[Resolved] Windows Antivirus Pro on XP 64-bit

It was a very good thought. I renamed OST.com to OST.exe, right-clicked and Ran As.. with administrator priviledges. That brought up the application and I was able to run the fix. It asked me to reboot, so I did. On reboot, however, I was immediately prompted with "Choose the program you want to use to open this file: OST.exe". I went into the \_OST\ directory and found the log file and here are its contents: All Processes Killed [Registry - Additional Scans - Safe List] Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\\'' updated successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\\'' updated successfully. [Empty Temp Folders] User: Administrator ->Temp folder emptied: 851 bytes File delete failed. F:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. F:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes File delete failed. F:\WINDOWS\temp\WFV1.tmp scheduled to be deleted on reboot. Windows Temp folder emptied: 50081792 bytes RecycleBin emptied: 720 bytes Total Files Cleaned = 47.83 mb < End of fix log > OTS by OldTimer - Version 3.0.10.3 fix logfile created on 09012009_124730 Files\Folders moved on Reboot… File move failed. F:\WINDOWS\temp\WFV1.tmp scheduled to be moved on reboot. Registry entries deleted on Reboot…

OK, Please run another OTS log, with the same reg associations checked so I can see whats there. Test a few of your other programs as well… if it still hasn't corrected then I will need to run another reg fix

Standard double-clicking of .exe files still results in "Choose the program you want to use to open this file". Right-clicking and selecting Run As… and choosing HOME\Administrator is working on everything I've tried.

Here's the new OTS log:

OTS logfile created on: 9/1/2009 1:16:19 PM - Run 6
OTS by OldTimer - Version 3.0.10.3	 Folder = F:\Documents and Settings\Administrator\Desktop
64bit-Windows Server 2003  Service Pack 1 (Version = 5.2.3790) - Type = NTWorkstation
Internet Explorer (Version = 6.0.3790.1830)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 931.50 Gb Total Space | 929.10 Gb Free Space | 99.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 59.61 Gb Total Space | 49.09 Gb Free Space | 82.35% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: HOME
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
 
[Processes - Safe List]
bratimer.exe -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe -> [2009/01/21 15:00:54 | 00,065,536 | —- | M] ()
brss01a.exe -> F:\WINDOWS\SysWOW64\brss01a.exe -> [2001/12/13 00:01:00 | 00,045,056 | —- | M] (brother Industries Ltd)
brsvc01a.exe -> F:\WINDOWS\SysWOW64\brsvc01a.exe -> [2004/06/14 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd)
frameworkservice.exe -> F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -> [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.)
naprdmgr.exe -> F:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe -> [2008/03/14 04:00:00 | 00,226,624 | —- | M] (McAfee, Inc.)
ots.exe -> F:\Documents and Settings\Administrator\Desktop\OTS.exe -> [2009/08/31 11:33:10 | 00,514,048 | —- | M] (OldTimer Tools)
vstskmgr.exe -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe -> [2008/09/29 08:07:00 | 00,062,800 | —- | M] (McAfee, Inc.)
 
[Win32 Services - Safe List]
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe -> [2008/07/25 10:13:44 | 00,046,088 | —- | M] (Microsoft Corporation)
(ATI Smart) ATI Smart [Win32_Own | Auto | Stopped] -> F:\WINDOWS\SysWow64\ati2saag.exe -> [2009/05/15 21:05:00 | 00,665,088 | —- | M] ()
(BRA_Scheduler) Brother BRAdminPro Scheduler [Win32_Own | Auto | Running] -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe -> [2009/01/21 15:00:54 | 00,065,536 | —- | M] ()
(Brother XP spl Service) BrSplService [Win32_Own | Auto | Running] -> F:\WINDOWS\SysWOW64\brsvc01a.exe -> [2004/06/14 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd)
(clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2008/07/25 11:17:02 | 00,069,632 | —- | M] (Microsoft Corporation)
(clr_optimization_v2.0.50727_64) .NET Runtime Optimization Service v2.0.50727_x64 [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -> [2008/07/25 10:13:48 | 00,093,184 | —- | M] (Microsoft Corporation)
(FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe -> [2008/07/29 21:18:04 | 00,046,104 | —- | M] (Microsoft Corporation)
(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> F:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2005/03/25 08:00:00 | 00,077,824 | —- | M] (Microsoft Corporation)
(IASJet) IAS Jet Database Access [Win32_Shared | On_Demand | Stopped] -> F:\WINDOWS\SysWOW64\iasrecst.dll -> [2005/03/25 08:00:00 | 00,162,816 | —- | M] (Microsoft Corporation)
(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe -> [2008/07/29 19:28:38 | 00,859,648 | —- | M] (Microsoft Corporation)
(McAfeeEngineService) McAfee Engine Service [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe -> [2008/09/29 08:07:00 | 00,017,920 | —- | M] (McAfee, Inc.)
(McAfeeFramework) McAfee Framework Service [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -> [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.)
(McShield) McAfee McShield [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe -> [2008/09/29 08:07:00 | 00,175,072 | —- | M] (McAfee, Inc.)
(McTaskManager) McAfee Task Manager [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe -> [2008/09/29 08:07:00 | 00,062,800 | —- | M] (McAfee, Inc.)
(Netlogon) Net Logon [Win32_Shared | On_Demand | Stopped] -> F:\WINDOWS\SysWow64\netlogon.dll -> [2005/03/25 08:00:00 | 00,419,328 | —- | M] (Microsoft Corporation)
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> F:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE -> [2003/07/28 12:28:22 | 00,089,136 | —- | M] (Microsoft Corporation)
(UMWdf) Windows User Mode Driver Framework [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\SysWow64\wdfmgr.exe -> [2005/03/25 08:00:00 | 00,039,424 | —- | M] (Microsoft Corporation)
 
[Driver Services - Safe List]
(BrPar) BrPar [Kernel | Auto | Stopped] -> F:\WINDOWS\System32\drivers\BrPar.sys -> [2000/07/24 01:01:00 | 00,019,537 | —- | M] (Brother Industries Ltd.)
(mnmdd) mnmdd [Kernel | System | Running] -> F:\WINDOWS\SysWow64\mnmdd.dll -> [2005/03/25 08:00:00 | 00,033,792 | —- | M] (Microsoft Corporation)
 
