | —- | M] (Microsoft Corporation)
"tscuninstall" -> %SystemRoot%\system32\tscupgrd.exe [%systemroot%\system32\tscupgrd.exe] -> [2006/01/13 01:25:59 | 00,044,544 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"msnsc" -> %SystemRoot%\system32\msnsc.exe [C:\WINDOWS\system32\msnsc.exe] -> [2006/01/13 01:36:08 | 00,062,054 | —- | M] (dgelwin )
< RunOnce [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ->
"nlsf" -> %SystemRoot%\system32\cmd.exe [cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"] -> [2006/01/13 01:49:10 | 00,388,608 | —- | M] (Microsoft Corporation)
"tscuninstall" -> %SystemRoot%\system32\tscupgrd.exe [%systemroot%\system32\tscupgrd.exe] -> [2006/01/13 01:25:59 | 00,044,544 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
"fghij" -> %SystemDrive%\msi\fghij.pif [C:\msi\fghij.pif] -> [2008/08/04 13:35:32 | 00,655,096 | -HS- | M] ()
"SpybotSD TeaTimer" -> %ProgramFiles%\Spybot - Search & Destroy\TeaTimer.exe [C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe] -> [2009/01/26 15:31:16 | 02,144,088 | RHS- | M] (Safer Networking Limited)
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup ->
-> %AllUsersProfile%\Start Menu\Programs\Startup\fghij.pif -> [2008/08/04 13:35:32 | 00,655,096 | —- | M] ()
< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup ->
< erson Startup Folder > -> C:\Documents and Settings\erson\Start Menu\Programs\Startup ->
< Software Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408\\"Iexplore.exe" -> [1] -> File not found
\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408\\"BufferBreakingSize" -> [10485760] -> File not found
< Software Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer
\\"Windows Update Menu Text" -> [Microsoft Update] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
< Software Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer
\\"Windows Update Menu Text" -> [Microsoft Update] -> File not found
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
< Software Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer
\\"Windows Update Menu Text" -> [Microsoft Update] -> File not found
HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
< Software Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer
\\"Windows Update Menu Text" -> [Microsoft Update] -> File not found
HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
< Software Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer
\\"Windows Update Menu Text" -> [Microsoft Update] -> File not found
HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
< Software Policy Settings [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Policies\Microsoft\Internet Explorer ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\Software\Policies\Microsoft\Internet Explorer
\\"Windows Update Menu Text" -> [Microsoft Update] -> File not found
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\Software\Policies\Microsoft\Internet Explorer\Main\Feature Control
\Main\Feature Control\\"IMAGING_EMF_USE_RCLFRAMESIZE_KB905299" -> [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoRemoteRecursiveEvents" -> [1] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
\Run\\"status" -> [present] -> File not found
\Run\\"winlogon" -> %SystemDrive%\heap41a\svchost.exe [C:\heap41a\svchost.exe C:\heap41a\std.txt] -> [2007/02/07 23:04:50 | 00,239,104 | R— | M] ()
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" -> [0] -> File not found
\\"legalnoticecaption" -> [] -> File not found
\\"legalnoticetext" -> [] -> File not found
\\"shutdownwithoutlogon" -> [1] -> File not found
\\"undockwithoutlogon" -> [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
\\"NoInternetIcon" -> [0] -> File not found
\\"ClearRecentDocsOnExit" -> [1] -> File not found
\\"NoLowDiskSpaceChecks" -> [1] -> File not found
\\"NoSaveSettings" -> [0] -> File not found
< CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"disableregistrytools" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
\\"NoInternetIcon" -> [0] -> File not found
\\"ClearRecentDocsOnExit" -> [1] -> File not found
\\"NoLowDiskSpaceChecks" -> [1] -> File not found
\\"NoSaveSettings" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
\\"NoInternetIcon" -> [0] -> File not found
\\"ClearRecentDocsOnExit" -> [1] -> File not found
\\"NoLowDiskSpaceChecks" -> [1] -> File not found
\\"NoSaveSettings" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
\\"NoInternetIcon" -> [0] -> File not found
\\"ClearRecentDocsOnExit" -> [1] -> File not found
\\"NoLowDiskSpaceChecks" -> [1] -> File not found
\\"NoSaveSettings" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
\\"NoInternetIcon" -> [0] -> File not found
\\"ClearRecentDocsOnExit" -> [1] -> File not found
\\"NoLowDiskSpaceChecks" -> [1] -> File not found
\\"NoSaveSettings" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
\\"NoInternetIcon" -> [0] -> File not found
\\"ClearRecentDocsOnExit" -> [1] -> File not found
\\"NoLowDiskSpaceChecks" -> [1] -> File not found
\\"NoSaveSettings" -> [0] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"disableregistrytools" -> [0] -> File not found
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ ->
E&xport to Microsoft Excel -> %ProgramFiles%\Microsoft Office\OFFICE11\EXCEL.EXE [res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000] -> [2005/05/27 01:06:54 | 10,095,808 | —- | M] (Microsoft Corporation)
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\Software\Microsoft\Internet Explorer\MenuExt\ ->
E&xport to Microsoft Excel -> %ProgramFiles%\Microsoft Office\OFFICE11\EXCEL.EXE [res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000] -> [2005/05/27 01:06:54 | 10,095,808 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}:{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Button: Yahoo! Services] -> [2007/12/12 22:09:42 | 00,222,448 | —- | M] (Yahoo! Inc.)
{92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Button: Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
{B205A35E-1FC4-4CE3-818B-899DBBB3388C}:{552781AF-37E4-4FEE-920A-CED9E648EADD} [HKLM] -> %CommonProgramFiles%\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL [Button: Encarta Search Bar] -> [2007/05/21 11:00:20 | 00,293,656 | —- | M] (Microsoft Corporation)
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}" [HKLM] -> %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2007/12/12 22:09:42 | 00,222,448 | —- | M] (Yahoo! Inc.)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
CmdMapping\\"{E908B145-C847-4e85-B315-07E2E70DECF8}" [HKLM] -> [Reg Error: Key error.] -> File not found
< Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}" [HKLM] -> %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2007/12/12 22:09:42 | 00,222,448 | —- | M] (Yahoo! Inc.)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
CmdMapping\\"{E908B145-C847-4e85-B315-07E2E70DECF8}" [HKLM] -> [Reg Error: Key error.] -> File not found
< Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}" [HKLM] -> %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2007/12/12 22:09:42 | 00,222,448 | —- | M] (Yahoo! Inc.)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
CmdMapping\\"{E908B145-C847-4e85-B315-07E2E70DECF8}" [HKLM] -> [Reg Error: Key error.] -> File not found
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}" [HKLM] -> %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2007/12/12 22:09:42 | 00,222,448 | —- | M] (Yahoo! Inc.)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> %ProgramFiles%\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
CmdMapping\\"{E908B145-C847-4e85-B315-07E2E70DECF8}" [HKLM] -> [Reg Error: Key error.] -> File not found
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ ->
PluginsPageFriendlyName -> Microsoft ActiveX Gallery ->
PluginsPage -> http://activex.microsoft.com/controls/find…=%s&mime=%s ->
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5445 domain(s) found. ->
49 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. ->
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5443 domain(s) found. ->
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5444 domain(s) found. ->
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5444 domain(s) found. ->
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. ->
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5443 domain(s) found. ->
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\] > -> HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_USERS\S-1-5-21-1214440339-1454471165-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. ->
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{30528230-99f7-4bb4-88d8-fa1d4f56a2ab} [HKLM] -> C:\Program Files\Yahoo!\Common\Yinsthelper.dll [Installation Support] ->
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab [Java Plug-in 1.6.0_11] ->
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab [Java Plug-in 1.6.0_11] ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab [Java Plug-in 1.6.0_11] ->
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwa…ash/swflash.cab [Shockwave Flash Object] ->
< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ ->
{3C398049-B385-4134-80BF-26D0CF311F34} -> (VIA Rhine II Fast Ethernet Adapter) ->
{ABC9A104-ACB8-417A-BF6B-FDAE6B405835} -> (VIA Rhine II Fast Ethernet Adapter) ->
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell ->
Explorer.exe -> %SystemRoot%\Explorer.exe -> [2006/01/13 01:46:46 | 01,075,200 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> ->
*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit ->
C:\msi\usirinit.exe -> %SystemDrive%\msi\usirinit.exe -> [2008/08/04 13:35:32 | 00,655,096 | -HS- | M] ()
*MultiFile Done* -> ->
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
AtiExtEvent -> -> File not found
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List ->
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2006/01/13 01:58:04 | 00,140,800 | —- | M] (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5] -> [2005/12/14 11:13:24 | 07,095,344 | —- | M] (Microsoft Corporation)
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ->
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2006/01/13 01:58:04 | 00,140,800 | —- | M] (Microsoft Corporation)
"C:\Documents and Settings\erson\Desktop\CabalBotPH1.11\cabalbot.exe" -> C:\Documents and Settings\erson\Desktop\CabalBotPH1.11\cabalbot.exe [C:\Documents and Settings\erson\Desktop\CabalBotPH1.11\cabalbot.exe:*:Enabled:HookSrv] -> File not found
"C:\Documents and Settings\erson\Desktop\CabalTemp\ESTSetupLoader.exe" -> C:\Documents and Settings\erson\Desktop\CabalTemp\ESTSetupLoader.exe [C:\Documents and Settings\erson\Desktop\CabalTemp\ESTSetupLoader.exe:*:Enabled:EST! download engine] -> File not found
"C:\Documents and Settings\erson\Desktop\New Folder (3)\cabalbot.exe" -> C:\Documents and Settings\erson\Desktop\New Folder (3)\cabalbot.exe [C:\Documents and Settings\erson\Desktop\New Folder (3)\cabalbot.exe:*:Enabled:HookSrv] -> File not found
"C:\Documents and Settings\erson\Desktop\New Folder\cabalbot.exe" -> C:\Documents and Settings\erson\Desktop\New Folder\cabalbot.exe [C:\Documents and Settings\erson\Desktop\New Folder\cabalbot.exe:*:Enabled:HookSrv] -> File not found
"C:\Documents and Settings\erson\Desktop\New Folder\CabalBotPH1.09\cabalbot.exe" -> C:\Documents and Settings\erson\Desktop\New Folder\CabalBotPH1.09\cabalbot.exe [C:\Documents and Settings\erson\Desktop\New Folder\CabalBotPH1.09\cabalbot.exe:*:Enabled:HookSrv] -> File not found
"C:\Documents and Settings\erson\Desktop\Speed Hack\CabalBotPH1.11\cabalbot.exe" -> C:\Documents and Settings\erson\Desktop\Speed Hack\CabalBotPH1.11\cabalbot.exe [C:\Documents and Settings\erson\Desktop\Speed Hack\CabalBotPH1.11\cabalbot.exe:*:Enabled:HookSrv] -> [2009/02/03 15:29:28 | 00,065,536 | —- | M] ()
"C:\Documents and Settings\erson\skp66.exe" -> C:\Documents and Settings\erson\skp66.exeskp66.exe [C:\Documents and Settings\erson\skp66.exeskp66.exe:*:Enabled:BNDMSS] -> File not found
"C:\Level Up! Games\Grand Chase PH\main.exe" -> C:\Level Up! Games\Grand Chase PH\main.exe [C:\Level Up! Games\Grand Chase PH\main.exe:*:Enabled:GrandChase] -> [2004/01/09 10:46:55 | 03,884,032 | —- | M] ()
"C:\Program Files\e-Games\CABAL Online (PH)\launcher\update\ESTdnheadless.exe" -> C:\Program Files\e-Games\CABAL Online (PH)\launcher\update\ESTdnheadless.exe [C:\Program Files\e-Games\CABAL Online (PH)\launcher\update\ESTdnheadless.exe:*:Enabled:EST! download engine] -> [2007/07/10 08:41:46 | 00,036,864 | —- | M] ()
"C:\Program Files\Garena\Garena.exe" -> C:\Program Files\Garena\Garena.exe [C:\Program Files\Garena\Garena.exe:*:Enabled:Garena] -> [2009/03/09 15:52:44 | 03,287,312 | —- | M] (Garena Interactive PTE LTD)
"C:\Program Files\LimeWire\LimeWire.exe" -> C:\Program Files\LimeWire\LimeWire.exe [C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire] -> File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5] -> [2005/12/14 11:13:24 | 07,095,344 | —- | M] (Microsoft Corporation)
"C:\Program Files\MYGAME\Special Force\specialforce.exe" -> C:\Program Files\MYGAME\Special Force\specialforce.exe [C:\Program Files\MYGAME\Special Force\specialforce.exe:*:Enabled:specialforce] -> [2009/02/27 05:20:12 | 01,806,336 | —- | M] ()
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger] -> [2007/08/30 16:43:18 | 04,670,704 | —- | M] (Yahoo! Inc.)