[Registry - Safe List]
< 64bit-Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\"Local Page" -> F:\WINDOWS\system32\blank.htm -> 
HKEY_CURRENT_USER\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
HKEY_CURRENT_USER\: SearchURL\\"provider" ->  -> 
64bit-HKEY_CURRENT_USER\: URLSearchHooks\\"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" [HKLM] -> F:\WINDOWS\SysNative\shdocvw.dll [Microsoft Url Search Hook] -> File not found
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> 
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions ->  -> 
HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} -> F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\] -> [2009/07/11 06:16:22 | 00,000,000 | —D | M]
< FireFox Extensions [User Folders] > -> 
Hosts file not found -> -> 
< 64bit-BHO's [HKEY_LOCAL_MACHINE] > -> 64bit-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKLM] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll [scriptproxy] -> [2008/09/29 08:07:00 | 00,064,808 | —- | M] (McAfee, Inc.)
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> [2004/12/14 01:56:50 | 00,063,136 | —- | M] (Adobe Systems Incorporated)
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKLM] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll [scriptproxy] -> [2008/09/29 08:07:00 | 00,061,200 | —- | M] (McAfee, Inc.)
{AE7CD045-E861-484f-8273-0445EE161910} [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [AcroIEToolbarHelper Class] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
< 64bit-Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Alcmtr" -> F:\WINDOWS\ALCMTR.EXE [ALCMTR.EXE] -> [2008/06/19 04:20:52 | 00,057,344 | —- | M] (Realtek Semiconductor Corp.)
"AlcWzrd" -> F:\WINDOWS\ALCWZRD.EXE [ALCWZRD.EXE] -> [2008/06/19 04:42:44 | 02,808,832 | —- | M] (RealTek Semicoductor Corp.)
"RTHDCPL" -> F:\WINDOWS\RTHDCPL.EXE [RTHDCPL.EXE] -> [2008/10/28 05:18:26 | 17,331,200 | —- | M] (Realtek Semiconductor Corp.)
"SkyTel" -> F:\WINDOWS\SkyTel.exe [SkyTel.EXE] -> [2007/11/20 06:15:58 | 01,826,816 | —- | M] (Realtek Semiconductor Corp.)
"SoundMan" -> F:\WINDOWS\SOUNDMAN.EXE [SOUNDMAN.EXE] -> [2008/08/19 01:26:44 | 00,077,824 | —- | M] (Realtek Semiconductor Corp.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Acrobat Assistant 7.0" -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe ["F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"] -> [2004/12/14 02:12:02 | 00,483,328 | —- | M] (Adobe Systems Inc.)
"McAfeeUpdaterUI" -> F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe ["F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey] -> [2008/03/14 04:00:00 | 00,136,512 | —- | M] (McAfee, Inc.)
"ShStatEXE" -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE ["F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE] -> [2008/09/29 08:07:00 | 00,124,240 | —- | M] (McAfee, Inc.)
"StartCCC" -> F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ["F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun] -> [2009/05/20 16:24:56 | 00,098,304 | —- | M] (Advanced Micro Devices, Inc.)
< Administrator Startup Folder > -> F:\Documents and Settings\Administrator\Start Menu\Programs\Startup -> 
< All Users Startup Folder > -> F:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk -> F:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-100000000002}\SC_Acrobat.exe -> [2009/07/11 14:57:50 | 00,025,214 | R— | M] ()
F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk -> F:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe -> [1999/11/04 16:06:48 | 00,113,664 | —- | M] (Adobe Systems, Inc.)
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoActiveDesktop" ->  [1] -> File not found
\\"NoActiveDesktopChanges" ->  [1] -> File not found
\\"ForceActiveDesktopOn" ->  [0] -> File not found
\\"HonorAutoRunSetting" ->  [1] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" ->  [0] -> File not found
\\"legalnoticecaption" ->  [] -> File not found
\\"legalnoticetext" ->  [] -> File not found
\\"scforceoption" ->  [0] -> File not found
\\"shutdownwithoutlogon" ->  [1] -> File not found
\\"undockwithoutlogon" ->  [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< 64bit-Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
Convert link target to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert link target to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
E&xport to Microsoft Excel -> F:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://F:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000] -> [2003/08/13 02:34:38 | 10,073,144 | —- | M] (Microsoft Corporation)
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
Convert link target to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert link target to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
E&xport to Microsoft Excel -> F:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://F:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000] -> [2003/08/13 02:34:38 | 10,073,144 | —- | M] (Microsoft Corporation)
< 64bit-Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Button: Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
64bit-CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
64bit-CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
< 64bit-Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< 64bit-Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< 64bit-Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
1 domain(s) and sub-domain(s) not assigned to a zone.
< 64bit-Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
1 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] -> http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1247275271781 [WUWebControl Class] -> 
< 64bit-Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
64bit-*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> F:\WINDOWS\explorer.exe -> [2005/03/25 08:00:00 | 01,364,480 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
64bit-*UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost -> 
%SystemRoot%\system32\logonui.exe -> F:\WINDOWS\SysNative\logonui.exe -> File not found
*MultiFile Done* -> -> 
64bit-*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
Control_RunDLL "sysdm.cpl" ->  -> File not found
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> F:\WINDOWS\SysWow64\explorer.exe -> [2005/03/25 08:00:00 | 01,050,624 | —- | M] (Microsoft Corporation)
rundll32.exe ->  -> File not found
*MultiFile Done* -> -> 
*System* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\System -> 
lsass.exe ->  -> File not found
*MultiFile Done* -> -> 
< 64bit-Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
AtiExtEvent ->  -> File not found
crypt32chain ->  -> File not found
cryptnet ->  -> File not found
cscdll ->  -> File not found
dimsntfy ->  -> File not found
ScCertProp ->  -> File not found
Schedule ->  -> File not found
sclgntfy ->  -> File not found
SensLogn ->  -> File not found
termsrv ->  -> File not found
wlballoon ->  -> File not found
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
ScCertProp ->  -> File not found
Schedule ->  -> File not found
SensLogn ->  -> File not found
wlballoon ->  -> File not found
< 64bit-SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -> 
"{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKLM] -> F:\WINDOWS\SysNative\stobject.dll [SysTray] -> File not found
< 64bit-ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}" [HKLM] ->  [] -> File not found
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 
64bit-*SecurityProviders* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 
msapsspc.dll ->  -> File not found
 schannel.dll ->  -> File not found
 digest.dll ->  -> File not found
 msnsspc.dll ->  -> File not found
*MultiFile Done* -> -> 
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"%windir%\system32\sessmgr.exe" -> F:\WINDOWS\SysWow64\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> File not found
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe" -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe [F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe:*:Enabled:BRAdmin Professional 3] -> [2009/03/11 11:32:26 | 00,139,264 | —- | M] ()
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe" -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe [F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe:*:Enabled:BRAdmin Professional 3] -> [2009/04/03 14:23:38 | 01,531,904 | —- | M] (Brother Industries, Ltd.)
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe" -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe [F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe:*:Enabled:BRAdmin Professional 3] -> [2009/03/11 11:33:20 | 00,131,072 | —- | M] ()
"F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe" -> F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service] -> [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> F:\WINDOWS\SysNative\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > ->  -> 
C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2009/07/10 20:40:29 | 00,000,000 | —- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\{2beef6d5-6e37-11de-b0ef-0001292264a7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell
\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun
\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\\"" ->  [Auto&Play] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\command
\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\command\\"" -> G:\LaunchU3.exe [G:\LaunchU3.exe -a] -> File not found
\{dcb2c169-6e4a-11de-85a3-0001292264a7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell
\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun
\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\\"" ->  [Auto&Play] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\command
\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\command\\"" -> G:\LaunchU3.exe [G:\LaunchU3.exe -a] -> File not found
\{fdbee656-6e39-11de-a229-0001292264a7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdbee656-6e39-11de-a229-0001292264a7}\Shell\AutoRun\command
\{fdbee656-6e39-11de-a229-0001292264a7}\Shell\AutoRun\command\\"" -> G:\setup.exe [G:\setup.exe] -> File not found
 
[Registry - Additional Scans - Safe List]
< 64bit-File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\ -> 
.bat [@ = batfile] -> "%1" %* -> 
.cmd [@ = cmdfile] -> "%1" %* -> 
.com [@ = comfile] -> "%1" %* -> 
.cpl [@ = cplfile] -> rundll32.exe shell32.dll,Control_RunDLL "%1",%* -> 
.exe [@ = exefile] -> F:\WINDOWS\SysWow64\desot.exe -> File not found
.html [@ = htmlfile] -> F:\Program Files (x86)\Internet Explorer\iexplore.exe -> [2005/03/25 08:00:00 | 00,094,208 | —- | M] (Microsoft Corporation)
.inf [@ = inffile] -> F:\WINDOWS\SysNative\NOTEPAD.EXE -> File not found
.ini [@ = inifile] -> F:\WINDOWS\SysNative\NOTEPAD.EXE -> File not found
.url [@ = InternetShortcut] -> rundll32.exe shdocvw.dll,OpenURL %l -> 
.js [@ = JSFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.jse [@ = JSEFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.pif [@ = piffile] -> "%1" %* -> 
.scr [@ = scrfile] -> "%1" /S -> 
.txt [@ = txtfile] -> F:\WINDOWS\SysNative\NOTEPAD.EXE -> File not found
.vbe [@ = VBEFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.vbs [@ = VBSFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.wsf [@ = WSFFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.wsh [@ = WSHFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\ -> 
.bat [@ = batfile] -> "%1" %* -> 
.cmd [@ = cmdfile] -> "%1" %* -> 
.com [@ = comfile] -> "%1" %* -> 
.exe [@ = exefile] -> F:\WINDOWS\SysWow64\desot.exe -> File not found
.html [@ = htmlfile] -> F:\Program Files (x86)\Internet Explorer\iexplore.exe -> [2005/03/25 08:00:00 | 00,094,208 | —- | M] (Microsoft Corporation)
.pif [@ = piffile] -> "%1" %* -> 
.reg [@ = regfile] -> F:\WINDOWS\SysWow64\regedit.exe -> [2005/03/25 08:00:00 | 00,147,456 | —- | M] (Microsoft Corporation)
.scr [@ = scrfile] -> "%1" /S -> 
< File Associations - Select to Repair > -> HKEY_CURRENT_USER\SOFTWARE\Classes\\ -> 
 
[Files/Folders - Created Within 30 Days]
fixme.reg -> F:\Documents and Settings\Administrator\Desktop\fixme.reg -> [2009/09/01 10:16:32 | 00,000,350 | —- | C] ()
query.bat -> F:\Documents and Settings\Administrator\Desktop\query.bat -> [2009/09/01 08:20:50 | 00,000,129 | —- | C] ()
_OTS -> F:\_OTS -> [2009/08/31 13:42:38 | 00,000,000 | —D | C]
OTS.exe -> F:\Documents and Settings\Administrator\Desktop\OTS.exe -> [2009/08/31 11:32:45 | 00,514,048 | —- | C] (OldTimer Tools)
HijackThis.exe -> F:\Documents and Settings\Administrator\Desktop\HijackThis.exe -> [2009/08/31 10:47:51 | 00,401,720 | —- | C] (Trend Micro Inc.)
ERDNT -> F:\WINDOWS\ERDNT -> [2009/08/31 10:39:13 | 00,000,000 | —D | C]
NTREGOPT.lnk -> F:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk -> [2009/08/31 10:38:42 | 00,000,641 | —- | C] ()
ERUNT.lnk -> F:\Documents and Settings\Administrator\Desktop\ERUNT.lnk -> [2009/08/31 10:38:42 | 00,000,622 | —- | C] ()
ERUNT -> F:\Program Files (x86)\ERUNT -> [2009/08/31 10:38:41 | 00,000,000 | —D | C]
RootRepeal.exe -> F:\Documents and Settings\Administrator\Desktop\RootRepeal.exe -> [2009/08/31 09:56:36 | 00,472,064 | —- | C] ( )
asdjflkjt.exe -> F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe -> [2009/08/31 09:56:29 | 00,791,393 | —- | C] (Lars Hederer												)
bincd32.dat -> F:\WINDOWS\SysWow64\bincd32.dat -> [2009/08/15 06:15:07 | 00,000,004 | —- | C] ()
My Videos -> F:\Documents and Settings\All Users\Documents\My Videos -> [2009/08/02 14:55:40 | 00,000,000 | R–D | C]
My Videos -> F:\Documents and Settings\Administrator\My Documents\My Videos -> [2009/08/02 14:55:40 | 00,000,000 | R–D | C]
EndNote X -> F:\Program Files (x86)\EndNote X -> [2009/08/02 14:44:09 | 00,000,000 | —D | C]
EndNote -> F:\Documents and Settings\Administrator\Application Data\EndNote -> [2009/08/02 14:41:10 | 00,000,000 | —D | C]
Sp32w.dll -> F:\WINDOWS\SysWow64\Sp32w.dll -> [2009/07/11 15:45:00 | 00,033,280 | —- | C] ()
brss01a.ini -> F:\WINDOWS\SysWow64\brss01a.ini -> [2009/07/11 15:17:25 | 00,000,030 | —- | C] ()
BRWMARK.INI -> F:\WINDOWS\BRWMARK.INI -> [2009/07/11 15:17:24 | 00,000,410 | —- | C] ()
BRVIDEO.INI -> F:\WINDOWS\BRVIDEO.INI -> [2009/07/11 14:14:28 | 00,000,153 | —- | C] ()
brpp2ka.ini -> F:\WINDOWS\brpp2ka.ini -> [2009/07/11 14:14:28 | 00,000,052 | —- | C] ()
BRDIAG.INI -> F:\WINDOWS\BRDIAG.INI -> [2009/07/11 14:14:28 | 00,000,040 | —- | C] ()
Brownie.ini -> F:\WINDOWS\Brownie.ini -> [2009/07/11 14:14:28 | 00,000,023 | —- | C] ()
bw5170dn.ini -> F:\WINDOWS\bw5170dn.ini -> [2009/07/11 14:14:28 | 00,000,000 | —- | C] ()
brmx2001.ini -> F:\WINDOWS\brmx2001.ini -> [2009/07/11 14:14:28 | 00,000,000 | —- | C] ()
BROSNMP.DLL -> F:\WINDOWS\SysWow64\BROSNMP.DLL -> [2009/07/11 14:14:26 | 00,077,824 | —- | C] ()
BRGSRC32.DLL -> F:\WINDOWS\SysWow64\BRGSRC32.DLL -> [2009/07/11 14:14:26 | 00,026,624 | —- | C] ()
HL-5170DN.INI -> F:\WINDOWS\HL-5170DN.INI -> [2009/07/11 14:14:26 | 00,015,108 | —- | C] ()
BRGSRC16.DLL -> F:\WINDOWS\SysWow64\BRGSRC16.DLL -> [2009/07/11 14:14:26 | 00,004,608 | —- | C] ()
PTRCENG.DLL -> F:\WINDOWS\SysWow64\PTRCENG.DLL -> [2009/07/11 14:14:13 | 00,045,056 | —- | C] ()
ODBC.INI -> F:\WINDOWS\ODBC.INI -> [2009/07/11 14:07:47 | 00,000,376 | —- | C] ()
PerfStringBackup.INI -> F:\WINDOWS\SysWow64\PerfStringBackup.INI -> [2009/07/10 20:54:58 | 00,541,752 | —- | C] ()
win.ini -> F:\WINDOWS\win.ini -> [2009/07/10 20:39:26 | 00,000,497 | —- | C] ()
system.ini -> F:\WINDOWS\system.ini -> [2009/07/10 16:16:08 | 00,000,150 | —- | C] ()
quartz.dll -> F:\WINDOWS\SysWow64\quartz.dll -> [2005/03/25 08:00:00 | 01,291,264 | —- | C] ()
qedwipes.dll -> F:\WINDOWS\SysWow64\qedwipes.dll -> [2005/03/25 08:00:00 | 00,733,696 | —- | C] ()
qedit.dll -> F:\WINDOWS\SysWow64\qedit.dll -> [2005/03/25 08:00:00 | 00,512,512 | —- | C] ()
dxmasf.dll -> F:\WINDOWS\SysWow64\dxmasf.dll -> [2005/03/25 08:00:00 | 00,498,742 | —- | C] ()
encdec.dll -> F:\WINDOWS\SysWow64\encdec.dll -> [2005/03/25 08:00:00 | 00,396,288 | —- | C] ()
qdvd.dll -> F:\WINDOWS\SysWow64\qdvd.dll -> [2005/03/25 08:00:00 | 00,385,536 | —- | C] ()
msjetoledb40.dll -> F:\WINDOWS\SysWow64\msjetoledb40.dll -> [2005/03/25 08:00:00 | 00,355,112 | —- | C] ()
qdv.dll -> F:\WINDOWS\SysWow64\qdv.dll -> [2005/03/25 08:00:00 | 00,279,040 | —- | C] ()
sbe.dll -> F:\WINDOWS\SysWow64\sbe.dll -> [2005/03/25 08:00:00 | 00,276,992 | —- | C] ()
ir32_32.dll -> F:\WINDOWS\SysWow64\ir32_32.dll -> [2005/03/25 08:00:00 | 00,199,168 | —- | C] ()
qcap.dll -> F:\WINDOWS\SysWow64\qcap.dll -> [2005/03/25 08:00:00 | 00,192,512 | —- | C] ()
msencode.dll -> F:\WINDOWS\SysWow64\msencode.dll -> [2005/03/25 08:00:00 | 00,114,688 | —- | C] ()
amstream.dll -> F:\WINDOWS\SysWow64\amstream.dll -> [2005/03/25 08:00:00 | 00,072,704 | —- | C] ()
mciqtz32.dll -> F:\WINDOWS\SysWow64\mciqtz32.dll -> [2005/03/25 08:00:00 | 00,062,464 | —- | C] ()
devenum.dll -> F:\WINDOWS\SysWow64\devenum.dll -> [2005/03/25 08:00:00 | 00,061,440 | —- | C] ()
tsd32.dll -> F:\WINDOWS\SysWow64\tsd32.dll -> [2005/03/25 08:00:00 | 00,016,896 | —- | C] ()
msdmo.dll -> F:\WINDOWS\SysWow64\msdmo.dll -> [2005/03/25 08:00:00 | 00,014,336 | —- | C] ()
msdxmlc.dll -> F:\WINDOWS\SysWow64\msdxmlc.dll -> [2005/03/25 08:00:00 | 00,004,126 | —- | C] ()
OUTLPERF.INI -> F:\WINDOWS\SysWow64\OUTLPERF.INI -> [2003/01/07 15:05:08 | 00,002,695 | —- | C] ()
 