"C:\Program Files\Yahoo!\Messenger\YServer.exe" -> C:\Program Files\Yahoo!\Messenger\YServer.exe [C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server] -> [2007/08/30 16:43:18 | 00,091,376 | —- | M] (Yahoo! Inc.)
"C:\WINDOWS\system32\bndmss.exe" -> C:\WINDOWS\system32\bndmss.exe [C:\WINDOWS\system32\bndmss.exe:*:Enabled:BNDMSS] -> [2008/11/07 08:35:57 | 00,030,720 | —- | M] ()
"skp66.exe" -> [skp66.exe:*:Enabled:BNDMSS] -> File not found
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 ->
"DisplayName" -> CD-ROM Driver ->
"ImagePath" -> %SystemRoot%\system32\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2006/01/13 01:32:41 | 00,049,536 | —- | M] (Microsoft Corporation)
< Drives with AutoRun files > -> ->
C:\AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] -> [2004/01/20 02:48:54 | 00,000,000 | —- | M] ()
C:\autorun.inf [[autorun] | open=efghi.pif | shell\open\Command=efghi.pif | shell\open\Default=1 | shell\explore\Command=efghi.pif | shell\explore\Default=2 | | | | | ] -> %SystemDrive%\autorun.inf [ NTFS ] -> [2008/08/04 04:42:39 | 00,000,144 | RHS- | M] ()
D:\autorun.inf [[autorun] | open=efghi.pif | shell\open\Command=efghi.pif | shell\open\Default=1 | shell\explore\Command=efghi.pif | shell\explore\Default=2 | | | | | ] -> D:\autorun.inf [ NTFS ] -> [2008/08/04 04:42:39 | 00,000,144 | RHS- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ->
\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}\Shell
\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}\Shell\Auto\command
\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}\Shell\Auto\command\\"" -> F:\MicrosoftPowerPoint.exe [F:\MicrosoftPowerPoint.exe] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}\Shell\AutoRun
\{0a4ed5bc-aca7-11dd-9311-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
\{17483906-5adc-11d8-92e5-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17483906-5adc-11d8-92e5-00115bc2ccce}\Shell
\{17483906-5adc-11d8-92e5-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17483906-5adc-11d8-92e5-00115bc2ccce}\Shell\Auto\command
\{17483906-5adc-11d8-92e5-00115bc2ccce}\Shell\Auto\command\\"" -> E:\MicrosoftPowerPoint.exe [E:\MicrosoftPowerPoint.exe] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{17483906-5adc-11d8-92e5-00115bc2ccce}\Shell\AutoRun
\{17483906-5adc-11d8-92e5-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}\Shell
\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}\Shell\Auto\command
\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}\Shell\Auto\command\\"" -> F:\MicrosoftPowerPoint.exe [F:\MicrosoftPowerPoint.exe] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}\Shell\AutoRun
\{1e4f5424-54e6-11d8-9c9b-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
\{567e3664-49fe-11d8-998c-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{567e3664-49fe-11d8-998c-00115bc2ccce}\Shell
\{567e3664-49fe-11d8-998c-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{567e3664-49fe-11d8-998c-00115bc2ccce}\Shell\Auto\command
\{567e3664-49fe-11d8-998c-00115bc2ccce}\Shell\Auto\command\\"" -> F:\MicrosoftPowerPoint.exe [F:\MicrosoftPowerPoint.exe] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{567e3664-49fe-11d8-998c-00115bc2ccce}\Shell\AutoRun
\{567e3664-49fe-11d8-998c-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
\{5b4c3380-156e-11de-ba23-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b4c3380-156e-11de-ba23-00115bc2ccce}\Shell\AutoRun\command
\{5b4c3380-156e-11de-ba23-00115bc2ccce}\Shell\AutoRun\command\\"" -> E:\efghi.pif [E:\efghi.pif] -> File not found
\{5b4c3380-156e-11de-ba23-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b4c3380-156e-11de-ba23-00115bc2ccce}\Shell\explore\Command
\{5b4c3380-156e-11de-ba23-00115bc2ccce}\Shell\explore\Command\\"" -> E:\efghi.pif [E:\efghi.pif] -> File not found
\{5b4c3380-156e-11de-ba23-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b4c3380-156e-11de-ba23-00115bc2ccce}\Shell\open\Command
\{5b4c3380-156e-11de-ba23-00115bc2ccce}\Shell\open\Command\\"" -> E:\efghi.pif [E:\efghi.pif] -> File not found
\{8018c5aa-b75f-11dd-9347-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8018c5aa-b75f-11dd-9347-00115bc2ccce}\Shell
\{8018c5aa-b75f-11dd-9347-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8018c5aa-b75f-11dd-9347-00115bc2ccce}\Shell\AutoRun
\{8018c5aa-b75f-11dd-9347-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}\Shell
\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}\Shell\AutoRun
\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}\Shell\AutoRun\command