[Files/Folders - Modified Within 30 Days]
Adobe Acrobat Speed Launcher.lnk -> F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk -> [2009/09/01 12:56:29 | 00,002,359 | —- | M] ()
bootstat.dat -> F:\WINDOWS\bootstat.dat -> [2009/09/01 12:49:05 | 00,002,048 | –S- | M] ()
SA.DAT -> F:\WINDOWS\tasks\SA.DAT -> [2009/09/01 12:49:05 | 00,000,006 | -H– | M] ()
NTUSER.DAT -> F:\Documents and Settings\Administrator\NTUSER.DAT -> [2009/09/01 12:47:37 | 01,310,720 | -H– | M] ()
ntuser.ini -> F:\Documents and Settings\Administrator\ntuser.ini -> [2009/09/01 12:47:37 | 00,000,178 | -HS- | M] ()
fixme.reg -> F:\Documents and Settings\Administrator\Desktop\fixme.reg -> [2009/09/01 10:17:04 | 00,000,350 | —- | M] ()
query.bat -> F:\Documents and Settings\Administrator\Desktop\query.bat -> [2009/09/01 08:23:40 | 00,000,129 | —- | M] ()
OTS.exe -> F:\Documents and Settings\Administrator\Desktop\OTS.exe -> [2009/08/31 11:33:10 | 00,514,048 | —- | M] (OldTimer Tools)
HijackThis.exe -> F:\Documents and Settings\Administrator\Desktop\HijackThis.exe -> [2009/08/31 10:48:16 | 00,401,720 | —- | M] (Trend Micro Inc.)
NTREGOPT.lnk -> F:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk -> [2009/08/31 10:38:42 | 00,000,641 | —- | M] ()
ERUNT.lnk -> F:\Documents and Settings\Administrator\Desktop\ERUNT.lnk -> [2009/08/31 10:38:42 | 00,000,622 | —- | M] ()
RootRepeal.exe -> F:\Documents and Settings\Administrator\Desktop\RootRepeal.exe -> [2009/08/31 09:49:34 | 00,472,064 | —- | M] ( )
asdjflkjt.exe -> F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe -> [2009/08/31 09:48:46 | 00,791,393 | —- | M] (Lars Hederer												)
bincd32.dat -> F:\WINDOWS\SysWow64\bincd32.dat -> [2009/08/15 07:01:40 | 00,000,004 | —- | M] ()
IconCache.db -> F:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db -> [2009/08/15 06:32:36 | 06,413,810 | -H– | M] ()
qmgr1.dat -> F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2009/08/12 05:56:56 | 00,005,508 | —- | M] ()
qmgr0.dat -> F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2009/08/12 05:56:56 | 00,004,232 | —- | M] ()
opa11.dat -> F:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat -> [2009/07/11 14:08:27 | 00,008,206 | —- | M] ()
< End of report >

Hi,

We need to remove the reg key that's there and overwrite it with what we want.

Please do the following:

Click Start type notepad in the Start Search box, and then press ENTER
Paste the following text into Notepad:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids]
"exefile"=hex(0):

On the File menu, click Save as.
Select All Files in the Save as type list, and then type Exe.reg in the File name box. Save it to your desktop
Click Save, and then close Notepad.
Double-click the Exe.reg file.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
Click Yes, and then click OK in response to the registry prompts.
Reboot.

I followed the instructions as noted and rebooted. There appears to be no change in behavior. I still cannot launch .exe files unless I select Run As… HOME\Administrator.

Here is a new scan log done after the reboot.

OTS logfile created on: 9/1/2009 1:37:10 PM - Run 8
OTS by OldTimer - Version 3.0.10.3	 Folder = F:\Documents and Settings\Administrator\Desktop
64bit-Windows Server 2003  Service Pack 1 (Version = 5.2.3790) - Type = NTWorkstation
Internet Explorer (Version = 6.0.3790.1830)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 931.50 Gb Total Space | 929.10 Gb Free Space | 99.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 59.61 Gb Total Space | 49.09 Gb Free Space | 82.34% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: HOME
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
 
[Processes - Safe List]
bratimer.exe -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe -> [2009/01/21 15:00:54 | 00,065,536 | —- | M] ()
brss01a.exe -> F:\WINDOWS\SysWOW64\brss01a.exe -> [2001/12/13 00:01:00 | 00,045,056 | —- | M] (brother Industries Ltd)
brsvc01a.exe -> F:\WINDOWS\SysWOW64\brsvc01a.exe -> [2004/06/14 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd)
frameworkservice.exe -> F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -> [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.)
naprdmgr.exe -> F:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe -> [2008/03/14 04:00:00 | 00,226,624 | —- | M] (McAfee, Inc.)
ots.exe -> F:\Documents and Settings\Administrator\Desktop\OTS.exe -> [2009/08/31 11:33:10 | 00,514,048 | —- | M] (OldTimer Tools)
vstskmgr.exe -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe -> [2008/09/29 08:07:00 | 00,062,800 | —- | M] (McAfee, Inc.)
 
[Win32 Services - Safe List]
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe -> [2008/07/25 10:13:44 | 00,046,088 | —- | M] (Microsoft Corporation)
(ATI Smart) ATI Smart [Win32_Own | Auto | Stopped] -> F:\WINDOWS\SysWow64\ati2saag.exe -> [2009/05/15 21:05:00 | 00,665,088 | —- | M] ()
(BRA_Scheduler) Brother BRAdminPro Scheduler [Win32_Own | Auto | Running] -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe -> [2009/01/21 15:00:54 | 00,065,536 | —- | M] ()
(Brother XP spl Service) BrSplService [Win32_Own | Auto | Running] -> F:\WINDOWS\SysWOW64\brsvc01a.exe -> [2004/06/14 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd)
(clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2008/07/25 11:17:02 | 00,069,632 | —- | M] (Microsoft Corporation)
(clr_optimization_v2.0.50727_64) .NET Runtime Optimization Service v2.0.50727_x64 [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -> [2008/07/25 10:13:48 | 00,093,184 | —- | M] (Microsoft Corporation)
(FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe -> [2008/07/29 21:18:04 | 00,046,104 | —- | M] (Microsoft Corporation)
(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> F:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2005/03/25 08:00:00 | 00,077,824 | —- | M] (Microsoft Corporation)
(IASJet) IAS Jet Database Access [Win32_Shared | On_Demand | Stopped] -> F:\WINDOWS\SysWOW64\iasrecst.dll -> [2005/03/25 08:00:00 | 00,162,816 | —- | M] (Microsoft Corporation)
(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> F:\WINDOWS\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe -> [2008/07/29 19:28:38 | 00,859,648 | —- | M] (Microsoft Corporation)
(McAfeeEngineService) McAfee Engine Service [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe -> [2008/09/29 08:07:00 | 00,017,920 | —- | M] (McAfee, Inc.)
(McAfeeFramework) McAfee Framework Service [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -> [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.)
(McShield) McAfee McShield [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe -> [2008/09/29 08:07:00 | 00,175,072 | —- | M] (McAfee, Inc.)
(McTaskManager) McAfee Task Manager [Win32_Own | Auto | Running] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe -> [2008/09/29 08:07:00 | 00,062,800 | —- | M] (McAfee, Inc.)
(Netlogon) Net Logon [Win32_Shared | On_Demand | Stopped] -> F:\WINDOWS\SysWow64\netlogon.dll -> [2005/03/25 08:00:00 | 00,419,328 | —- | M] (Microsoft Corporation)
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> F:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE -> [2003/07/28 12:28:22 | 00,089,136 | —- | M] (Microsoft Corporation)
(UMWdf) Windows User Mode Driver Framework [Win32_Own | On_Demand | Stopped] -> F:\WINDOWS\SysWow64\wdfmgr.exe -> [2005/03/25 08:00:00 | 00,039,424 | —- | M] (Microsoft Corporation)
 
[Driver Services - Safe List]
(BrPar) BrPar [Kernel | Auto | Stopped] -> F:\WINDOWS\System32\drivers\BrPar.sys -> [2000/07/24 01:01:00 | 00,019,537 | —- | M] (Brother Industries Ltd.)
(mnmdd) mnmdd [Kernel | System | Running] -> F:\WINDOWS\SysWow64\mnmdd.dll -> [2005/03/25 08:00:00 | 00,033,792 | —- | M] (Microsoft Corporation)
 