\{94ccaa6c-3c85-11d8-93ba-00115bc2ccce}\Shell\AutoRun\command\\"" -> F:\LaunchU3.exe [F:\LaunchU3.exe -a] -> File not found
\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}\Shell
\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}\Shell\\"" -> [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}\Shell\Auto\command
\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}\Shell\Auto\command\\"" -> G:\MicrosoftPowerPoint.exe [G:\MicrosoftPowerPoint.exe] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}\Shell\AutoRun
\{94ccaa6d-3c85-11d8-93ba-00115bc2ccce}\Shell\AutoRun\\"" -> [Auto&Play] -> File not found
\{9cda142c-b92d-11dd-934a-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9cda142c-b92d-11dd-934a-00115bc2ccce}\Shell\AutoRun\command
\{9cda142c-b92d-11dd-934a-00115bc2ccce}\Shell\AutoRun\command\\"" -> F:\b0j6j16.bat [F:\b0j6j16.bat] -> File not found
\{9cda142c-b92d-11dd-934a-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9cda142c-b92d-11dd-934a-00115bc2ccce}\Shell\explore\Command
\{9cda142c-b92d-11dd-934a-00115bc2ccce}\Shell\explore\Command\\"" -> F:\b0j6j16.bat [F:\b0j6j16.bat] -> File not found
\{9cda142c-b92d-11dd-934a-00115bc2ccce}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9cda142c-b92d-11dd-934a-00115bc2ccce}\Shell\open\Command
\{9cda142c-b92d-11dd-934a-00115bc2ccce}\Shell\open\Command\\"" -> F:\b0j6j16.bat [F:\b0j6j16.bat] -> File not found

[Registry - Additional Scans - Safe List]
< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Application [ Error ] 1/1/2004 1:43:01 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:45:37 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:45:38 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:45:38 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:45:39 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:46:28 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:46:29 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:46:29 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 1/1/2004 1:46:30 AM Computer Name = ERSON | Source = crypt32 | ID = 131083 -> Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Application [ Error ] 11/7/2008 8:41:56 AM Computer Name = ERSON | Source = Application Error | ID = 1000 -> Description = Faulting application garena.exe, version 3.1.0.1568, faulting module wc3ladder.dll, version 0.9.4.2, fault address 0x00010200.
System [ Error ] 12/31/2003 8:00:50 PM Computer Name = ERSON | Source = W32Time | ID = 39452701 -> Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time.
System [ Error ] 12/31/2003 8:01:07 PM Computer Name = ERSON | Source = W32Time | ID = 39452706 -> Description = The time service has detected that the system time needs to be changed by +146802967 seconds. The time service will not change the system time by more than +54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|192.168.1.100:123->[removed]:123) is working properly.
System [ Error ] 12/31/2003 10:17:32 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:09:04 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:01:16 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:00:52 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:02:10 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:01:18 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:01:21 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease [removed] for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
System [ Error ] 12/31/2003 8:02:05 PM Computer Name = ERSON | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.100 for the Network Card with network address 00115BC2CCCE has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

[Files/Folders - Created Within 30 Days]
1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
1 C:\Documents and Settings\erson\*.tmp files -> C:\Documents and Settings\erson\*.tmp ->
Yahoo! Companion -> %AllUsersProfile%\Application Data\Yahoo! Companion -> [2009/08/10 12:57:41 | 00,000,000 | —D | C]
Yahoo! -> %AppData%\Yahoo! -> [2009/08/10 12:57:41 | 00,000,000 | —D | C]
GDIPFONTCACHEV1.DAT -> %UserProfile%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT -> [2009/08/10 12:56:22 | 00,023,192 | —- | C] ()
Yahoo! -> %AllUsersProfile%\Application Data\Yahoo! -> [2009/08/10 10:54:03 | 00,000,000 | —D | C]
Yahoo! Messenger.lnk -> %AllUsersProfile%\Desktop\Yahoo! Messenger.lnk -> [2009/08/10 10:51:20 | 00,000,812 | —- | C] ()
Yahoo! -> %ProgramFiles%\Yahoo! -> [2009/08/10 10:50:53 | 00,000,000 | —D | C]