[Registry - Safe List]
< 64bit-Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\"Local Page" -> F:\WINDOWS\system32\blank.htm -> 
HKEY_CURRENT_USER\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> 
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> 
HKEY_CURRENT_USER\: SearchURL\\"provider" ->  -> 
64bit-HKEY_CURRENT_USER\: URLSearchHooks\\"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" [HKLM] -> F:\WINDOWS\SysNative\shdocvw.dll [Microsoft Url Search Hook] -> File not found
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> 
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions ->  -> 
HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} -> F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\] -> [2009/07/11 06:16:22 | 00,000,000 | —D | M]
< FireFox Extensions [User Folders] > -> 
Hosts file not found -> -> 
< 64bit-BHO's [HKEY_LOCAL_MACHINE] > -> 64bit-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKLM] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll [scriptproxy] -> [2008/09/29 08:07:00 | 00,064,808 | —- | M] (McAfee, Inc.)
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> [2004/12/14 01:56:50 | 00,063,136 | —- | M] (Adobe Systems Incorporated)
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKLM] -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll [scriptproxy] -> [2008/09/29 08:07:00 | 00,061,200 | —- | M] (McAfee, Inc.)
{AE7CD045-E861-484f-8273-0445EE161910} [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [AcroIEToolbarHelper Class] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" [HKLM] -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [Adobe PDF] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
< 64bit-Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Alcmtr" -> F:\WINDOWS\ALCMTR.EXE [ALCMTR.EXE] -> [2008/06/19 04:20:52 | 00,057,344 | —- | M] (Realtek Semiconductor Corp.)
"AlcWzrd" -> F:\WINDOWS\ALCWZRD.EXE [ALCWZRD.EXE] -> [2008/06/19 04:42:44 | 02,808,832 | —- | M] (RealTek Semicoductor Corp.)
"RTHDCPL" -> F:\WINDOWS\RTHDCPL.EXE [RTHDCPL.EXE] -> [2008/10/28 05:18:26 | 17,331,200 | —- | M] (Realtek Semiconductor Corp.)
"SkyTel" -> F:\WINDOWS\SkyTel.exe [SkyTel.EXE] -> [2007/11/20 06:15:58 | 01,826,816 | —- | M] (Realtek Semiconductor Corp.)
"SoundMan" -> F:\WINDOWS\SOUNDMAN.EXE [SOUNDMAN.EXE] -> [2008/08/19 01:26:44 | 00,077,824 | —- | M] (Realtek Semiconductor Corp.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Acrobat Assistant 7.0" -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe ["F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"] -> [2004/12/14 02:12:02 | 00,483,328 | —- | M] (Adobe Systems Inc.)
"McAfeeUpdaterUI" -> F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe ["F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey] -> [2008/03/14 04:00:00 | 00,136,512 | —- | M] (McAfee, Inc.)
"ShStatEXE" -> F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE ["F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE] -> [2008/09/29 08:07:00 | 00,124,240 | —- | M] (McAfee, Inc.)
"StartCCC" -> F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ["F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun] -> [2009/05/20 16:24:56 | 00,098,304 | —- | M] (Advanced Micro Devices, Inc.)
< Administrator Startup Folder > -> F:\Documents and Settings\Administrator\Start Menu\Programs\Startup -> 
< All Users Startup Folder > -> F:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk -> F:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-100000000002}\SC_Acrobat.exe -> [2009/07/11 14:57:50 | 00,025,214 | R— | M] ()
F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk -> F:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe -> [1999/11/04 16:06:48 | 00,113,664 | —- | M] (Adobe Systems, Inc.)
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoActiveDesktop" ->  [1] -> File not found
\\"NoActiveDesktopChanges" ->  [1] -> File not found
\\"ForceActiveDesktopOn" ->  [0] -> File not found
\\"HonorAutoRunSetting" ->  [1] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" ->  [0] -> File not found
\\"legalnoticecaption" ->  [] -> File not found
\\"legalnoticetext" ->  [] -> File not found
\\"scforceoption" ->  [0] -> File not found
\\"shutdownwithoutlogon" ->  [1] -> File not found
\\"undockwithoutlogon" ->  [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< 64bit-Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
Convert link target to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert link target to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
E&xport to Microsoft Excel -> F:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://F:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000] -> [2003/08/13 02:34:38 | 10,073,144 | —- | M] (Microsoft Corporation)
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
Convert link target to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert link target to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selected links to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert selection to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to Adobe PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
Convert to existing PDF -> F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html] -> [2004/12/14 02:13:40 | 00,225,280 | —- | M] (Adobe Systems Incorporated)
E&xport to Microsoft Excel -> F:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://F:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000] -> [2003/08/13 02:34:38 | 10,073,144 | —- | M] (Microsoft Corporation)
< 64bit-Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Button: Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
64bit-CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] -> F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Research] -> [2003/07/14 22:57:08 | 00,040,512 | —- | M] (Microsoft Corporation)
64bit-CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> F:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2005/03/25 08:00:00 | 01,681,920 | —- | M] (Microsoft Corporation)
< 64bit-Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< 64bit-Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< 64bit-Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
1 domain(s) and sub-domain(s) not assigned to a zone.
< 64bit-Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
1 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] -> http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1247275271781 [WUWebControl Class] -> 
< 64bit-Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
64bit-*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> F:\WINDOWS\explorer.exe -> [2005/03/25 08:00:00 | 01,364,480 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
64bit-*UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost -> 
%SystemRoot%\system32\logonui.exe -> F:\WINDOWS\SysNative\logonui.exe -> File not found
*MultiFile Done* -> -> 
64bit-*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> 
Control_RunDLL "sysdm.cpl" ->  -> File not found
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> F:\WINDOWS\SysWow64\explorer.exe -> [2005/03/25 08:00:00 | 01,050,624 | —- | M] (Microsoft Corporation)
rundll32.exe ->  -> File not found
*MultiFile Done* -> -> 
*System* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\System -> 
lsass.exe ->  -> File not found
*MultiFile Done* -> -> 
< 64bit-Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
AtiExtEvent ->  -> File not found
crypt32chain ->  -> File not found
cryptnet ->  -> File not found
cscdll ->  -> File not found
dimsntfy ->  -> File not found
ScCertProp ->  -> File not found
Schedule ->  -> File not found
sclgntfy ->  -> File not found
SensLogn ->  -> File not found
termsrv ->  -> File not found
wlballoon ->  -> File not found
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
ScCertProp ->  -> File not found
Schedule ->  -> File not found
SensLogn ->  -> File not found
wlballoon ->  -> File not found
< 64bit-SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -> 
"{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKLM] -> F:\WINDOWS\SysNative\stobject.dll [SysTray] -> File not found
< 64bit-ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}" [HKLM] ->  [] -> File not found
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 
64bit-*SecurityProviders* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders -> 
msapsspc.dll ->  -> File not found
 schannel.dll ->  -> File not found
 digest.dll ->  -> File not found
 msnsspc.dll ->  -> File not found
*MultiFile Done* -> -> 
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"%windir%\system32\sessmgr.exe" -> F:\WINDOWS\SysWow64\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> File not found
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe" -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe [F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe:*:Enabled:BRAdmin Professional 3] -> [2009/03/11 11:32:26 | 00,139,264 | —- | M] ()
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe" -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe [F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe:*:Enabled:BRAdmin Professional 3] -> [2009/04/03 14:23:38 | 01,531,904 | —- | M] (Brother Industries, Ltd.)
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe" -> F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe [F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe:*:Enabled:BRAdmin Professional 3] -> [2009/03/11 11:33:20 | 00,131,072 | —- | M] ()
"F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe" -> F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service] -> [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> F:\WINDOWS\SysNative\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > ->  -> 
C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2009/07/10 20:40:29 | 00,000,000 | —- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\{2beef6d5-6e37-11de-b0ef-0001292264a7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell
\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun
\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\\"" ->  [Auto&Play] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\command
\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\command\\"" -> G:\LaunchU3.exe [G:\LaunchU3.exe -a] -> File not found
\{dcb2c169-6e4a-11de-85a3-0001292264a7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell
\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun
\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\\"" ->  [Auto&Play] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\command
\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\command\\"" -> G:\LaunchU3.exe [G:\LaunchU3.exe -a] -> File not found
\{fdbee656-6e39-11de-a229-0001292264a7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdbee656-6e39-11de-a229-0001292264a7}\Shell\AutoRun\command
\{fdbee656-6e39-11de-a229-0001292264a7}\Shell\AutoRun\command\\"" -> G:\setup.exe [G:\setup.exe] -> File not found
 
[Registry - Additional Scans - Safe List]
< 64bit-File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\ -> 
.bat [@ = batfile] -> "%1" %* -> 
.cmd [@ = cmdfile] -> "%1" %* -> 
.com [@ = comfile] -> "%1" %* -> 
.cpl [@ = cplfile] -> rundll32.exe shell32.dll,Control_RunDLL "%1",%* -> 
.exe [@ = exefile] -> F:\WINDOWS\SysWow64\desot.exe -> File not found
.html [@ = htmlfile] -> F:\Program Files (x86)\Internet Explorer\iexplore.exe -> [2005/03/25 08:00:00 | 00,094,208 | —- | M] (Microsoft Corporation)
.inf [@ = inffile] -> F:\WINDOWS\SysNative\NOTEPAD.EXE -> File not found
.ini [@ = inifile] -> F:\WINDOWS\SysNative\NOTEPAD.EXE -> File not found
.url [@ = InternetShortcut] -> rundll32.exe shdocvw.dll,OpenURL %l -> 
.js [@ = JSFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.jse [@ = JSEFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.pif [@ = piffile] -> "%1" %* -> 
.scr [@ = scrfile] -> "%1" /S -> 
.txt [@ = txtfile] -> F:\WINDOWS\SysNative\NOTEPAD.EXE -> File not found
.vbe [@ = VBEFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.vbs [@ = VBSFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.wsf [@ = WSFFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
.wsh [@ = WSHFile] -> F:\WINDOWS\SysNative\WScript.exe -> File not found
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\ -> 
.bat [@ = batfile] -> "%1" %* -> 
.cmd [@ = cmdfile] -> "%1" %* -> 
.com [@ = comfile] -> "%1" %* -> 
.exe [@ = exefile] -> F:\WINDOWS\SysWow64\desot.exe -> File not found
.html [@ = htmlfile] -> F:\Program Files (x86)\Internet Explorer\iexplore.exe -> [2005/03/25 08:00:00 | 00,094,208 | —- | M] (Microsoft Corporation)
.pif [@ = piffile] -> "%1" %* -> 
.reg [@ = regfile] -> F:\WINDOWS\SysWow64\regedit.exe -> [2005/03/25 08:00:00 | 00,147,456 | —- | M] (Microsoft Corporation)
.scr [@ = scrfile] -> "%1" /S -> 
< File Associations - Select to Repair > -> HKEY_CURRENT_USER\SOFTWARE\Classes\\ -> 
 