UserData -> %UserProfile%\UserData -> [2009/08/10 07:01:22 | 00,000,000 | –SD | C]
LogFiles -> %SystemRoot%\System32\LogFiles -> [2009/08/10 06:56:39 | 00,000,000 | —D | C]
Msft_Kernel_ccdcmb_01005.Wdf -> %SystemRoot%\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf -> [2009/08/10 06:11:30 | 00,000,000 | -H– | C] ()
MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> %SystemRoot%\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> [2009/08/10 06:11:29 | 00,000,000 | -H– | C] ()
spmsg.dll -> %SystemRoot%\System32\spmsg.dll -> [2009/08/10 06:11:17 | 00,014,640 | —- | C] (Microsoft Corporation)
spupdsvc.exe -> %SystemRoot%\System32\spupdsvc.exe -> [2009/08/10 06:11:14 | 00,023,856 | —- | C] (Microsoft Corporation)
Nokia -> %AppData%\Nokia -> [2009/08/10 06:09:25 | 00,000,000 | —D | C]
PC Suite -> %AppData%\PC Suite -> [2009/08/10 06:09:24 | 00,000,000 | —D | C]
PC Suite -> %AllUsersProfile%\Application Data\PC Suite -> [2009/08/10 06:09:23 | 00,000,000 | —D | C]
PCSuite -> %CommonProgramFiles%\PCSuite -> [2009/08/10 06:08:51 | 00,000,000 | —D | C]
Nokia -> %CommonProgramFiles%\Nokia -> [2009/08/10 06:08:50 | 00,000,000 | —D | C]
DIFX -> %ProgramFiles%\DIFX -> [2009/08/10 06:08:41 | 00,000,000 | —D | C]
pccsmcfd.sys -> %SystemRoot%\System32\drivers\pccsmcfd.sys -> [2009/08/10 06:08:40 | 00,021,632 | —- | C] (Nokia)
PC Connectivity Solution -> %ProgramFiles%\PC Connectivity Solution -> [2009/08/10 06:08:33 | 00,000,000 | —D | C]
ccdcmbo.sys -> %SystemRoot%\System32\drivers\ccdcmbo.sys -> [2009/08/10 06:08:29 | 00,020,864 | —- | C] (Nokia)
usbser_lowerflt.sys -> %SystemRoot%\System32\usbser_lowerflt.sys -> [2009/08/10 06:08:29 | 00,008,064 | —- | C] (Windows ® Codename Longhorn DDK provider)
nmwcdcocls.dll -> %SystemRoot%\System32\nmwcdcocls.dll -> [2009/08/10 06:08:28 | 00,659,968 | —- | C] (Nokia)
ccdcmb.sys -> %SystemRoot%\System32\drivers\ccdcmb.sys -> [2009/08/10 06:08:28 | 00,017,536 | —- | C] (Nokia)
wdfcoinstaller01005.dll -> %SystemRoot%\System32\wdfcoinstaller01005.dll -> [2009/08/10 06:08:27 | 01,419,232 | —- | C] (Microsoft Corporation)
DRVSTORE -> %SystemRoot%\System32\DRVSTORE -> [2009/08/10 06:08:27 | 00,000,000 | —D | C]
nmwcdcls.dll -> %SystemRoot%\System32\nmwcdcls.dll -> [2009/08/10 06:08:26 | 00,090,624 | —- | C] (Nokia)
Nokia -> %ProgramFiles%\Nokia -> [2009/08/10 06:08:25 | 00,000,000 | —D | C]
Installations -> %AllUsersProfile%\Application Data\Installations -> [2009/08/10 06:07:39 | 00,000,000 | —D | C]
OTScanIt2 -> %UserProfile%\Desktop\OTScanIt2 -> [2009/03/24 11:08:28 | 00,000,000 | —D | C]
OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/03/24 10:58:29 | 00,662,639 | —- | C] ()
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [2009/03/24 10:55:35 | 00,000,000 | —D | C]
OTMoveIt3.exe -> %UserProfile%\Desktop\OTMoveIt3.exe -> [2009/03/24 10:52:25 | 00,389,120 | —- | C] (OldTimer Tools)
32788R22FWJFW -> %SystemDrive%\32788R22FWJFW -> [2009/03/24 10:24:46 | 00,000,000 | —D | C]
ComboFix.exe -> %UserProfile%\Desktop\ComboFix.exe -> [2009/03/24 10:17:05 | 02,934,667 | —- | C] ()
Recent -> %UserProfile%\Recent -> [2009/03/21 08:31:03 | 00,000,000 | RH-D | C]
efghi.pif -> %ProgramFiles%\efghi.pif -> [2009/03/20 18:02:04 | 00,655,096 | -HS- | C] ()
efghi.pif -> %SystemDrive%\efghi.pif -> [2009/03/19 16:17:33 | 00,655,096 | -HS- | C] ()
fghij.pif -> %AllUsersProfile%\Start Menu\Programs\Startup\fghij.pif -> [2009/03/19 16:17:28 | 00,655,096 | —- | C] ()
msi -> %SystemDrive%\msi -> [2009/03/19 16:17:24 | 00,000,000 | -HSD | C]
Avira Premium Security Suite -> %AppData%\Avira Premium Security Suite -> [2009/03/19 15:34:46 | 00,000,000 | —D | C]
Avira Premium Security Suite.lnk -> %AllUsersProfile%\Desktop\Avira Premium Security Suite.lnk -> [2009/03/19 15:00:05 | 00,001,728 | —- | C] ()
avfwot.sys -> %SystemRoot%\System32\drivers\avfwot.sys -> [2009/03/19 14:59:39 | 00,057,344 | —- | C] (Avira GmbH)
avfwim.sys -> %SystemRoot%\System32\drivers\avfwim.sys -> [2009/03/19 14:59:39 | 00,053,504 | —- | C] (Avira GmbH)
avgntdd.sys -> %SystemRoot%\System32\drivers\avgntdd.sys -> [2009/03/19 14:59:39 | 00,040,000 | —- | C] (AVIRA GmbH)
ssmdrv.sys -> %SystemRoot%\System32\drivers\ssmdrv.sys -> [2009/03/19 14:59:39 | 00,028,352 | —- | C] (Avira GmbH)
avgntmgr.sys -> %SystemRoot%\System32\drivers\avgntmgr.sys -> [2009/03/19 14:59:39 | 00,014,848 | —- | C] (AVIRA GmbH)
avsda.dll -> %SystemRoot%\System32\avsda.dll -> [2009/03/19 14:59:38 | 00,069,672 | —- | C] (Avira GmbH)
avipbb.sys -> %SystemRoot%\System32\drivers\avipbb.sys -> [2009/03/19 14:59:38 | 00,043,584 | —- | C] (Avira GmbH)
Avira Premium Security Suite -> %ProgramFiles%\Avira Premium Security Suite -> [2009/03/19 14:59:38 | 00,000,000 | —D | C]
Avira Premium Security Suite -> %AllUsersProfile%\Application Data\Avira Premium Security Suite -> [2009/03/19 14:59:38 | 00,000,000 | —D | C]
firstlsp.reg.dat -> %AllUsersProfile%\Application Data\firstlsp.reg.dat -> [2009/03/19 14:40:34 | 00,096,374 | —- | C] ()
hidden rock -> %UserProfile%\Desktop\hidden rock -> [2009/03/17 23:04:37 | 00,000,000 | —D | C]
edited pics -> %UserProfile%\Desktop\edited pics -> [2009/03/16 22:00:23 | 00,000,000 | —D | C]
Hinder - Lips Of An Angel.mp3 -> %UserProfile%\My Documents\Hinder - Lips Of An Angel.mp3 -> [2009/03/16 10:34:49 | 07,252,652 | —- | C] ()
Casting Crowns - Who Am I.mp3 -> %UserProfile%\My Documents\Casting Crowns - Who Am I.mp3 -> [2009/03/16 10:34:26 | 05,376,000 | —- | C] ()
Mikaila -The Art of Letting Go.mp3 -> %UserProfile%\My Documents\Mikaila -The Art of Letting Go.mp3 -> [2009/03/16 10:33:47 | 03,775,007 | —- | C] ()
dxhden.dll -> %SystemRoot%\System32\dxhden.dll -> [2009/03/15 14:21:24 | 00,112,640 | R-S- | C] ()
Spybot - Search & Destroy.lnk -> %UserProfile%\Desktop\Spybot - Search & Destroy.lnk -> [2009/03/14 04:13:53 | 00,000,933 | —- | C] ()
Spybot - Search & Destroy -> %ProgramFiles%\Spybot - Search & Destroy -> [2009/03/14 04:13:32 | 00,000,000 | —D | C]
Spybot - Search & Destroy -> %AllUsersProfile%\Application Data\Spybot - Search & Destroy -> [2009/03/14 04:13:32 | 00,000,000 | —D | C]
Minidump -> %SystemRoot%\Minidump -> [2009/03/11 13:22:29 | 00,000,000 | —D | C]
Adobe -> %SystemRoot%\System32\Adobe -> [2009/03/02 20:33:08 | 00,000,000 | —D | C]
Special Force.lnk -> %UserProfile%\Desktop\Special Force.lnk -> [2009/03/02 15:37:03 | 00,000,820 | —- | C] ()
MYGAME -> %ProgramFiles%\MYGAME -> [2009/03/02 15:35:12 | 00,000,000 | —D | C]
MYGAME Launcher -> %ProgramFiles%\MYGAME Launcher -> [2009/03/02 15:35:10 | 00,000,000 | —D | C]
GoogleUpdateTaskUserS-1-5-21-1214440339-1454471165-682003330-1003.job -> %SystemRoot%\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-1454471165-682003330-1003.job -> [2009/02/26 08:12:10 | 00,000,926 | —- | C] ()
tita mars -> %UserProfile%\Desktop\tita mars -> [2009/02/26 05:53:29 | 00,000,000 | —D | C]

[Files/Folders - Modified Within 30 Days]
1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
1 C:\Documents and Settings\erson\*.tmp files -> C:\Documents and Settings\erson\*.tmp ->
Yahoo! Messenger.lnk -> %AllUsersProfile%\Desktop\Yahoo! Messenger.lnk -> [2009/08/10 10:51:20 | 00,000,812 | —- | M] ()
desktop.ini -> %AllUsersProfile%\Documents\desktop.ini -> [2009/08/10 06:57:20 | 00,000,138 | -HS- | M] ()
Msft_Kernel_ccdcmb_01005.Wdf -> %SystemRoot%\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf -> [2009/08/10 06:11:30 | 00,000,000 | -H– | M] ()
MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> %SystemRoot%\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf -> [2009/08/10 06:11:29 | 00,000,000 | -H– | M] ()
nvapps.xml -> %SystemRoot%\System32\nvapps.xml -> [2009/03/24 11:02:07 | 00,041,237 | —- | M] ()
Perflib_Perfdata_25c.dat -> %SystemRoot%\Temp\Perflib_Perfdata_25c.dat -> [2009/03/24 11:01:39 | 00,016,384 | —- | M] ()
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [2009/03/24 11:01:21 | 00,000,006 | -H– | M] ()
wpa.dbl -> %SystemRoot%\System32\wpa.dbl -> [2009/03/24 11:01:19 | 00,002,206 | —- | M] ()
bootstat.dat -> %SystemRoot%\bootstat.dat -> [2009/03/24 11:01:18 | 00,002,048 | –S- | M] ()
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [2009/03/24 11:01:17 | 13,417,10336 | -HS- | M] ()
ntuser.dat -> %UserProfile%\ntuser.dat -> [2009/03/24 11:00:34 | 06,029,312 | —- | M] ()
ntuser.ini -> %UserProfile%\ntuser.ini -> [2009/03/24 11:00:34 | 00,000,278 | -HS- | M] ()
GoogleUpdateTaskUserS-1-5-21-1214440339-1454471165-682003330-1003.job -> %SystemRoot%\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-1454471165-682003330-1003.job -> [2009/03/24 11:00:30 | 00,000,926 | —- | M] ()
OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/03/24 10:59:00 | 00,662,639 | —- | M] ()
OTMoveIt3.exe -> %UserProfile%\Desktop\OTMoveIt3.exe -> [2009/03/24 10:52:47 | 00,389,120 | —- | M] (OldTimer Tools)
ComboFix.exe -> %UserProfile%\Desktop\ComboFix.exe -> [2009/03/24 10:19:42 | 02,934,667 | —- | M] ()
gercescp.dvr -> %SystemRoot%\gercescp.dvr -> [2009/03/24 10:09:14 | 00,000,244 | —- | M] ()
Avira Premium Security Suite.lnk -> %AllUsersProfile%\Desktop\Avira Premium Security Suite.lnk -> [2009/03/19 15:00:05 | 00,001,728 | —- | M] ()
firstlsp.reg.dat -> %AllUsersProfile%\Application Data\firstlsp.reg.dat -> [2009/03/19 14:59:44 | 00,096,374 | —- | M] ()
IconCache.db -> %UserProfile%\Local Settings\Application Data\IconCache.db -> [2009/03/19 13:35:01 | 04,284,138 | -H– | M] ()
Hinder - Lips Of An Angel.mp3 -> %UserProfile%\My Documents\Hinder - Lips Of An Angel.mp3 -> [2009/03/18 00:19:22 | 07,252,652 | —- | M] ()
Casting Crowns - Who Am I.mp3 -> %UserProfile%\My Documents\Casting Crowns - Who Am I.mp3 -> [2009/03/18 00:15:04 | 05,376,000 | —- | M] ()
Mikaila -The Art of Letting Go.mp3 -> %UserProfile%\My Documents\Mikaila -The Art of Letting Go.mp3 -> [2009/03/18 00:12:42 | 03,775,007 | —- | M] ()
cmicnfg.ini -> %SystemRoot%\System\cmicnfg.ini -> [2009/03/17 16:40:01 | 00,000,035 | —- | M] ()
NMM-MetaData.db -> %AppData%\NMM-MetaData.db -> [2009/03/16 10:46:47 | 00,211,035 | —- | M] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> %UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/03/16 10:22:40 | 00,026,112 | —- | M] ()
dxhden.dll -> %SystemRoot%\System32\dxhden.dll -> [2009/03/15 14:21:24 | 00,112,640 | R-S- | M] ()
hosts -> %SystemRoot%\System32\drivers\etc\hosts -> [2009/03/14 06:18:45 | 00,302,820 | R— | M] ()
Spybot - Search & Destroy.lnk -> %UserProfile%\Desktop\Spybot - Search & Destroy.lnk -> [2009/03/14 04:13:53 | 00,000,933 | —- | M] ()
hosts.20090314-061845.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090314-061845.backup -> [2009/03/09 21:23:57 | 00,000,762 | —- | M] ()
winsc32.ini -> %SystemRoot%\winsc32.ini -> [2009/03/09 21:08:02 | 00,000,228 | —- | M] ()
win.ini -> %SystemRoot%\win.ini -> [2009/03/05 08:03:23 | 00,000,795 | —- | M] ()
system.ini -> %SystemRoot%\system.ini -> [2009/03/05 08:03:23 | 00,000,227 | —- | M] ()
boot.ini -> %SystemDrive%\boot.ini -> [2009/03/05 08:03:23 | 00,000,211 | -HS- | M] ()
Special Force.lnk -> %UserProfile%\Desktop\Special Force.lnk -> [2009/03/02 15:37:04 | 00,000,820 | —- | M] ()
PhotoSnapViewer.INI -> %SystemRoot%\PhotoSnapViewer.INI -> [2009/02/26 06:34:57 | 00,000,151 | —- | M] ()
qmgr1.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2008/12/06 21:03:15 | 00,006,524 | —- | M] ()
qmgr0.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2008/12/06 20:53:46 | 00,008,471 | —- | M] ()
opa11.dat -> %AllUsersProfile%\Application Data\Microsoft\OFFICE\DATA\opa11.dat -> [2004/01/03 05:06:14 | 00,008,206 | —- | M] ()

[File - Lop Check]
Application Data -> C:\Documents and Settings\All Users\Application Data -> [2009/03/19 14:59:38 | 00,000,000 | RH-D | M]
Ahead -> C:\Documents and Settings\All Users\Application Data\Ahead -> [2008/11/24 13:40:11 | 00,000,000 | —D | M]
CyberLink -> C:\Documents and Settings\All Users\Application Data\CyberLink -> [2008/12/15 13:03:52 | 00,000,000 | —D | M]
Installations -> C:\Documents and Settings\All Users\Application Data\Installations -> [2009/08/10 06:07:39 | 00,000,000 | —D | M]
NCH Swift Sound -> C:\Documents and Settings\All Users\Application Data\NCH Swift Sound -> [2008/12/09 16:12:55 | 00,000,000 | —D | M]
PC Suite -> C:\Documents and Settings\All Users\Application Data\PC Suite -> [2009/08/10 06:09:23 | 00,000,000 | —D | M]
POP3Profiles -> C:\Documents and Settings\All Users\Application Data\POP3Profiles -> [2004/02/04 17:15:58 | 00,000,000 | —D | M]
Application Data -> C:\Documents and Settings\Default User\Application Data -> [2008/08/09 09:36:06 | 00,000,000 | RH-D | M]
Application Data -> C:\Documents and Settings\erson\Application Data -> [2009/03/19 15:34:46 | 00,000,000 | -H-D | M]
Ahead -> C:\Documents and Settings\erson\Application Data\Ahead -> [2008/11/24 13:42:49 | 00,000,000 | —D | M]
CyberLink -> C:\Documents and Settings\erson\Application Data\CyberLink -> [2008/12/15 13:05:45 | 00,000,000 | —D | M]
ESTsoft -> C:\Documents and Settings\erson\Application Data\ESTsoft -> [2004/01/20 10:45:47 | 00,000,000 | —D | M]
LimeWire -> C:\Documents and Settings\erson\Application Data\LimeWire -> [2009/03/10 17:32:04 | 00,000,000 | —D | M]
mIRC -> C:\Documents and Settings\erson\Application Data\mIRC -> [2004/01/20 10:46:17 | 00,000,000 | —D | M]
NCH Swift Sound -> C:\Documents and Settings\erson\Application Data\NCH Swift Sound -> [2009/01/05 11:58:37 | 00,000,000 | —D | M]
Nokia -> C:\Documents and Settings\erson\Application Data\Nokia -> [2009/08/10 06:09:25 | 00,000,000 | —D | M]
PC Suite -> C:\Documents and Settings\erson\Application Data\PC Suite -> [2008/11/22 10:11:21 | 00,000,000 | —D | M]
Recordpad -> C:\Documents and Settings\erson\Application Data\Recordpad -> [2008/12/09 16:12:43 | 00,000,000 | —D | M]
Search Settings -> C:\Documents and Settings\erson\Application Data\Search Settings -> [2004/01/19 20:36:27 | 00,000,000 | —D | M]
Simple Star -> C:\Documents and Settings\erson\Application Data\Simple Star -> [2008/11/24 13:43:54 | 00,000,000 | —D | M]
Snapfish -> C:\Documents and Settings\erson\Application Data\Snapfish -> [2008/11/24 13:46:14 | 00,000,000 | —D | M]
Application Data -> C:\Documents and Settings\LocalService\Application Data -> [2009/01/07 22:44:19 | 00,000,000 | —D | M]
Application Data -> C:\Documents and Settings\NetworkService\Application Data -> [2008/08/09 09:38:12 | 00,000,000 | —D | M]
C:\WINDOWS\Tasks\ -> C:\WINDOWS\Tasks -> [2009/03/19 14:47:27 | 00,000,000 | –SD | M]
desktop.ini -> C:\WINDOWS\Tasks\desktop.ini -> [2006/01/13 01:42:33 | 00,000,065 | RH– | M] ()
GoogleUpdateTaskUserS-1-5-21-1214440339-1454471165-682003330-1003.job -> C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-1454471165-682003330-1003.job -> [2009/03/24 11:00:30 | 00,000,926 | —- | M] ()
SA.DAT -> C:\WINDOWS\Tasks\SA.DAT -> [2009/03/24 11:01:21 | 00,000,006 | -H– | M] ()

[File - Purity Scan]

[File - Signature Check]
< Cached Copy > -> < OS Copy > -> < MD5's >
No cached file found -> C:\WINDOWS\explorer.exe [2006/01/13 01:46:46 | 01,075,200 | —- | M] (Microsoft Corporation) -> OS Copy = 2DEACA71A7FD77205F59D48D76B2F565
No cached file found -> C:\WINDOWS\system32\csrss.exe [2006/01/13 01:13:50 | 00,006,144 | —- | M] (Microsoft Corporation) -> OS Copy = F12B178B1678D778CFD3FF1FC38C71FB
No cached file found -> C:\WINDOWS\system32\lsass.exe [2006/01/13 01:57:01 | 00,013,312 | —- | M] (Microsoft Corporation) -> OS Copy = 84885F9B82F4D55C6146EBF6065D75D2
No cached file found -> C:\WINDOWS\system32\rundll32.exe [2006/01/13 01:27:20 | 00,033,280 | —- | M] (Microsoft Corporation) -> OS Copy = DA285490BBD8A1D0CE6623577D5BA1FF
No cached file found -> C:\WINDOWS\system32\services.exe [2006/01/13 02:05:20 | 00,108,032 | —- | M] (Microsoft Corporation) -> OS Copy = C6CE6EEC82F187615D1002BB3BB50ED4
No cached file found -> C:\WINDOWS\system32\smss.exe [2006/01/13 01:48:18 | 00,050,688 | —- | M] (Microsoft Corporation) -> OS Copy = BD7FB0957C716F1A60333AEE04DE2178
No cached file found -> C:\WINDOWS\system32\spoolsv.exe [2006/01/13 01:44:42 | 00,057,856 | —- | M] (Microsoft Corporation) -> OS Copy = AD3D9D191AEA7B5445FE1D82FFBB4788
No cached file found -> C:\WINDOWS\system32\svchost.exe [2006/01/13 01:38:02 | 00,014,336 | —- | M] (Microsoft Corporation) -> OS Copy = 8F078AE4ED187AAABC0A305146DE6716
No cached file found -> C:\WINDOWS\system32\taskmgr.exe [2006/01/13 02:03:31 | 00,135,680 | —- | M] (Microsoft Corporation) -> OS Copy = FC160ACE21C81837692B339D230DD4BE
No cached file found -> C:\WINDOWS\system32\userinit.exe [2006/01/13 01:23:18 | 00,024,576 | —- | M] (Microsoft Corporation) -> OS Copy = 39B1FFB03C2296323832ACBAE50D2AFF
No cached file found -> C:\WINDOWS\system32\winlogon.exe [2006/01/13 02:01:00 | 00,502,272 | —- | M] (Microsoft Corporation) -> OS Copy = 01C3346C241652F43AED8E2149881BFE

[CatchMe Rootkit Scan by GMER]
< Windows folder & sub-folders >
scanning hidden processes …
scanning hidden services & system hive …
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fglxtbxj]
"DisplayName"="Notify Audit"
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Description"="Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver."
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fglxtbxj\Parameters]
"ServiceDll"=str(2):"C:\WINDOWS\system32\dxhden.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\fglxtbxj]
"DisplayName"="Notify Audit"
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=str(2):"%SystemRoot%\system32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Description"="Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver."
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\fglxtbxj\Parameters]
"ServiceDll"=str(2):"C:\WINDOWS\system32\dxhden.dll"
scanning hidden registry entries …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
< Document and Settings folder & sub folders >
scanning hidden files …
C:\Documents and Settings\erson\Desktop\Programs\scanned files\48cef1baba395.3gp:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} 0 bytes
scan completed successfully
hidden files: 28

< End of report >


FROM:OTScanIT
i had read a topic about this.. and d one who post for help did'nt reply… the the topic was closed because of lack of reply… PLZ help TNX