[Files/Folders - Created Within 30 Days]
exe.reg -> F:\Documents and Settings\Administrator\Desktop\exe.reg -> [2009/09/01 13:31:42 | 00,000,437 | —- | C] ()
Application Data -> F:\Application Data -> [2009/09/01 13:18:50 | 00,000,000 | —D | C]
fixme.reg -> F:\Documents and Settings\Administrator\Desktop\fixme.reg -> [2009/09/01 10:16:32 | 00,000,350 | —- | C] ()
query.bat -> F:\Documents and Settings\Administrator\Desktop\query.bat -> [2009/09/01 08:20:50 | 00,000,129 | —- | C] ()
_OTS -> F:\_OTS -> [2009/08/31 13:42:38 | 00,000,000 | —D | C]
OTS.exe -> F:\Documents and Settings\Administrator\Desktop\OTS.exe -> [2009/08/31 11:32:45 | 00,514,048 | —- | C] (OldTimer Tools)
HijackThis.exe -> F:\Documents and Settings\Administrator\Desktop\HijackThis.exe -> [2009/08/31 10:47:51 | 00,401,720 | —- | C] (Trend Micro Inc.)
ERDNT -> F:\WINDOWS\ERDNT -> [2009/08/31 10:39:13 | 00,000,000 | —D | C]
NTREGOPT.lnk -> F:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk -> [2009/08/31 10:38:42 | 00,000,641 | —- | C] ()
ERUNT.lnk -> F:\Documents and Settings\Administrator\Desktop\ERUNT.lnk -> [2009/08/31 10:38:42 | 00,000,622 | —- | C] ()
ERUNT -> F:\Program Files (x86)\ERUNT -> [2009/08/31 10:38:41 | 00,000,000 | —D | C]
RootRepeal.exe -> F:\Documents and Settings\Administrator\Desktop\RootRepeal.exe -> [2009/08/31 09:56:36 | 00,472,064 | —- | C] ( )
asdjflkjt.exe -> F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe -> [2009/08/31 09:56:29 | 00,791,393 | —- | C] (Lars Hederer												)
bincd32.dat -> F:\WINDOWS\SysWow64\bincd32.dat -> [2009/08/15 06:15:07 | 00,000,004 | —- | C] ()
My Videos -> F:\Documents and Settings\All Users\Documents\My Videos -> [2009/08/02 14:55:40 | 00,000,000 | R–D | C]
My Videos -> F:\Documents and Settings\Administrator\My Documents\My Videos -> [2009/08/02 14:55:40 | 00,000,000 | R–D | C]
EndNote X -> F:\Program Files (x86)\EndNote X -> [2009/08/02 14:44:09 | 00,000,000 | —D | C]
EndNote -> F:\Documents and Settings\Administrator\Application Data\EndNote -> [2009/08/02 14:41:10 | 00,000,000 | —D | C]
Sp32w.dll -> F:\WINDOWS\SysWow64\Sp32w.dll -> [2009/07/11 15:45:00 | 00,033,280 | —- | C] ()
brss01a.ini -> F:\WINDOWS\SysWow64\brss01a.ini -> [2009/07/11 15:17:25 | 00,000,030 | —- | C] ()
BRWMARK.INI -> F:\WINDOWS\BRWMARK.INI -> [2009/07/11 15:17:24 | 00,000,410 | —- | C] ()
BRVIDEO.INI -> F:\WINDOWS\BRVIDEO.INI -> [2009/07/11 14:14:28 | 00,000,153 | —- | C] ()
brpp2ka.ini -> F:\WINDOWS\brpp2ka.ini -> [2009/07/11 14:14:28 | 00,000,052 | —- | C] ()
BRDIAG.INI -> F:\WINDOWS\BRDIAG.INI -> [2009/07/11 14:14:28 | 00,000,040 | —- | C] ()
Brownie.ini -> F:\WINDOWS\Brownie.ini -> [2009/07/11 14:14:28 | 00,000,023 | —- | C] ()
bw5170dn.ini -> F:\WINDOWS\bw5170dn.ini -> [2009/07/11 14:14:28 | 00,000,000 | —- | C] ()
brmx2001.ini -> F:\WINDOWS\brmx2001.ini -> [2009/07/11 14:14:28 | 00,000,000 | —- | C] ()
BROSNMP.DLL -> F:\WINDOWS\SysWow64\BROSNMP.DLL -> [2009/07/11 14:14:26 | 00,077,824 | —- | C] ()
BRGSRC32.DLL -> F:\WINDOWS\SysWow64\BRGSRC32.DLL -> [2009/07/11 14:14:26 | 00,026,624 | —- | C] ()
HL-5170DN.INI -> F:\WINDOWS\HL-5170DN.INI -> [2009/07/11 14:14:26 | 00,015,108 | —- | C] ()
BRGSRC16.DLL -> F:\WINDOWS\SysWow64\BRGSRC16.DLL -> [2009/07/11 14:14:26 | 00,004,608 | —- | C] ()
PTRCENG.DLL -> F:\WINDOWS\SysWow64\PTRCENG.DLL -> [2009/07/11 14:14:13 | 00,045,056 | —- | C] ()
ODBC.INI -> F:\WINDOWS\ODBC.INI -> [2009/07/11 14:07:47 | 00,000,376 | —- | C] ()
PerfStringBackup.INI -> F:\WINDOWS\SysWow64\PerfStringBackup.INI -> [2009/07/10 20:54:58 | 00,541,752 | —- | C] ()
win.ini -> F:\WINDOWS\win.ini -> [2009/07/10 20:39:26 | 00,000,497 | —- | C] ()
system.ini -> F:\WINDOWS\system.ini -> [2009/07/10 16:16:08 | 00,000,150 | —- | C] ()
quartz.dll -> F:\WINDOWS\SysWow64\quartz.dll -> [2005/03/25 08:00:00 | 01,291,264 | —- | C] ()
qedwipes.dll -> F:\WINDOWS\SysWow64\qedwipes.dll -> [2005/03/25 08:00:00 | 00,733,696 | —- | C] ()
qedit.dll -> F:\WINDOWS\SysWow64\qedit.dll -> [2005/03/25 08:00:00 | 00,512,512 | —- | C] ()
dxmasf.dll -> F:\WINDOWS\SysWow64\dxmasf.dll -> [2005/03/25 08:00:00 | 00,498,742 | —- | C] ()
encdec.dll -> F:\WINDOWS\SysWow64\encdec.dll -> [2005/03/25 08:00:00 | 00,396,288 | —- | C] ()
qdvd.dll -> F:\WINDOWS\SysWow64\qdvd.dll -> [2005/03/25 08:00:00 | 00,385,536 | —- | C] ()
msjetoledb40.dll -> F:\WINDOWS\SysWow64\msjetoledb40.dll -> [2005/03/25 08:00:00 | 00,355,112 | —- | C] ()
qdv.dll -> F:\WINDOWS\SysWow64\qdv.dll -> [2005/03/25 08:00:00 | 00,279,040 | —- | C] ()
sbe.dll -> F:\WINDOWS\SysWow64\sbe.dll -> [2005/03/25 08:00:00 | 00,276,992 | —- | C] ()
ir32_32.dll -> F:\WINDOWS\SysWow64\ir32_32.dll -> [2005/03/25 08:00:00 | 00,199,168 | —- | C] ()
qcap.dll -> F:\WINDOWS\SysWow64\qcap.dll -> [2005/03/25 08:00:00 | 00,192,512 | —- | C] ()
msencode.dll -> F:\WINDOWS\SysWow64\msencode.dll -> [2005/03/25 08:00:00 | 00,114,688 | —- | C] ()
amstream.dll -> F:\WINDOWS\SysWow64\amstream.dll -> [2005/03/25 08:00:00 | 00,072,704 | —- | C] ()
mciqtz32.dll -> F:\WINDOWS\SysWow64\mciqtz32.dll -> [2005/03/25 08:00:00 | 00,062,464 | —- | C] ()
devenum.dll -> F:\WINDOWS\SysWow64\devenum.dll -> [2005/03/25 08:00:00 | 00,061,440 | —- | C] ()
tsd32.dll -> F:\WINDOWS\SysWow64\tsd32.dll -> [2005/03/25 08:00:00 | 00,016,896 | —- | C] ()
msdmo.dll -> F:\WINDOWS\SysWow64\msdmo.dll -> [2005/03/25 08:00:00 | 00,014,336 | —- | C] ()
msdxmlc.dll -> F:\WINDOWS\SysWow64\msdxmlc.dll -> [2005/03/25 08:00:00 | 00,004,126 | —- | C] ()
OUTLPERF.INI -> F:\WINDOWS\SysWow64\OUTLPERF.INI -> [2003/01/07 15:05:08 | 00,002,695 | —- | C] ()
 
[Files/Folders - Modified Within 30 Days]
Adobe Acrobat Speed Launcher.lnk -> F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk -> [2009/09/01 13:33:33 | 00,002,359 | —- | M] ()
SA.DAT -> F:\WINDOWS\tasks\SA.DAT -> [2009/09/01 13:33:31 | 00,000,006 | -H– | M] ()
bootstat.dat -> F:\WINDOWS\bootstat.dat -> [2009/09/01 13:33:30 | 00,002,048 | –S- | M] ()
exe.reg -> F:\Documents and Settings\Administrator\Desktop\exe.reg -> [2009/09/01 13:32:24 | 00,000,437 | —- | M] ()
NTUSER.DAT -> F:\Documents and Settings\Administrator\NTUSER.DAT -> [2009/09/01 13:32:02 | 01,310,720 | -H– | M] ()
ntuser.ini -> F:\Documents and Settings\Administrator\ntuser.ini -> [2009/09/01 13:32:02 | 00,000,178 | -HS- | M] ()
fixme.reg -> F:\Documents and Settings\Administrator\Desktop\fixme.reg -> [2009/09/01 10:17:04 | 00,000,350 | —- | M] ()
query.bat -> F:\Documents and Settings\Administrator\Desktop\query.bat -> [2009/09/01 08:23:40 | 00,000,129 | —- | M] ()
OTS.exe -> F:\Documents and Settings\Administrator\Desktop\OTS.exe -> [2009/08/31 11:33:10 | 00,514,048 | —- | M] (OldTimer Tools)
HijackThis.exe -> F:\Documents and Settings\Administrator\Desktop\HijackThis.exe -> [2009/08/31 10:48:16 | 00,401,720 | —- | M] (Trend Micro Inc.)
NTREGOPT.lnk -> F:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk -> [2009/08/31 10:38:42 | 00,000,641 | —- | M] ()
ERUNT.lnk -> F:\Documents and Settings\Administrator\Desktop\ERUNT.lnk -> [2009/08/31 10:38:42 | 00,000,622 | —- | M] ()
RootRepeal.exe -> F:\Documents and Settings\Administrator\Desktop\RootRepeal.exe -> [2009/08/31 09:49:34 | 00,472,064 | —- | M] ( )
asdjflkjt.exe -> F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe -> [2009/08/31 09:48:46 | 00,791,393 | —- | M] (Lars Hederer												)
bincd32.dat -> F:\WINDOWS\SysWow64\bincd32.dat -> [2009/08/15 07:01:40 | 00,000,004 | —- | M] ()
IconCache.db -> F:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db -> [2009/08/15 06:32:36 | 06,413,810 | -H– | M] ()
qmgr1.dat -> F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2009/08/12 05:56:56 | 00,005,508 | —- | M] ()
qmgr0.dat -> F:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2009/08/12 05:56:56 | 00,004,232 | —- | M] ()
opa11.dat -> F:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat -> [2009/07/11 14:08:27 | 00,008,206 | —- | M] ()
< End of report >

Hi, did you right click and run the regfix as an administrator?

Hi,

did you right click and run the regfix as an administrator?

I don't have that option in the right-click contextual menu.

My choices are:

Merge
Edit
Print
Open With…
Scan for Threats…
Send To ->
Cut
Copy
Create Shortcut
Delete
Rename
Properties

When I ran it, I got prompted with "Are you sure you want to add the information in to the registry?"
I clicked "Yes"
Then it said "Information in has been successfully entered into the registry".

Then I rebooted.

Perhaps this might help? http://www.dougknox.com/xp/file_assoc.htm

No, Those reg fixes are only for XP. I need to look into this a little more.

Just as a reminder, this machine we're working on *is* XP, but it's the 64-bit version. It is not Vista or Win7.

Operating System: Windows Vista Enterprise 64-bit

That will teach me to just look at your user profile……

Ok, let me look into this more now

Thanks for pointing that out

I had a feeling that was the case…

Hi,

I have asked assistance from a colloeague who knows 64bit systems inside out as I want to make certain any fix I give you is correct for your OS.

In the meantime, try running MalwareBytes Antimalware

Rename it to MBAM.com before you save it

Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.com to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Well, that was almost an exercise in frustration trying to install applications without being able to double-click .exe files, lol. But I managed to get it on and updated and ran the scan. Here's the log. Malwarebytes' Anti-Malware 1.40 Database version: 2729 Windows 5.2.3790 Service Pack 1 9/2/2009 9:20:56 AM mbam-log-2009-09-02 (09-20-56).txt Scan type: Quick Scan Objects scanned: 82849 Time elapsed: 1 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 1 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{76dc0b63-1533-4ba9-8be8-d59eb676fa02} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Windows antiVirus pro (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win AntiVirus Pro (Rogue.WindowsAntiVirus) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Windows antiVirus pro (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (F:\WINDOWS\SysWow64\desot.exe "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe rundll32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully. Folders Infected: F:\Documents and Settings\Administrator\Start Menu\Programs\Windows AntiVirus Pro (Rogue.WindowsAntiVirus) -> Quarantined and deleted successfully. Files Infected: F:\Documents and Settings\Administrator\Start Menu\Programs\Windows AntiVirus Pro\Windows Antivirus Pro.lnk (Rogue.WindowsAntiVirus) -> Quarantined and deleted successfully. F:\WINDOWS\system32\bincd32.dat (Malware.Trace) -> Quarantined and deleted successfully.

OH HEY… After reboot, I can run .exe files! I noticed in the log I was posting the Registry Data Items Infected section contained a deletion of a bad key and it looks like that fixed the problem. I immediately ran my antivirus app updater to get up to date there because I was feeling nervous having that machine sitting on the network without the latest dat files. There are also windows updates I need to apply, but I will wait for your next instructions before running wild with updaters and whatnot.

Good

I expected Malware Bytes would be able to mend the exe situation

We should do an online scan to make sure there aren't any leftovers. After the scan go ahead and update all you need to.

Please do the following: I believe this scan supports 64 bit systems, if it doesn't do the Panda Scan.

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the [external image: Posted Image] button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the [external image: Posted Image] button.
• Push [external image: Posted Image]

NEXT

Perform an online scan with Internet Explorer with Panda ActiveScan

• Click on Scan your PCnow button located at the bottom of the page.
• A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
• Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting the Local Disks button

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on the See Report button, then Save Report and save it to a convenient location. Post the report in your next response.
  
• You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan