What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

wscipt.exe problems

342 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am not sure what I have downloaded or installed to cause this problem but whenever I restart my computer attempts to open Internet Explorer pages before loading up completely, which I can bypass by cancelling the RunOnce.exe process, but then it proceeds to open several (20+) wscript.exe processes which open between 20 and 120 internet explorer and firefox windows, it also attempts to send email via Outlook and Microsoft mail, neither of which are set up. Anyways here is the HijackThis log, the OTL log was taking over an hour to complete with the given specs. Thanks in advance!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:51:33 PM, on 6/1/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\DAP\DAP.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Sun\SDK\jdk\bin\javaw.exe
C:\Program Files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Administrator\Desktop\OTL.exe
C:\Users\Administrator\Desktop\HiJackThis.exe

R3 - URLSearchHook: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngin0.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\IPS\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll
O2 - BHO: Download Accelerator Plus Integration - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~2\DAP\DAPIEL~1.DLL
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: GOM Player + Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: (no name) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngin0.dll
O3 - Toolbar: (no name) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)
O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll
O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (file missing)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\coIEPlg.dll
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CarboniteSetupLite] "C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=1800
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QT Lite\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LifeChatSetup] "D:\setupstb.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files (x86)\DAP\DAP.EXE" /STARTUP
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: SDK Tray Menu.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files (x86)\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Web Printing ?d?\?|?U???I”n?\?| - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareup…15108/CTPID.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton Security Suite (N360) - Symantec Corporation - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: UCManSvc - Paltiosoft Inc. - C:\Program Files (x86)\SoftDenchi\UCManSvc.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12911 bytes
Post #2
Hi ryoga99,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

At minimum, you've got some adware and misc. garbage on there.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #3
I ran ComboFix, it made it as far as this step, I did run it as Admin but it still had some problems: Scanning for infected files . . . This typically doesn't take more than 10 minutes However, scan times for badly infected machines may easily double Completed Stage_1 Completed Stage_2 Completed Stage_3 Completed Stage_4 Completed Stage_5 Completed Stage_6 Completed Stage_6A Completed Stage_7 Completed Stage_8 Completed Stage_9 Completed Stage_10 Completed Stage_11 Completed Stage_12 Completed Stage_13 Completed Stage_14 Completed Stage_15 Completed Stage_16 Completed Stage_17 Completed Stage_18 Completed Stage_19 Completed Stage_19B Completed Stage_20 Completed Stage_21 Completed Stage_22 Completed Stage_23 Completed Stage_24 Completed Stage_25 Completed Stage_26 Completed Stage_27 Completed Stage_28 Completed Stage_29 Completed Stage_30 Completed Stage_31 Completed Stage_32 Completed Stage_32A Completed Stage_33 Completed Stage_34 Completed Stage_35 Completed Stage_36 Completed Stage_37 Completed Stage_38 Access Denied. Administrator permissions are needed to use the selected options. Use an administrator command prompt to complete these tasks. Completed Stage_39 Completed Stage_40 Completed Stage_41 Completed Stage_42 Completed Stage_43 Completed Stage_44 Completed Stage_45 Completed Stage_46 Completed Stage_47 Completed Stage_48 Completed Stage_49 Completed Stage_50
Post #4
Also, I know you didn't ask for this but the OTL I was running finally finished and here are the contents:

OTL Extras logfile created on: 6/1/2011 11:16:06 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Administrator\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

11.99 Gb Total Physical Memory | 6.80 Gb Available Physical Memory | 56.72% Memory free
23.91 Gb Paging File | 19.09 Gb Available in Paging File | 79.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.26 Gb Total Space | 177.68 Gb Free Space | 12.72% Space Free | Partition Type: NTFS
Drive D: | 24.45 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive J: | 1397.26 Gb Total Space | 1372.01 Gb Free Space | 98.19% Space Free | Partition Type: NTFS

Computer Name: NICK-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [Browse with FastStone] – "C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with FastStone] – "C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = 0F BC 62 45 95 1A CC 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04106837-B8DF-4A68-8C24-27B29D24424F}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{0B98D8E5-A237-4926-AAF6-97E602A17CE9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{0C1B5C04-6BBE-483D-A981-093CD2C0267D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0E4A6E2B-139A-4D95-A27C-C3DE91C4D533}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{1116CBCA-5381-4D79-B261-45D2D8522BCB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{11E1DC72-BB95-4DE4-9FFA-5EB7C675960F}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{13459B82-D3E4-42E6-8BE5-560EE8DAAA23}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe |
"{16F6E3BD-762F-4B9B-B63D-7491F4F2494C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{1711B4BC-30F3-4719-8E37-2E4477A03458}" = lport=80 | protocol=6 | dir=in | name=@wsmres.dll,-50 |
"{17B3BBA4-3992-4BD4-B9A5-CB7B161BA494}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{1863A941-EACF-4DAC-A347-154D002BAB02}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{1BE2F736-67D4-47C8-A352-AD10C9D32347}" = rport=2178 | protocol=6 | dir=out | app=system |
"{1D3F8AFF-602C-4F59-9D1E-63F0E5F1214F}" = rport=10243 | protocol=6 | dir=out | app=system |
"{22CC4AFA-4AC1-4196-824A-903E0685214D}" = rport=5358 | protocol=6 | dir=out | app=system |
"{25397D40-1899-4B4C-BD92-031D42187838}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{29347EB7-E11A-4352-BF07-6ADBA80FD952}" = rport=5357 | protocol=6 | dir=out | app=system |
"{298A1573-7302-49A6-B46E-F0A860D480D8}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{2C6FE1B3-DB87-4F92-B802-920A91751024}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{32B162A8-A9E9-43EF-9F7E-BEF3941B835F}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{337DDBCC-4A34-41B7-9EDA-5EF13603750E}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{33C3C04C-1F98-42EC-9834-1A0EC830ED15}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{33CCF905-FAE3-4A94-A116-457F09802BB0}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{39B181E8-EF4A-482E-8621-94A554362DA7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{3F95C93B-EBCC-4CF4-B538-D6BD81CFA411}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{42FBD4C3-4849-4B07-876B-FA2CB02302A8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{452413E7-D8E1-4DC1-954B-A52BE197470F}" = lport=138 | protocol=17 | dir=in | app=system |
"{4CE4B1C1-7B41-4F88-8FAB-1E3697864034}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{5149A0E0-BF5A-4313-9549-84DD27CA70FF}" = lport=10244 | protocol=6 | dir=in | app=system |
"{51DF7847-55E0-44A3-8E5D-842981748065}" = lport=2178 | protocol=6 | dir=in | app=system |
"{53363335-D4DC-45F0-8106-A5186C4E7374}" = lport=3390 | protocol=6 | dir=in | app=system |
"{562BA1D9-B6F7-4035-B504-1BDAE7B7B518}" = lport=137 | protocol=17 | dir=in | app=system |
"{5D72CBB9-FC4B-428B-AE2B-8B8D9D4FB9F2}" = rport=137 | protocol=17 | dir=out | app=system |
"{6187DAC9-0C0C-46B8-9135-6E2FDA2C0CFE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{618F63CD-7AB3-47CB-83DF-B9F9C00CED78}" = rport=138 | protocol=17 | dir=out | app=system |
"{66697E41-22EF-477E-A40B-C5E0C3BE66A3}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{6B3F2DFF-56DA-4B70-9375-E4D69DD88C04}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{7692A2DD-62B3-4AE0-8498-3575100992D2}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{769A5B44-05B8-446F-8B8E-CEF28B91ED68}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{7D3AEFAE-3029-4ECF-AA8C-875ED3789F87}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{7DCB709E-8F56-4DED-87DF-DA33B07D7001}" = lport=445 | protocol=6 | dir=in | app=system |
"{8336C8C6-85B3-469A-A50C-B5D9998FA2D5}" = lport=445 | protocol=6 | dir=in | app=system |
"{90DBC2C4-E03A-4A01-921C-E7A39F942D54}" = lport=rpc | protocol=6 | dir=in | svc=eventlog | app=c:\windows\system32\svchost.exe |
"{925D8BCA-D853-4B31-BC9A-A3BC9521FE47}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{973AE764-D95A-45E3-A3AE-91B288919A46}" = lport=445 | protocol=6 | dir=in | app=system |
"{9DD857E4-3376-4D75-9878-FA1888BD6222}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{9FEF374B-95E2-40C3-A907-F9EB96643233}" = lport=rpc | protocol=6 | dir=in | svc=schedule | app=c:\windows\system32\svchost.exe |
"{A02989AB-0736-43FD-82C7-B8797104B689}" = lport=5358 | protocol=6 | dir=in | app=system |
"{A10BA8AD-75BD-4CCA-BA2E-051ED7365A45}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{A3F6262C-27D1-4865-B300-405C98D40F1B}" = lport=6881 | protocol=6 | dir=in | name=blizzard downloader: 6881 |
"{A735F095-83F0-48AD-8E78-3E2ED7E34935}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{AB3DC130-B89D-418C-AB00-E36BD2B8C43F}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{ADEA539F-A5CA-49CC-B3A4-CF4290F6C3DF}" = rport=445 | protocol=6 | dir=out | app=system |
"{AF952CAF-980E-4EAD-B450-8F56B5F97E06}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B0769A82-8245-40E5-8A07-0216C6FF6E7A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B187B504-C185-4371-BC3D-41685D8EC1D2}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{B6EC09C6-1143-42FC-9E63-3C689D4ACC4E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{B9786EB4-E013-405E-9197-F3FB3FF92934}" = lport=445 | protocol=6 | dir=in | app=system |
"{BE94987A-02AD-4BAB-97FE-90D98A26FE23}" = lport=rpc | protocol=6 | dir=in | svc=* | app=c:\windows\system32\svchost.exe |
"{BFC9365B-052F-4CD4-80D6-344653F61AA9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{C529AA85-6864-4438-BECF-1298BEB8287A}" = lport=5357 | protocol=6 | dir=in | app=system |
"{C5E48CB5-85AC-4ABB-B288-B27501B70123}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{CBA9CAAE-9B09-4580-9B50-C8AB93024F51}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{CF3C5FD5-7D2B-40E9-B7E9-D3BF5CC2C58E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D1518A14-EB84-4383-B16F-37A37FF1A1F2}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{D17E21AE-0F9D-47BC-ABD3-71FE6F70DB17}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{D205F94A-43AE-4FDB-AD1D-9436C27913FE}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{D228379F-F1B7-46A0-9823-17070D919C0F}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D2675679-474C-4BD3-96CE-9DBED42D1825}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{D923B863-BC18-4880-ADFE-A99FC6E44EEB}" = rport=10244 | protocol=6 | dir=out | app=system |
"{DAE56094-6D3C-41DE-A266-1ADC213DD937}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{DB15EEDD-F2EF-4D70-943D-8F7B6F56B3E4}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{DD8D98CA-CAE3-4B61-AB3F-0B70C5095763}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{E0D9D3F7-E8EF-4C2F-85DB-1C761A0E6499}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{E87460A5-BA25-41E1-957D-2FF48C138132}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EC2DD520-BFEC-4FE8-B022-2EAB31EE303D}" = lport=5985 | protocol=6 | dir=in | app=system |
"{F0C0554B-1920-44B0-9D30-71022E852754}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F2608B58-D01C-44B9-B45A-6817397957BC}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{F62F10C0-49C4-405F-B9A7-F5D57713EE99}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{FA5CBBD5-D260-428A-B815-34F3FCF3785B}" = rport=139 | protocol=6 | dir=out | app=system |
"{FBF6F721-4C27-4A0A-AE67-48ABE0006419}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{FE3CED07-59A8-46EC-9DBE-7A81B2BB52A5}" = lport=139 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03C15274-4FAA-4839-82F3-E5FB8DC85475}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{08407BAA-5C9B-423E-8FDA-FDFCA469353E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{0958E77C-5ADB-4E12-A490-B4E85F7C9B93}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{0978C08A-EADE-495C-BC55-AB190495C979}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\docs\ea help\electronic_arts_technical_support.htm |
"{0AF5D09E-29F6-4225-8AF3-D4329C6BDE28}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{0B893829-C72A-4BCF-B419-8379FEE2644A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\eufloria\eufloria.exe |
"{10193A01-FAE4-423C-90C4-0E602C454D11}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grotesque tactics\grotesquetactics.exe |
"{12E01890-ED87-46F0-9CA6-42B498EB69F2}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{13D1CB22-DB68-4566-A961-65B8C57F6FF9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic the gathering - duels of the planeswalkers\dotp.exe |
"{1BE11F25-C56D-48F7-86EA-C808507CF30C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\blood bowl\manual.pdf |
"{1CFBACCA-4818-4EA1-88DC-25FFD492CAC0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\on the rain-slick precipice of darkness - episode one\rainslickep1.exe |
"{1D292703-3A33-46D2-BE07-02997DF522F0}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe |
"{1DED68D8-2F6C-47F7-B42E-8DDA3BF11BE9}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{1E7A4B04-08C3-4F65-96F8-E59BF74A47BC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ii\docs\ea help\electronic_arts_technical_support.htm |
"{21B0E700-149A-412F-AC3C-9DD6C30DBF8E}" = protocol=6 | dir=in | app=c:\psd\psopenlf.exe |
"{26D9B00E-D717-4217-A082-70B282D33F8B}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{28CD4123-30F6-4A31-A723-90539BEC4AA9}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age 2 demo\dragonage2launcher.exe |
"{2A65CD2B-84B7-466D-AFB0-73A73264A1C6}" = protocol=6 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{2D6C56DC-6A90-4EC2-AE0D-55330AAB35DA}" = protocol=17 | dir=in | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{2EDBC3D6-7DD0-4C9F-8CDA-DB76040051FA}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{31DB573B-2A11-409B-8CF9-B0916726B8E7}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{3D4263F6-C3C0-4AD2-AE7A-A49C79B5332A}" = protocol=17 | dir=out | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{3D4891A4-6AB9-46CA-8D2A-62DF2408302E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\daoriginslauncher.exe |
"{3EC97CB5-DCC6-4CE0-BC3D-579B8C8BE50B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\delve deeper\delvedeeper.exe |
"{3F5CDAC5-57AA-4E34-A4E6-D5D10DC3F836}" = protocol=6 | dir=out | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{4024253B-CFBE-4BE2-9412-4746CA58C221}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\blood bowl\strategyguide.pdf |
"{404F34A1-3482-40EA-AD38-D1589397390E}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{4076BC14-EF87-44FB-BDFF-2FB4376C9735}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\droplitz\cascade.exe |
"{432EAAF0-F19F-4843-8AD4-C0BAB8479B6F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{44670626-CA79-4BFA-B129-BF7F744E8536}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |
"{45E827C2-3625-4841-85AA-4AFA1718A853}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\daupdatersvc.service.exe |
"{45FE3E90-04F3-46F2-94D8-62492478EE4E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\swkotor\swkotor.exe |
"{47D3A029-7D5C-499F-BDA3-478277559308}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{4902542A-770F-4EF0-B457-36EA2066B197}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{494FA5F8-4E2A-4F95-B77B-7DBAB0F2542E}" = protocol=6 | dir=in | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{4AB27EDA-79DF-4D71-AAE9-FD94241906D4}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{4B002542-25CD-446C-8A62-370CFD34DAE9}" = protocol=6 | dir=in | app=c:\program files (x86)\relevantknowledge\rlvknlg.exe |
"{4BD10957-0471-47FA-92BF-6C29E485AF8B}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{4D6864F7-EDB5-494F-9EA2-59F449907B75}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\penny arcade adventures on the rain-slick precipice of darkness episode 2\rainslickep2.exe |
"{4D849155-3368-4F10-B629-1351E384AE0F}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{4F45FBC5-EFF4-4DC6-B966-2C3FBB3975AC}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{4F73BA52-6DE6-4E64-A66D-4D55E9ED67CE}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{50213DB1-6478-4B07-A631-F7E890EDF744}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{50280424-64BF-43CC-BCBB-A685F9FEFF6B}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{511ACA13-6E86-4C21-99E6-BB7E3EFC8723}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{51D63259-1761-422F-A17D-6C1B5016E4A3}" = protocol=6 | dir=out | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{51EA9EE9-4151-4DEE-BD07-D2552CBD3C30}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{53858BC6-9CFD-4743-A20A-35957B22B59A}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{541CDBB7-CC67-475E-9F26-9A9E06E3F678}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"{54D07119-D8A6-4FF0-8684-31BEB23EA4ED}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\blood bowl\strategyguide.pdf |
"{58417764-9A67-411E-9BE6-154C54D0F73F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{5A749848-9354-4E0E-8875-39CF4E3E8DB8}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |
"{5C536C48-CFC5-420D-9EEF-0641C48B8A21}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |
"{5C98965A-B51B-442A-8308-0BA06BE44D17}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{61F5E92D-863C-4784-AE24-32810AC13516}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\penny arcade adventures on the rain-slick precipice of darkness episode 2\rainslickep2.exe |
"{624BC325-DA5E-4549-BB06-06F27C814156}" = protocol=6 | dir=in | app=c:\users\administrator\appdata\local\apps\2.0\27hn4ab1.ggc\at9rmmob.0nm\curs..tion_eee711038731a406_0004.0000_1829574d2128b108\curseclient.exe |
"{64315470-AC2B-43BA-9FCA-1960C1E795A7}" = protocol=17 | dir=in | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{64FA3F19-A47B-490A-86E8-9434C6B404BC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\poker night at the inventory\celebritypoker.exe |
"{66FDE5C1-1202-440C-87DF-279791582A10}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{69F9122F-03E0-4065-A957-D83984E29A6D}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-enus-downloader.exe |
"{6CFEBC70-AE1F-44C4-8185-F32C0FC9315C}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{6D8E4F3D-6E3F-4EBE-A52F-4B33491E7DA2}" = protocol=6 | dir=out | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{6E4275E0-8A82-4A84-A451-F5D275055EAF}" = protocol=6 | dir=out | app=system |
"{6E7E0F50-3ACD-4D7E-92C3-EC644DB3B4C4}" = protocol=17 | dir=out | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{6FDDE426-4473-4984-B44C-AF544DC4B930}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{709AA080-607F-4B53-9480-94204DC67D79}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{72A88FC2-2E1A-49E7-996C-E096F19169F4}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{759C3A3E-19C6-460E-8170-ADB8DBD54AE4}" = protocol=6 | dir=in | app=c:\program files (x86)\relevantknowledge\rlvknlg.exe |
"{75FF04AB-BDD0-488F-87E5-DA5079122363}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\droplitz\cascade.exe |
"{782F8B19-E7CF-4683-B4D3-9D2B513ED223}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\swkotor\swkotor.exe |
"{78CB06E0-D9F6-4806-B45F-906C3A12DFFB}" = protocol=17 | dir=in | app=c:\program files (x86)\curse\curseclient.exe |
"{798CC047-60C5-4461-8E32-327A4678DF43}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{79B3B7DC-BAC1-4221-947D-CB67549E4E08}" = protocol=6 | dir=out | app=system |
"{7DEFF834-B5A4-4118-8808-89A40CE41DBF}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe |
"{7E896CDE-864C-47F5-837C-D6A5C8A5870C}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{8006981C-CF0A-44AD-B5DC-6216CE195737}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{8047263E-2EC1-45DA-8404-A26142666C6F}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{81E4B33C-7E05-48B5-90BF-360E5A9B2916}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{86F6B622-68C0-4122-83F9-5F5BFD93FDBF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ii\dragonage2launcher.exe |
"{880A6B22-2389-4E88-BFAA-FC353DEA04C6}" = protocol=17 | dir=in | app=c:\users\administrator\appdata\local\apps\2.0\27hn4ab1.ggc\at9rmmob.0nm\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\curseclient.exe |
"{895BA48E-9132-481E-9937-75764AFFA96A}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-enus-downloader.exe |
"{8D07A026-EDBD-4D8D-9E24-53C3F9919A80}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\world of goo\worldofgoo.exe |
"{91454D2D-8838-4E92-A797-0BD63F326141}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{91462E23-B284-4358-A58F-86D2012BCA24}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{91DEC211-35E0-4323-B8D0-5C0C51095557}" = protocol=6 | dir=in | app=c:\users\administrator\appdata\local\apps\2.0\27hn4ab1.ggc\at9rmmob.0nm\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\curseclient.exe |
"{9267C3A4-E597-450D-B9A0-D08B6057FD02}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic the gathering - duels of the planeswalkers\dotp.exe |
"{941842A7-05EB-4303-A27B-DABF5592474E}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age 2 demo\dragonage2launcher.exe |
"{985343C9-3D22-4C24-BB29-04C1F32AB3D5}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{9A507BCC-EC7C-4E84-B946-7D1AC1B6D4B4}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{9D8AD3C9-E9F0-490F-8BF6-926B99E0C076}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |
"{9DB5554C-4AF0-4599-ABD9-D02ECA548FD9}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{9E148599-052E-46A5-BA1B-54BB745E97BB}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe |
"{9EEA0441-3455-4228-908E-C29B66061A76}" = protocol=6 | dir=in | app=c:\users\administrator\appdata\local\temp\~os3c47.tmp\rlvknlg.exe |
"{9F02A7AC-085D-4EAC-9E6A-3C9F184024F8}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{A01F4372-5EB9-4467-A8B1-37B17C7348EC}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.patch.exe |
"{A0296FA3-E7A6-4B8A-9535-9C1CEAB06939}" = protocol=17 | dir=in | app=c:\psd\psopenlf.exe |
"{A133A256-0AFD-4E9B-B0EB-859B89A35AF3}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\blizzard downloader.exe |
"{A16D554E-0D1F-4D21-86FC-A2EA4EB5E23C}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{A20A0CBE-8F07-4F21-8866-169EF427558D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\eufloria\eufloria.exe |
"{A27D1F36-793C-4453-998E-75F840CBD021}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{A328E66C-AC98-4186-B1FF-1046C73996AD}" = protocol=6 | dir=in | app=c:\windows\system32\wbem\unsecapp.exe |
"{A38F1D84-DF9F-4FB8-A5BA-C456A0F2626B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe |
"{A4F45DC5-6E81-43B7-8247-6EFBF0781CEF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\poker night at the inventory\celebritypoker.exe |
"{A86274A5-3526-49C2-97DB-41200A057DF0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\delve deeper\delvedeeper.exe |
"{A8A94242-CB49-4760-B1EF-AD94CFF7C6CC}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{ABBF050E-E1BD-4BD7-BF08-A18B4DA48E3B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ii\docs\ea help\electronic_arts_technical_support.htm |
"{AD085015-BFD7-44DD-9F2A-13476164AFC3}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{AE813642-AB4B-4F56-B6DF-0758A0350BC9}" = protocol=6 | dir=in | app=c:\program files (x86)\curse\curseclient.exe |
"{AF93CFC5-D97E-4488-8474-199342211250}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\world of goo\worldofgoo.exe |
"{B22BA972-EB8C-4F09-89BE-BC14A7508B68}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{B36E7762-AD4E-471E-A96A-D271EF6928CC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\blood bowl\bb.exe |
"{B405BF35-C7D2-4215-8B4A-A5F2E7B7939A}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\blizzard downloader.exe |
"{B4B01A13-9C47-4487-9007-B4E142D89DA1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{B693555F-EBCD-4059-9E01-C324A5D02B59}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqcopy2.exe |
"{B7005A18-B460-4910-933B-ED8B33F93C88}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age 2 demo\bin_ship\dragonage2demo.exe |
"{BAEBA95D-3A29-415F-919E-A7A4C12615E1}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\blood bowl\bb.exe |
"{BB6FB297-1CE2-4BEB-874F-40C1EB404389}" = dir=in | app=c:\program files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{BC3AC497-C3FE-4C25-B160-CA7F1F584C60}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\daoriginslauncher.exe |
"{BD98CE27-3A6F-471E-874D-4D619D303B1B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\monkey2\monkey2.exe |
"{BD9C6436-F32C-474F-93D4-197E6ADDC880}" = protocol=6 | dir=in | app=c:\users\administrator\appdata\local\temp\~os7149.tmp\rlvknlg.exe |
"{BF0223A3-0FF5-4360-8E7E-3D88DFE4A3AF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\blood bowl\manual.pdf |
"{C1041D34-D595-4F0B-8E18-CA62F5307970}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{C3006C84-B521-443C-A482-DB02063816C6}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{C3091F1B-35E7-4A83-A82E-ACF99A18EFD2}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{C4ADEEF7-C8FF-4B64-8F00-2976F7670DEF}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{C82A3F9D-050D-4EBC-8B3F-51A7C9AAF365}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{C8B1EBBE-763E-43E9-868F-C6BE4F15BABD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CBAD60E5-53FD-493F-9D31-628568EE9702}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{CC40F302-ABB3-4F36-AB90-41106E3B18A1}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.patch.exe |
"{CDBDBA71-87F6-41E1-A415-6176D0F9AEBC}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-enus-downloader.exe |
"{D03AB19B-8C04-43DF-8CB5-E31026DA882D}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age 2 demo\bin_ship\dragonage2demo.exe |
"{D11CAB78-DB6B-48FA-9947-E6202886FEF9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\monkey2\monkey2.exe |
"{D238EEDC-BD19-4036-A4C7-2550184D26F7}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe |
"{D7457B6F-CA69-44CA-92E3-A2DD01DBD016}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-enus-downloader.exe |
"{D74FCE3A-CDAA-47F9-A1D4-76619D499AAF}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-enus-downloader.exe |
"{D8B81D40-4829-400E-8B66-FE10360E3221}" = protocol=17 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{DA62E5E4-F31F-47FF-904C-9279AAAB618B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\on the rain-slick precipice of darkness - episode one\rainslickep1.exe |
"{DB1A3D0E-8C51-41B1-BCF5-1576B2B7E26F}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{DBAB7239-2092-4E34-B0BC-46EE5CF9ED75}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"{DFBBD318-42F6-4834-BCC9-188DA3D69FE8}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{E02AAFE8-8B2C-4772-A016-310F224C5DB3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ii\dragonage2launcher.exe |
"{E1D310FC-12FB-4054-A525-EA6EC712B335}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-enus-downloader.exe |
"{E7024C91-AC14-43BF-8921-9A103D876533}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe |
"{E89BBD45-2BD4-4016-8F7B-26BB9A213ED4}" = protocol=6 | dir=in | app=c:\users\administrator\appdata\local\temp\~os46ef.tmp\rlvknlg.exe |
"{E96C2363-AB46-485D-8321-3EEE3130E865}" = protocol=17 | dir=in | app=c:\program files (x86)\relevantknowledge\rlvknlg.exe |
"{EA21DB5A-054B-49F5-832A-480499FF6081}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{EBCE778E-985D-4653-AB55-151D6F0B4540}" = protocol=17 | dir=in | app=c:\program files (x86)\relevantknowledge\rlvknlg.exe |
"{ED6F722C-6717-4F0A-A929-0A63138349EE}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe |
"{EDB1050E-FA6D-4BCC-9D7B-C14B2FF082F0}" = protocol=17 | dir=in | app=c:\users\administrator\appdata\local\apps\2.0\27hn4ab1.ggc\at9rmmob.0nm\curs..tion_eee711038731a406_0004.0000_1829574d2128b108\curseclient.exe |
"{F1F54069-ABF8-4E1C-995D-CFA0B804CBCB}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{F1F95967-00DA-412F-A5B5-A9483D2B1D36}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{F40E2014-D541-4BE5-B0E9-C0EF095B68FF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grotesque tactics\grotesquetactics.exe |
"{F5C12992-C0BE-48E8-9F40-62DB6E2B65F0}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{F64A7ABD-69D7-4858-8BB9-0C21635F0FAC}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{F8363140-F20F-446C-AE1D-A4238DACC534}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe |
"{FA16C912-F400-4F6B-B5D3-D33AA3ABF712}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\daupdatersvc.service.exe |
"{FA8D4E28-F2ED-4836-94A3-6EDEE8D368C2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\docs\ea help\electronic_arts_technical_support.htm |
"TCP Query User{16000625-64A4-44BC-B634-942A99D81E26}C:\sun\sdk\jdk\bin\java.exe" = protocol=6 | dir=in | app=c:\sun\sdk\jdk\bin\java.exe |
"TCP Query User{2DC73334-62B4-4534-B24A-52850852AC1D}J:\teatime\らぶデス５５５！\lovedeath555.exe" = protocol=6 | dir=in | app=j:\teatime\らぶデス５５５！\lovedeath555.exe |
"TCP Query User{44310028-DF52-4892-B232-108286D4EABB}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{44C329FA-F556-4D37-B40A-E1BE1E265BB4}J:\teatime\らぶデス５５５！\lovedeath555 english.exe" = protocol=6 | dir=in | app=j:\teatime\らぶデス５５５！\lovedeath555 english.exe |
"TCP Query User{56C260C5-0D58-4559-BAA0-3C6A747660F4}C:\windows\syswow64\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |
"TCP Query User{8EBE93AD-1083-431A-B93D-F79E1086D713}C:\program files (x86)\dap\dap.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dap\dap.exe |
"TCP Query User{94582D6C-386C-4391-90C9-7E3B3DF7923B}C:\users\administrator\appdata\local\temp\java_ee_sdk-5_07-jdk-6u16-windows.exe2\package\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\users\administrator\appdata\local\temp\java_ee_sdk-5_07-jdk-6u16-windows.exe2\package\jre\bin\javaw.exe |
"TCP Query User{A9A2EDA5-19DE-4DDB-B9E9-414505AD2183}C:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\daorigins.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\daorigins.exe |
"TCP Query User{E729354D-B2CB-4049-9BA2-4AB2B88DB54F}C:\program files (x86)\curse\curseclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\curse\curseclient.exe |
"TCP Query User{F5594A83-DCDB-4136-81C1-BC8915473E30}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe |
"UDP Query User{1B723960-028A-469B-B197-1FBF32DE1E5B}C:\program files (x86)\curse\curseclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\curse\curseclient.exe |
"UDP Query User{278CCE7C-79A6-484C-8C77-E68C81F97CD0}J:\teatime\らぶデス５５５！\lovedeath555.exe" = protocol=17 | dir=in | app=j:\teatime\らぶデス５５５！\lovedeath555.exe |
"UDP Query User{32875294-6BD2-40E5-9B77-C7530DC1AD51}J:\teatime\らぶデス５５５！\lovedeath555 english.exe" = protocol=17 | dir=in | app=j:\teatime\らぶデス５５５！\lovedeath555 english.exe |
"UDP Query User{643C7216-D55B-46C8-B8F3-56D0E2A2506D}C:\program files (x86)\dap\dap.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dap\dap.exe |
"UDP Query User{71C4EC86-31AD-42AE-AC31-2240E868E37F}C:\sun\sdk\jdk\bin\java.exe" = protocol=17 | dir=in | app=c:\sun\sdk\jdk\bin\java.exe |
"UDP Query User{91904DE6-EB7E-4016-91B7-EB802D30D2AB}C:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\daorigins.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\daorigins.exe |
"UDP Query User{9BFC01D1-C09D-42A4-926D-C0F4A68611BF}C:\users\administrator\appdata\local\temp\java_ee_sdk-5_07-jdk-6u16-windows.exe2\package\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\users\administrator\appdata\local\temp\java_ee_sdk-5_07-jdk-6u16-windows.exe2\package\jre\bin\javaw.exe |
"UDP Query User{E8A6AE96-BB6B-4F79-895B-C00D5A4C4600}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{EBC43F9E-C968-4C2F-8392-0B0107A1DCC0}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe |
"UDP Query User{ED85E037-0990-42DB-92C4-9E0E993EF4F9}C:\windows\syswow64\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dpnsvr.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1AAF3A3B-7B32-4DDF-8ABB-438DAEB46EEC}" = Windows Live Family Safety
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416016FF}" = Java™ 6 Update 16 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety
"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer
"{56F26668-13DA-497A-883F-61434A10CBAB}" = MobileMe Control Panel
"{5AEBB4A3-6878-4CEE-AD34-0F6958A983F0}" = HP Deskjet F4400 Printer Driver Software 13.0 Rel .5
"{64A3A4F4-B792-11D6-A78A-00B0D0160160}" = Java™ SE Development Kit 6 Update 16 (64-bit)
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8F473675-D702-45F9-8EBC-342B40C17BF5}" = Apple Mobile Device Support
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9545E9DB-6F4C-4404-BF25-E221BE8B44C5}" = iTunes
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 267.24
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 267.24
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E06AF9BE-E1D6-4867-8DBF-74E4BA32BBB3}" = DAP Plug-in for 64 Bit IE
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"doPDF 6 printer_is1" = doPDF 6.3 printer
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Ogg Codecs" = Ogg Codecs 0.81.15562
"Shop for HP Supplies" = Shop for HP Supplies
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03BD9204-6685-4307-8868-18F8CCFDE7BA}" = シュガーコートフリークス
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B712D56-0E32-4159-A3D2-7CD8A73F39F4}" = 微少女
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{140347A0-4A0C-44FC-9CA1-C8A3471899B7}" = SdRt4200
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{17828ACB-25FE-42B2-B05E-7D3026981B07}" = With Ribbon
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.7
"{1BE2B53E-27C8-4207-95E6-84873089C207}" = 11eyes -Resona Forma-
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{25136D99-7F99-4861-B7B2-B2430D4297F4}" = relations sister×sister
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 24
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{311EBF70-9282-41D1-BAB0-AD22220301B9}" = ３Ｄカスタム少女
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{37E3E507-FB56-4A9A-895F-1F88039ACF45}" = あかときっ！ －夢こそまされ恋の魔砲－
"{3BA9D546-B0E3-4549-BB2E-3F4FF65A1B81}" = YouTube Downloader Toolbar v4.4
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{402ED4A1-8F5B-387A-8688-997ABF58B8F2}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{41810510-3CE0-425B-BE07-B9793731737F}" = 神採りアルケミーマイスター
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{497072FE-0A75-4E5C-A5B7-EB1FA67F66F1}" = DJ_AIO_05_F4400_Software_Min
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D565319-8B91-41cb-961C-0DDC86101AC5}" = Dragon Age II Demo
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 5.0
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{51FAC155-0705-4EA0-B00F-7955676627BF}" = ILLUSION SexyビーチZERO
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{584EB168-D319-4795-BA97-AEE0A4EEBC8E}" = らぶデス５５５！
"{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}" = RGSS-RTP Standard
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5E7C721D-B008-4269-A1C4-2CE7E9757983}" = BoneTown
"{626C034B-50B8-47BD-AF93-EEFD0FA78FF4}" = Character Builder
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{78DBA0F5-56C4-4EF9-BBF2-CC69C0A1A738}" = るいは智を呼ぶＦＤ
"{7A387452-4D16-4EB9-9E74-76CA65534E45}" = Dealio Toolbar v4.4
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{88E16899-9A4E-4AEE-AB5C-20E318E4D3D0}" = らぶデス４
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EAD600D-1912-4DEF-92B5-0C7525E17ED2}" = F4400
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_PROHYBRIDR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{99b2f2d4-9744-44bc-85f7-d3af784ab037}" = 桜花センゴク
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A67066F8-1EFA-468A-8FAB-25E931BE1F50}" = rezumoe02
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{AE36D6DB-549F-440B-A2CD-5E6C56EDBCEB}" = ぶらぶら
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B77844E9-6AB1-4395-8E80-C2D16BD0EFD8}" = Reg Tool
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C13FE0EE-9F78-4081-A75C-7B4688ED41B2}" = Perfect Secretary 2011
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C5828861-B97B-4037-995C-C65E9CC13A3B}" = Sound Blaster Audigy
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C73F2967-062E-48F2-A462-D335B8950183}" = Safari
"{C754A10B-6861-4B41-99F1-D88851FCFA24}" = ILLUSION ですくとっぷメイト
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{d08d9f98-1c78-4704-87e6-368b0023d831}" = RelevantKnowledge
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}" = きゃらコレ！ ALICESOFT
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F3BB8D4D-F164-401B-92A8-78AD39EE0D25}_is1" = SISTERS ～夏の最後の日～
"{FAF26102-09D7-4C58-AB01-0D59A2E517CA}" = Copy
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"「ふくびき！トライアングル」　©BLUEGALE" = 「ふくびき！トライアングル」　©BLUEGALE
"AC3Filter_is1" = AC3Filter 1.63b
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Army Builder V3.2d" = Army Builder V3.2d
"AudioCS" = Creative ｵｰﾃﾞｲｵｺﾝﾄﾛｰﾙﾊﾟﾈﾙ
"BitTorrentBar Toolbar" = BitTorrentBar Toolbar
"Carbonite Setup Lite" = Carbonite Online Backup Setup
"CDisplay_is1" = CDisplay 1.8
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"conduitEngine" = Conduit Engine
"CoreFLAC Audio Decoder+Source Filter" = CoreFLAC Audio Decoder+Source Filter (remove only)
"Creative Software AutoUpdate" = Creative ｿﾌﾄｳｪｱ ｵｰﾄｱｯﾌﾟﾃﾞｰﾄ
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"CrossDays" = CrossDays
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"delivera" = でりばらっ！-deliverance of strays-
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"DS-Monkey Audio Source" = DS-Monkey Audio Source 1.00
"DUEE_TUKUTUKU" = つく×つく の アンインストール
"ExpressBurn" = Express Burn Disc Burning Software
"FastStone Image Viewer" = FastStone Image Viewer 4.0
"ffdshow" = ffdshow (remove only)
"FW_Grisaia" = グリザイアの果実
"GOM Player" = GOM Player
"HENSIN-PKP" = へんし～ん!!! ～パンツになってクンクンペロペロ～
"IDFEIDHNIBFLIBJJICKLICOBICPBICNF" = サマー☆きゃんぷ
"InstallShield_{03BD9204-6685-4307-8868-18F8CCFDE7BA}" = シュガーコートフリークス
"InstallShield_{17828ACB-25FE-42B2-B05E-7D3026981B07}" = With Ribbon
"InstallShield_{41810510-3CE0-425B-BE07-B9793731737F}" = 神採りアルケミーマイスター
"Java Platform, Enterprise Edition 5 SDK" = Java Platform, Enterprise Edition 5 SDK
"JCAGE" = じゅーしぃエイジ
"JGICJFKIJGLKICLNICLPICMGICMMIKHJIJIAIBGAIDFIIDIJIDEDIDIAIBJFIDFIIDEMIDIFIDI
JIBGA" = 魔物娘たちとの楽園～スライム＆スキュラ～
"Love×Evolution" = Love×Evolution
"Lula Inside" = Lula Inside
"MajiroAppPrimary Step" = Primary Step
"McAfee Security Scan" = McAfee Security Scan Plus
"Media Player - Codec Pack" = Media Player Codec Pack 3.9.6
"Monkey's Audio_is1" = Monkey's Audio
"MOV Player_is1" = MOV Player 1.0
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MPEG2 Codec(libmpeg2/mad)" = MPEG2 Codec(libmpeg2/mad)
"Mystery P.I. - Stolen in San Francisco" = Mystery P.I. - Stolen in San Francisco
"N360" = Norton Security Suite
"On the Rain-Slick Precipice of Darkness, Episode Two" = On the Rain-Slick Precipice of Darkness, Episode Two
"OpenAL" = OpenAL
"Plants vs. Zombies" = Plants vs. Zombies
"PROHYBRIDR" = 2007 Microsoft Office system
"qt7lite_is1" = QT Lite 3.2.2
"Quick PDF Converter v3.0" = Quick PDF Converter v3.0
"RapeLay" = RapeLay (remove only)
"RealAlt_is1" = Real Alternative 1.9.0
"Sengoku Rance English_is1" = Sengoku Rance English v1.0
"Steam App 11170" = Blood Bowl: Dark Elves Edition
"Steam App 18000" = On the Rain-Slick Precipice of Darkness, Episode One
"Steam App 18020" = On the Rain-Slick Precipice of Darkness, Episode Two
"Steam App 22000" = World of Goo
"Steam App 23120" = Droplitz
"Steam App 31280" = Poker Night at the Inventory
"Steam App 32159" = Everyday Genius: SquareLogic Demo
"Steam App 32370" = Star Wars: Knights of the Old Republic
"Steam App 32460" = Monkey Island 2: Special Edition
"Steam App 41210" = Eufloria
"Steam App 46450" = Grotesque Tactics: Evil Heroes
"Steam App 47810" = Dragon Age: Origins - Ultimate Edition
"Steam App 47900" = Dragon Age II
"Steam App 49400" = Magic: The Gathering - Duels of the Planeswalkers
"Steam App 63800" = Delve Deeper
"Sweet Robin Girl_is1" = Sweet Robin Girl
"SystemRequirementsLab" = System Requirements Lab
"Warcraft II BNE" = Warcraft II BNE
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
"zak_s_is1" = 究極魔法少女　絶対☆姉貴　アンインストーラー
"コイ★カツ！" = コイ★カツ！
"ティンクルベル カジノ★パラダイス" = ティンクルベル カジノ★パラダイス
"俺サマのラグナRock_is1" = 俺サマのラグナRock ver.1.00
"先生っ！　シてあげる" = 先生っ！　シてあげる
"夏にゃん" = 夏にゃん
"恋祭☆綺想カメリアノート_is1" = 恋祭☆綺想カメリアノート
"操心術０" = 操心術０

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"1005080179.elitistjerks.com" = Rawr
"BitTorrent" = BitTorrent
"HinataTerrace" = ひなたテラス
"JINKI_TRIAL1" = JINKI EXTEND Re：VISION -FIRST CONTACT-
"りとるらびっつ～わがままツインテール" = りとるらびっつ～わがままツインテール
"りぼる・さもなー" = りぼる・さもなー

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >
Post #5
This is the first bit of the OTL.txt, this is approximately 0.5% of the file, the whole thing is 168 MB:

OTL logfile created on: 6/1/2011 11:16:06 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Administrator\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

11.99 Gb Total Physical Memory | 6.80 Gb Available Physical Memory | 56.72% Memory free
23.91 Gb Paging File | 19.09 Gb Available in Paging File | 79.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397.26 Gb Total Space | 177.68 Gb Free Space | 12.72% Space Free | Partition Type: NTFS
Drive D: | 24.45 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive J: | 1397.26 Gb Total Space | 1372.01 Gb Free Space | 98.19% Space Free | Partition Type: NTFS

Computer Name: NICK-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
PRC - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\DAP\DAP.exe (SpeedBit Ltd.)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Program Files (x86)\SoftDenchi\UCManSvc.exe (Paltiosoft Inc.)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Sun\SDK\jdk\bin\javaw.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe (Hewlett-Packard Co.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\asoehook.dll (Symantec Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c
2\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c
2\msvcp90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\IME\IMEJP10\IMJPTIP.DLL (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\IMJP10K.DLL (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\IME\SHARED\IMETIP.DLL (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\IME\IMEJP10\IMJPAPI.DLL (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\IME\SHARED\IMJKAPI.DLL (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\IME\SHARED\imecfm.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Application Updater) – C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (N360) – C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (DAUpdaterSvc) – c:\Program Files (x86)\Steam\steamapps\common\dragon age ultimate edition\bin_ship\DAUpdaterSvc.Service.exe (BioWare)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (UCManSvc) – C:\Program Files (x86)\SoftDenchi\UCManSvc.exe (Paltiosoft Inc.)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (wuauserv) – C:\Windows\service.vbe ()


========== Driver Services (SafeList) ==========

DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\N360x64\0501000.01D\SRTSP64.SYS (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\SRTSPX64.SYS (Symantec Corporation)
DRV:64bit: - (SYMTDIv) – C:\Windows\SysNative\Drivers\N360x64\0501000.01D\SYMTDIV.SYS (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\SYMEFA64.SYS (Symantec Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\SYMDS64.SYS (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\Ironx64.SYS (Symantec Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\DRIVERS\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (sptd) – C:\Windows\SysNative\Drivers\sptd.sys ()
DRV:64bit: - (P17) – C:\Windows\SysNative\drivers\P17.sys (Creative Technology Ltd.)
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) – C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\DRIVERS\ASACPI.sys ()
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\DRIVERS\nvm60x64.sys (NVIDIA Corporation)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110601.002\EX64.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110601.002\ENG64.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110518.001\BHDrvx64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110531.001\IDSviA64.sys (Symantec Corporation)
DRV - (NPF) – C:\Windows\SysWOW64\drivers\npf.sys (CACE Technologies)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - Reg Error: Key error. File not found

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://wow.allakhazam.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.speedbit.com
IE - HKCU\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=616163"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.smellslikevictory.net/SMF/"
FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:9.5.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {6E19037A-12E3-4295-8915-ED48BC341614}:1.3.328.4
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.1
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=616163&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/21 02:26:24 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Program Files (x86)\RelevantKnowledge [2011/05/30 17:37:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2011/05/30 22:01:42 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn\ [2011/05/30 16:45:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/05/05 23:03:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/05/05 23:03:21 | 000,000,000 | —D | M]

[2009/10/08 21:58:32 | 000,000,000 | —D | M] (No name found) – C:\Users\Administrator\AppData\Roaming\Mozilla\Extensions
[2011/05/30 00:07:07 | 000,000,000 | —D | M] (No name found) – C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\extensions
[2010/04/27 11:38:47 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/06 22:10:55 | 000,000,000 | —D | M] (Easy Youtube Video Downloader) – C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2011/05/30 00:07:08 | 000,000,000 | —D | M] (Babylon) – C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\extensions\[removed]
[2010/06/12 12:25:10 | 000,002,059 | —- | M] () – C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\searchplugins\daemon-search.xml
[2011/05/30 22:10:58 | 000,002,468 | —- | M] () – C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\searchplugins\safesearch.xml
[2011/05/30 00:07:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/05/13 18:52:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/10 08:06:16 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/11 19:53:24 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/18 19:45:21 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/26 12:04:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/05/30 00:07:28 | 000,000,000 | —D | M] ("Babylon Spelling and Proofreading") – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
File not found (No name found) –
[2011/05/19 00:24:09 | 000,000,000 | —D | M] (Widgi Toolbar Platform) – C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM
[2010/11/30 12:11:27 | 000,000,000 | —D | M] (Download Accelerator Plus (DAP) extension) – C:\PROGRAM FILES (X86)\DAP\DAPFIREFOX
[2011/05/19 00:24:09 | 000,000,000 | —D | M] (Dealio Toolbar) – C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF
[2011/05/30 17:37:06 | 000,000,000 | —D | M] (RelevantKnowledge) – C:\PROGRAM FILES (X86)\RELEVANTKNOWLEDGE
[2011/05/22 18:41:52 | 000,000,000 | —D | M] (YouTube Downloader Toolbar) – C:\PROGRAM FILES (X86)\YOUTUBE DOWNLOADER TOOLBAR\FF
[2011/05/30 16:45:27 | 000,000,000 | —D | M] (Norton Toolbar) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\COFFPLGN
[2011/05/30 22:01:42 | 000,000,000 | —D | M] (Symantec IPS) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPLGN
[2010/10/21 17:42:56 | 000,000,000 | —D | M] (Gamevance TextLinks) – C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\EXTENSIONS\{EC8030F7-C20A-464F-9B0E-13A3A9E97384}\[removed]
[2011/05/05 23:03:18 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2011/05/30 00:07:04 | 000,002,191 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
[2011/05/05 23:03:20 | 000,002,252 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2006/09/18 16:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (DAPIELoader Class) - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files (x86)\DAP\DAPIELoader64.dll (SpeedBit Ltd.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (GOM Player + Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Download Accelerator Plus Integration) - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files (x86)\DAP\dapieloader.dll (SpeedBit Ltd.)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKLM\..\Toolbar: (no name) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - No CLSID value found.
O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - File not found
O3 - HKLM\..\Toolbar: (GOM Player + Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (GOM Player + Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [001] File not found
O4:64bit: - HKLM..\Run: [003] C:\Windows\SysNative\url.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [004] File not found
O4:64bit: - HKLM..\Run: [005] File not found
O4:64bit: - HKLM..\Run: [006] File not found
O4:64bit: - HKLM..\Run: [007] File not found
O4:64bit: - HKLM..\Run: [008] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [009] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [010] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [011] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [012] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [112] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [1omake_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [2_omake] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [3omake_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [4omake] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [anime] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [anime2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [animekun] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [animez] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [aniwota_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [cult_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [cult2_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [exp] File not found
O4:64bit: - HKLM..\Run: [Explorer] File not found
O4:64bit: - HKLM..\Run: [fuck1] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [fuck2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [fuckpedo] File not found
O4:64bit: - HKLM..\Run: [fuckpedo2_] File not found
O4:64bit: - HKLM..\Run: [fuckpedo2kuso] File not found
O4:64bit: - HKLM..\Run: [geroki_mo] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [GOGO] File not found
O4:64bit: - HKLM..\Run: File not found
O4:64bit: - HKLM..\Run: [help2] File not found
O4:64bit: - HKLM..\Run: [helpz] File not found
O4:64bit: - HKLM..\Run: [helpz2] File not found
O4:64bit: - HKLM..\Run: [hentai] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [hentai_2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [hentai2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [hentaic_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [hentaiz] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Internet] File not found
O4:64bit: - HKLM..\Run: [kimoi] File not found
O4:64bit: - HKLM..\Run: [kimoi2] File not found
O4:64bit: - HKLM..\Run: [kimois2] File not found
O4:64bit: - HKLM..\Run: [kimoiwo_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kimoiz] File not found
O4:64bit: - HKLM..\Run: [kimowot_a] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusai_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusoanime2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusofuck1] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusofuck2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusohelp2] File not found
O4:64bit: - HKLM..\Run: [kusohentai] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusohoo2] File not found
O4:64bit: - HKLM..\Run: [kusokimoi2] File not found
O4:64bit: - HKLM..\Run: [kusolog] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusomake3] C:\Windows\SysNative\url.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusomakedayoO] File not found
O4:64bit: - HKLM..\Run: [kusope_do] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusopedo2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [kusoshioki2] File not found
O4:64bit: - HKLM..\Run: [log] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [max] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MyDocuments] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [N013] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [N014] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikare] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikare_m] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikare2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikarem] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikarem_2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikarem2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikarem2kuso] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikaremz] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namikarez] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namipedo_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [namirei] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [omake_1] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [omake1z] File not found
O4:64bit: - HKLM..\Run: [omake2] File not found
O4:64bit: - HKLM..\Run: [omake2z] File not found
O4:64bit: - HKLM..\Run: [omake3] C:\Windows\SysNative\url.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [omake4] C:\Windows\SysNative\url.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [omakedayoO] File not found
O4:64bit: - HKLM..\Run: [oshioki] File not found
O4:64bit: - HKLM..\Run: [oshioki2] File not found
O4:64bit: - HKLM..\Run: [oshiokii2] File not found
O4:64bit: - HKLM..\Run: [oshiokiz] File not found
O4:64bit: - HKLM..\Run: [p2p_pedo] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedo] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedo_2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedo_ip_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedo2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedohentai] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedoip] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [pedoz] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [rhelp] File not found
O4:64bit: - HKLM..\Run: [rindex1] File not found
O4:64bit: - HKLM..\Run: [rindex2] File not found
O4:64bit: - HKLM..\Run: [rkimoi] File not found
O4:64bit: - HKLM..\Run: [romake1] File not found
O4:64bit: - HKLM..\Run: [romake2] File not found
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ryahoo] File not found
O4:64bit: - HKLM..\Run: [Service] File not found
O4:64bit: - HKLM..\Run: [Share_DLP] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [spare] File not found
O4:64bit: - HKLM..\Run: [start] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [sva] File not found
O4:64bit: - HKLM..\Run: [t_1] File not found
O4:64bit: - HKLM..\Run: [t_2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [ttttt] File not found
O4:64bit: - HKLM..\Run: [unko] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [winx_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [yahoo] File not found
O4:64bit: - HKLM..\Run: [yahoo2] File not found
O4:64bit: - HKLM..\Run: [yahooj_] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [zip] File not found
O4:64bit: - HKLM..\Run: [松本優樹（２４）] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [LifeChatSetup] D:\setupstb.exe (Microsoft Corporation)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QT Lite\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [DownloadAccelerator] C:\Program Files (x86)\DAP\DAP.EXE (SpeedBit Ltd.)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [WMPNSCFG] File not found
O4:64bit: - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\SysNative\WerFault.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [0B1] c:\boot.vbe ()
O4:64bit: - HKLM..\RunOnce: [0B2] C:\Windows\SysNative\sub.vbe ()
O4:64bit: - HKLM..\RunOnce: [0B3] File not found
O4:64bit: - HKLM..\RunOnce: [0B4] File not found
O4:64bit: - HKLM..\RunOnce: [0B5] File not found
O4:64bit: - HKLM..\RunOnce: [0B6] File not found
O4:64bit: - HKLM..\RunOnce: [0B7] File not found
O4:64bit: - HKLM..\RunOnce: [1B2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [1B3] File not found
O4:64bit: - HKLM..\RunOnce: [1B4] File not found
O4:64bit: - HKLM..\RunOnce: [anime] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [ero] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [fuckpedo] File not found
O4:64bit: - HKLM..\RunOnce: [geropedo] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: File not found
O4:64bit: - HKLM..\RunOnce: [helpman] File not found
O4:64bit: - HKLM..\RunOnce: [hentai] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [Internez Explorer] File not found
O4:64bit: - HKLM..\RunOnce: [kimoi] File not found
O4:64bit: - HKLM..\RunOnce: [kimoioyaji] File not found
O4:64bit: - HKLM..\RunOnce: [kuseehentai] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [Microsoft] File not found
O4:64bit: - HKLM..\RunOnce: [namikare] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [namikarem] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [namireg] File not found
O4:64bit: - HKLM..\RunOnce: [ohkimoi] File not found
O4:64bit: - HKLM..\RunOnce: [omake2] File not found
O4:64bit: - HKLM..\RunOnce: [oshioki] File not found
O4:64bit: - HKLM..\RunOnce: [pedo] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [reg1] File not found
O4:64bit: - HKLM..\RunOnce: [regsub2] File not found
O4:64bit: - HKLM..\RunOnce: [service] File not found
O4:64bit: - HKLM..\RunOnce: [sound] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [update] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [Windowz] File not found
O4:64bit: - HKLM..\RunOnce: [yahoo] File not found
O4:64bit: - HKLM..\RunOnce: [ZIP1] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [ZIP2] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [ZIP3] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [ZIP4] C:\Windows\SysNative\mshta.exe (Microsoft Corporation)
O4:64bit: - HKLM..\RunOnce: [ZIP5] File not found
O4:64bit: - HKLM..\RunOnce: [ZIP6] File not found
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SDK Tray Menu.lnk = C:\Sun\SDK\jdk\bin\javaw.exe (Sun Microsystems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: &Clean Traces - C:\Program Files (x86)\DAP\Privacy Package\dapcleanerie.htm ()
O8:64bit: - Extra context menu item: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm ()
O8:64bit: - Extra context menu item: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm ()
O8 - Extra context menu item: &Clean Traces - C:\Program Files (x86)\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm ()
O8 - Extra context menu item: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…15108/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/24 18:57:08 | 000,000,047 | R— | M] () - D:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2011/05/31 10:00:00 | 000,000,059 | R— | M] () - J:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{acbf97db-84bd-11de-a2d8-0026184c75bf}\Shell - "" = AutoRun
O33 - MountPoints2\{acbf97db-84bd-11de-a2d8-0026184c75bf}\Shell\AutoRun\command - "" = E:\setup.exe
O33 - MountPoints2\{ebdc6048-7891-11de-89c6-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ebdc6048-7891-11de-89c6-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe – [2009/09/28 14:48:12 | 000,153,448 | R— | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: wuauserv - C:\Windows\service.vbe ()

Drivers32:64bit: msacm.ac3filter - ac3filter64.acm ()
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.divxa32 - C:\Windows\SysWow64\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.divx - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.vp60 - C:\Windows\SysWow64\vp6vfw.dll (On2.com)
Drivers32: vidc.vp61 - C:\Windows\SysWow64\vp6vfw.dll (On2.com)
Drivers32: vidc.vp62 - C:\Windows\SysWow64\vp6vfw.dll (On2.com)
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/01 18:33:27 | 000,580,096 | —- | C] (OldTimer Tools) – C:\Users\Administrator\Desktop\OTL.exe
[2011/06/01 18:29:27 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Administrator\Desktop\HiJackThis.exe
[2011/06/01 01:19:58 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Parasol
[2011/06/01 01:17:35 | 000,000,000 | —D | C] – C:\Parasol
[2011/05/31 09:42:44 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Local\NPE
[2011/05/30 20:49:03 | 000,000,000 | —D | C] – C:\N360_BACKUP
[2011/05/30 16:46:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Symantec Shared
[2011/05/30 16:45:39 | 000,912,504 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\symefa64.sys
[2011/05/30 16:45:39 | 000,432,760 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\symtdiv.sys
[2011/05/30 16:45:39 | 000,382,584 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\symnets.sys
[2011/05/30 16:45:38 | 000,744,568 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtsp64.sys
[2011/05/30 16:45:38 | 000,450,680 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\symds64.sys
[2011/05/30 16:45:38 | 000,171,128 | R— | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\ironx64.sys
[2011/05/30 16:45:38 | 000,040,568 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\N360x64\0501000.01D\srtspx64.sys
[2011/05/30 16:45:27 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\N360x64\0501000.01D
[2011/05/30 15:16:51 | 000,034,152 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2011/05/30 15:16:48 | 000,174,200 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/05/30 15:16:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2011/05/30 15:16:48 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2011/05/30 15:14:58 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\N360x64
[2011/05/30 15:14:57 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite
[2011/05/30 15:14:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton Security Suite
[2011/05/30 15:14:52 | 000,000,000 | —D | C] – C:\Users\Administrator\Documents\Symantec
[2011/05/30 15:14:52 | 000,000,000 | —D | C] – C:\ProgramData\NortonInstaller
[2011/05/30 15:14:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\NortonInstaller
[2011/05/30 15:12:53 | 000,000,000 | —D | C] – C:\ProgramData\Norton
[2011/05/30 00:58:38 | 000,000,000 | —D | C] – C:\Users\Administrator\Documents\しゃんぐりらすまーと
[2011/05/30 00:54:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\しゃんぐりらすまーと
[2011/05/30 00:08:03 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Local\Babylon
[2011/05/30 00:06:50 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Roaming\Babylon
[2011/05/30 00:06:50 | 000,000,000 | —D | C] – C:\ProgramData\Babylon
[2011/05/30 00:01:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sex Game Devil
[2011/05/30 00:01:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Anal Masters
[2011/05/27 18:09:05 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/05/26 00:08:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
[2011/05/25 20:01:02 | 000,000,000 | —D | C] – C:\Windows\en
[2011/05/25 19:56:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2011/05/25 19:52:13 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2011/05/25 19:52:11 | 000,048,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\fssfltr.sys
[2011/05/25 19:52:11 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Live
[2011/05/25 19:51:50 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2011/05/25 19:50:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft
[2011/05/25 19:50:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSN Toolbar
[2011/05/25 19:50:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bing Bar Installer
[2011/05/25 19:44:46 | 001,103,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webservices.dll
[2011/05/25 19:44:46 | 000,754,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webservices.dll
[2011/05/25 07:33:47 | 001,653,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsPrint.dll
[2011/05/25 07:33:47 | 000,876,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsPrint.dll
[2011/05/25 00:38:12 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Local\Windows Live
[2011/05/25 00:25:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Portable Devices
[2011/05/25 00:25:51 | 000,000,000 | —D | C] – C:\Program Files\Windows Portable Devices
[2011/05/25 00:25:42 | 000,000,000 | —D | C] – C:\Windows\SysWow64\spool
[2011/05/25 00:23:09 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\BthMtpContextHandler.dll
[2011/05/25 00:23:09 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WPDShextAutoplay.exe
[2011/05/25 00:23:09 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WPDShextAutoplay.exe
[2011/05/25 00:23:07 | 002,727,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wpdshext.dll
[2011/05/25 00:23:07 | 002,537,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wpdshext.dll
[2011/05/25 00:23:07 | 000,573,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wpd_ci.dll
[2011/05/25 00:23:07 | 000,453,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PortableDeviceApi.dll
[2011/05/25 00:23:07 | 000,433,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WPDSp.dll
[2011/05/25 00:23:07 | 000,350,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WPDSp.dll
[2011/05/25 00:23:07 | 000,334,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PortableDeviceApi.dll
[2011/05/25 00:23:07 | 000,295,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WpdMtp.dll
[2011/05/25 00:23:07 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PortableDeviceWMDRM.dll
[2011/05/25 00:23:07 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PortableDeviceTypes.dll
[2011/05/25 00:23:07 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PortableDeviceWMDRM.dll
[2011/05/25 00:23:07 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PortableDeviceTypes.dll
[2011/05/25 00:23:07 | 000,113,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PortableDeviceClassExtension.dll
[2011/05/25 00:23:07 | 000,110,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WPDShServiceObj.dll
[2011/05/25 00:23:07 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PortableDeviceClassExtension.dll
[2011/05/25 00:23:07 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PortableDeviceConnectApi.dll
[2011/05/25 00:23:07 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WpdMtpUS.dll
[2011/05/25 00:23:07 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PortableDeviceConnectApi.dll
[2011/05/25 00:23:07 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\WpdUsb.sys
[2011/05/25 00:23:07 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WpdConns.dll
[2011/05/25 00:22:12 | 000,736,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIAutomationCore.dll
[2011/05/25 00:22:12 | 000,555,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIAutomationCore.dll
[2011/05/25 00:22:12 | 000,315,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\oleacc.dll
[2011/05/25 00:22:12 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\oleaccrc.dll
[2011/05/25 00:22:12 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\oleaccrc.dll
[2011/05/25 00:18:06 | 003,815,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIRibbon.dll
[2011/05/25 00:18:06 | 003,023,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIRibbon.dll
[2011/05/25 00:18:06 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIRibbonRes.dll
[2011/05/25 00:18:06 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIRibbonRes.dll
[2011/05/25 00:18:06 | 000,103,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UIAnimation.dll
[2011/05/25 00:18:06 | 000,092,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UIAnimation.dll
[2011/05/25 00:14:31 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2011/05/25 00:14:31 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msls31.dll
[2011/05/25 00:14:30 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2011/05/25 00:14:30 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2011/05/25 00:14:30 | 000,580,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2011/05/25 00:14:30 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2011/05/25 00:14:30 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2011/05/25 00:14:30 | 000,353,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxtmsft.dll
[2011/05/25 00:14:30 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2011/05/25 00:14:30 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxtrans.dll
[2011/05/25 00:14:30 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2011/05/25 00:14:30 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2011/05/25 00:14:30 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2011/05/25 00:14:30 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2011/05/25 00:14:30 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2011/05/25 00:14:30 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2011/05/25 00:14:30 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2011/05/25 00:14:30 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2011/05/25 00:14:30 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2011/05/25 00:14:30 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2011/05/25 00:14:30 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2011/05/25 00:14:30 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2011/05/25 00:14:30 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2011/05/25 00:14:30 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2011/05/25 00:14:30 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2011/05/25 00:14:29 | 002,303,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2011/05/25 00:14:29 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9.dll
[2011/05/25 00:14:29 | 000,818,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2011/05/25 00:14:29 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2011/05/25 00:14:29 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2011/05/25 00:14:29 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2011/05/25 00:14:29 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2011/05/25 00:14:29 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2011/05/25 00:14:29 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2011/05/25 00:14:29 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2011/05/25 00:14:29 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2011/05/25 00:14:29 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2011/05/25 00:14:29 | 000,145,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2011/05/25 00:14:29 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2011/05/25 00:14:29 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\advpack.dll
[2011/05/25 00:14:29 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2011/05/25 00:14:29 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2011/05/25 00:14:29 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2011/05/25 00:14:29 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2011/05/25 00:14:29 | 000,114,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\advpack.dll
[2011/05/25 00:14:29 | 000,114,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2011/05/25 00:14:29 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2011/05/25 00:14:29 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2011/05/25 00:14:29 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2011/05/25 00:14:29 | 000,091,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2011/05/25 00:14:29 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2011/05/25 00:14:29 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2011/05/25 00:14:29 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2011/05/25 00:14:29 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2011/05/25 00:14:29 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\imgutil.dll
[2011/05/25 00:14:29 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2011/05/25 00:14:29 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2011/05/25 00:14:29 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2011/05/25 00:14:28 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2011/05/25 00:14:28 | 001,492,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2011/05/25 00:14:28 | 000,697,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2011/05/25 00:14:28 | 000,603,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2011/05/25 00:14:28 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2011/05/25 00:14:28 | 000,452,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2011/05/25 00:14:28 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2011/05/25 00:14:28 | 000,282,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2011/05/25 00:14:28 | 000,236,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2011/05/25 00:14:28 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2011/05/25 00:14:28 | 000,165,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2011/05/25 00:14:28 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2011/05/25 00:14:28 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2011/05/25 00:14:28 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2011/05/25 00:14:28 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2011/05/25 00:14:28 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2011/05/25 00:14:28 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2011/05/25 00:14:28 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2011/05/25 00:14:28 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2011/05/25 00:14:28 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2011/05/25 00:14:28 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2011/05/25 00:14:28 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2011/05/25 00:13:17 | 003,548,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mf.dll
[2011/05/25 00:13:17 | 002,873,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mf.dll
[2011/05/25 00:13:17 | 001,257,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MFH264Dec.dll
[2011/05/25 00:13:17 | 001,204,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\shdocvw.dll
[2011/05/25 00:13:17 | 000,979,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFH264Dec.dll
[2011/05/25 00:13:17 | 000,748,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\stobject.dll
[2011/05/25 00:13:17 | 000,428,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MFHEAACdec.dll
[2011/05/25 00:13:17 | 000,377,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfmp4src.dll
[2011/05/25 00:13:17 | 000,357,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MFHEAACdec.dll
[2011/05/25 00:13:17 | 000,345,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfreadwrite.dll
[2011/05/25 00:13:17 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfmp4src.dll
[2011/05/25 00:13:17 | 000,278,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfplat.dll
[2011/05/25 00:13:17 | 000,261,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfreadwrite.dll
[2011/05/25 00:13:17 | 000,209,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfplat.dll
[2011/05/25 00:13:17 | 000,195,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfps.dll
[2011/05/25 00:13:17 | 000,098,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfps.dll
[2011/05/25 00:13:17 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfpmp.exe
[2011/05/25 00:13:15 | 002,002,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2011/05/25 00:13:15 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10warp.dll
[2011/05/25 00:13:15 | 000,834,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2011/05/25 00:13:15 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d2d1.dll
[2011/05/25 00:13:15 | 000,566,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2011/05/25 00:13:15 | 000,486,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10level9.dll
[2011/05/25 00:13:15 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsRasterService.dll
[2011/05/25 00:13:14 | 003,068,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xpsservices.dll
[2011/05/25 00:13:14 | 001,554,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xpsservices.dll
[2011/05/25 00:13:14 | 001,461,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\OpcServices.dll
[2011/05/25 00:13:14 | 001,268,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10.dll
[2011/05/25 00:13:14 | 001,032,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\printfilterpipelinesvc.exe
[2011/05/25 00:13:14 | 001,029,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10.dll
[2011/05/25 00:13:14 | 000,847,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\OpcServices.dll
[2011/05/25 00:13:14 | 000,625,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxgi.dll
[2011/05/25 00:13:14 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxgi.dll
[2011/05/25 00:13:14 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winspool.drv
[2011/05/25 00:13:14 | 000,327,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2011/05/25 00:13:14 | 000,287,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10core.dll
[2011/05/25 00:13:14 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1core.dll
[2011/05/25 00:13:14 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1.dll
[2011/05/25 00:13:14 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10core.dll
[2011/05/25 00:13:14 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1.dll
[2011/05/25 00:13:14 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsRasterService.dll
[2011/05/25 00:13:14 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdd.dll
[2011/05/25 00:13:14 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\printfilterpipelineprxy.dll
[2011/05/25 00:12:46 | 001,209,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecs.dll
[2011/05/25 00:12:46 | 000,792,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d11.dll
[2011/05/25 00:12:46 | 000,519,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d11.dll
[2011/05/25 00:12:46 | 000,449,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMPhoto.dll
[2011/05/25 00:12:46 | 000,411,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PhotoMetadataHandler.dll
[2011/05/25 00:12:46 | 000,369,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMPhoto.dll
[2011/05/25 00:12:46 | 000,328,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxdiag.exe
[2011/05/25 00:12:46 | 000,321,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PhotoMetadataHandler.dll
[2011/05/25 00:12:46 | 000,262,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxdiagn.dll
[2011/05/25 00:12:46 | 000,252,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxdiag.exe
[2011/05/25 00:12:46 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecsExt.dll
[2011/05/25 00:12:46 | 000,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxdiagn.dll
[2011/05/25 00:12:46 | 000,189,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WindowsCodecsExt.dll
[2011/05/25 00:09:08 | 000,479,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsGdiConverter.dll
[2011/05/25 00:09:08 | 000,288,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsGdiConverter.dll
[2011/05/25 00:09:07 | 001,555,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2011/05/25 00:09:07 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\DWrite.dll
[2011/05/25 00:09:03 | 000,316,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msshsq.dll
[2011/05/25 00:09:03 | 000,231,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msshsq.dll
[2011/05/24 23:29:38 | 000,000,000 | —D | C] – C:\Windows\SysWow64\vi-VN
[2011/05/24 23:29:38 | 000,000,000 | —D | C] – C:\Windows\SysNative\vi-VN
[2011/05/24 23:29:38 | 000,000,000 | —D | C] – C:\Windows\SysWow64\eu-ES
[2011/05/24 23:29:38 | 000,000,000 | —D | C] – C:\Windows\SysNative\eu-ES
[2011/05/24 23:29:38 | 000,000,000 | —D | C] – C:\Windows\SysWow64\ca-ES
[2011/05/24 23:29:38 | 000,000,000 | —D | C] – C:\Windows\SysNative\ca-ES
[2011/05/24 17:32:51 | 000,000,000 | —D | C] – C:\Windows\SysNative\EventProviders
[2011/05/23 23:20:47 | 000,000,000 | —D | C] – C:\Users\Administrator\Documents\Lass
[2011/05/23 23:20:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lass
[2011/05/23 23:17:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lass
[2011/05/23 01:13:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\May-Be SOFT
[2011/05/23 01:09:52 | 000,000,000 | —D | C] – C:\May-Be SOFT
[2011/05/23 00:15:26 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CureGirl
[2011/05/23 00:15:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CureGirl
[2011/05/23 00:11:55 | 000,000,000 | —D | C] – C:\Noesis
[2011/05/22 20:43:44 | 000,000,000 | —D | C] – C:\Windows\SysWow64\WindowsPowerShell
[2011/05/22 20:43:42 | 000,000,000 | —D | C] – C:\Windows\SysNative\WindowsPowerShell
[2011/05/22 20:04:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSXML 4.0
[2011/05/22 19:55:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Creative Labs Shared
[2011/05/22 19:52:32 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshhttp.dll
[2011/05/22 19:52:32 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshhttp.dll
[2011/05/22 19:52:31 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\httpapi.dll
[2011/05/22 19:52:31 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\httpapi.dll
[2011/05/22 19:46:06 | 001,942,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dfshim.dll
[2011/05/22 19:46:06 | 001,130,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dfshim.dll
[2011/05/22 19:46:06 | 000,320,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PresentationHost.exe
[2011/05/22 19:46:06 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PresentationHost.exe
[2011/05/22 19:46:06 | 000,109,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PresentationHostProxy.dll
[2011/05/22 19:46:06 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PresentationHostProxy.dll
[2011/05/22 19:46:06 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\netfxperf.dll
[2011/05/22 19:46:06 | 000,048,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netfxperf.dll
[2011/05/22 19:43:57 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrsmgr.dll
[2011/05/22 19:43:57 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winrsmgr.dll
[2011/05/22 19:43:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wsmplpxy.dll
[2011/05/22 19:43:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winrssrv.dll
[2011/05/22 19:43:53 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wsmplpxy.dll
[2011/05/22 19:43:53 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrssrv.dll
[2011/05/22 19:43:39 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pwrshplugin.dll
[2011/05/22 19:43:39 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pwrshplugin.dll
[2011/05/22 19:43:39 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winrshost.exe
[2011/05/22 19:43:39 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wsmprovhost.exe
[2011/05/22 19:43:38 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winrs.exe
[2011/05/22 19:43:35 | 000,113,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wevtfwd.dll
[2011/05/22 19:43:35 | 000,113,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wecutil.exe
[2011/05/22 19:43:35 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wecapi.dll
[2011/05/22 19:43:35 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wevtfwd.dll
[2011/05/22 19:43:35 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wecutil.exe
[2011/05/22 19:43:35 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wecapi.dll
[2011/05/22 19:43:35 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WsmRes.dll
[2011/05/22 19:43:35 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WsmRes.dll
[2011/05/22 19:43:35 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrs.exe
[2011/05/22 19:43:35 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrshost.exe
[2011/05/22 19:43:35 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wsmprovhost.exe
[2011/05/22 19:43:30 | 000,370,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winrscmd.dll
[2011/05/22 19:43:30 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSManMigrationPlugin.dll
[2011/05/22 19:43:30 | 000,348,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WSManHTTPConfig.exe
[2011/05/22 19:43:30 | 000,310,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WsmWmiPl.dll
[2011/05/22 19:43:30 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSManMigrationPlugin.dll
[2011/05/22 19:43:30 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSManHTTPConfig.exe
[2011/05/22 19:43:30 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrscmd.dll
[2011/05/22 19:43:30 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WsmWmiPl.dll
[2011/05/22 19:43:30 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WsmAuto.dll
[2011/05/22 19:43:30 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WsmAuto.dll
[2011/05/22 19:38:29 | 000,000,000 | —D | C] – C:\ProgramData\NVIDIA Corporation
[2011/05/22 19:38:02 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2011/05/22 19:34:01 | 000,600,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate_isv.exe
[2011/05/22 19:34:01 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate.exe
[2011/05/22 19:34:00 | 000,539,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc.dll
[2011/05/22 19:34:00 | 000,538,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc_isv.dll
[2011/05/22 19:34:00 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate_isv.exe
[2011/05/22 19:34:00 | 000,518,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate.exe
[2011/05/22 19:34:00 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc_isv.dll
[2011/05/22 19:34:00 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc.dll
[2011/05/22 19:33:59 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate_ssp_isv.exe
[2011/05/22 19:33:59 | 000,409,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RMActivate_ssp.exe
[2011/05/22 19:33:59 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate_ssp.exe
[2011/05/22 19:33:59 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RMActivate_ssp_isv.exe
[2011/05/22 19:33:58 | 000,460,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msdrm.dll
[2011/05/22 19:33:58 | 000,332,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msdrm.dll
[2011/05/22 19:33:58 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc_ssp_isv.dll
[2011/05/22 19:33:58 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secproc_ssp.dll
[2011/05/22 19:33:58 | 000,152,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc_ssp_isv.dll
[2011/05/22 19:33:58 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\secproc_ssp.dll
[2011/05/22 19:33:53 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc40.dll
[2011/05/22 19:33:53 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc40u.dll
[2011/05/22 19:33:48 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\shlwapi.dll
[2011/05/22 19:33:33 | 004,699,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2011/05/22 19:33:32 | 001,585,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll
[2011/05/22 19:33:18 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\netevent.dll
[2011/05/22 19:33:18 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netevent.dll
[2011/05/22 19:33:18 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sscore.dll
[2011/05/22 19:33:18 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sscore.dll
[2011/05/22 19:33:14 | 001,927,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gameux.dll
[2011/05/22 19:33:13 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2011/05/22 19:33:13 | 001,696,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\gameux.dll
[2011/05/22 19:33:13 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Apphlpdm.dll
[2011/05/22 19:33:13 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Apphlpdm.dll
[2011/05/22 19:33:12 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2011/05/22 19:33:09 | 000,280,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rastls.dll
[2011/05/22 19:33:09 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rastls.dll
[2011/05/22 19:32:59 | 013,426,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmp.dll
[2011/05/22 19:32:57 | 010,627,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmp.dll
[2011/05/22 19:32:52 | 008,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmploc.DLL
[2011/05/22 19:32:52 | 008,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmploc.DLL
[2011/05/22 19:32:37 | 001,570,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\quartz.dll
[2011/05/22 19:32:37 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\quartz.dll
[2011/05/22 19:32:36 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvfw32.dll
[2011/05/22 19:32:36 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\avifil32.dll
[2011/05/22 19:32:36 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mciavi32.dll
[2011/05/22 19:32:30 | 000,466,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\odbc32.dll
[2011/05/22 19:32:29 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbc32.dll
[2011/05/22 19:32:27 | 000,621,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usp10.dll
[2011/05/22 19:32:14 | 000,220,672 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\SysWow64\l3codecp.acm
[2011/05/22 19:32:14 | 000,181,760 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\SysNative\l3codecp.acm
[2011/05/22 19:32:14 | 000,072,192 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\SysNative\l3codeca.acm
[2011/05/22 19:32:14 | 000,062,464 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\SysWow64\l3codeca.acm
[2011/05/22 19:32:04 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\t2embed.dll
[2011/05/22 19:32:04 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\t2embed.dll
[2011/05/22 19:32:03 | 000,081,920 | —- | C] (Radius Inc.) – C:\Windows\SysWow64\iccvid.dll
[2011/05/22 19:32:01 | 000,633,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\comctl32.dll
[2011/05/22 19:31:55 | 000,317,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MP4SDECD.DLL
[2011/05/22 19:31:55 | 000,295,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MP4SDECD.DLL
[2011/05/22 19:31:39 | 001,915,904 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ole32.dll
[2011/05/22 19:31:37 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rtutils.dll
[2011/05/22 19:31:37 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rtutils.dll
[2011/05/22 19:31:35 | 000,655,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskschd.dll
[2011/05/22 19:31:35 | 000,500,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmicmiplugin.dll
[2011/05/22 19:31:35 | 000,410,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskcomp.dll
[2011/05/22 19:31:35 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskschd.dll
[2011/05/22 19:31:35 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2011/05/22 19:31:34 | 000,270,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskcomp.dll
[2011/05/22 19:31:30 | 000,367,616 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2011/05/22 19:31:30 | 000,292,864 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2011/05/22 19:31:30 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\fontsub.dll
[2011/05/22 19:31:30 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\fontsub.dll
[2011/05/22 19:31:30 | 000,048,128 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2011/05/22 19:31:30 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2011/05/22 19:31:28 | 001,076,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winload.efi
[2011/05/22 19:31:28 | 001,063,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winload.exe
[2011/05/22 19:31:28 | 000,991,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winresume.efi
[2011/05/22 19:31:28 | 000,979,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winresume.exe
[2011/05/22 19:31:28 | 000,020,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kdusb.dll
[2011/05/22 19:31:28 | 000,018,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kd1394.dll
[2011/05/22 19:31:28 | 000,017,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kdcom.dll
[2011/05/22 19:31:22 | 002,425,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2011/05/22 19:31:21 | 002,067,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2011/05/22 19:31:21 | 000,731,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2011/05/22 19:31:21 | 000,677,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2011/05/22 19:31:21 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tscupgrd.exe
[2011/05/22 19:31:21 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tscupgrd.exe
[2011/05/22 19:31:19 | 000,880,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\timedate.cpl
[2011/05/22 19:31:18 | 000,714,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl
[2011/05/22 19:31:18 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2011/05/22 19:31:16 | 001,251,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sdclt.exe
[2011/05/22 19:30:54 | 000,221,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dnsapi.dll
[2011/05/22 19:30:54 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dnscacheugc.exe
[2011/05/22 19:30:54 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dnscacheugc.exe
[2011/05/22 19:30:52 | 001,090,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmpmde.dll
[2011/05/22 19:30:51 | 000,867,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wmpmde.dll
[2011/05/22 19:30:49 | 000,559,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\EncDec.dll
[2011/05/22 19:30:49 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\EncDec.dll
[2011/05/22 19:30:49 | 000,416,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sbe.dll
[2011/05/22 19:30:49 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sbe.dll
[2011/05/22 19:30:49 | 000,226,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mpg2splt.ax
[2011/05/22 19:30:49 | 000,210,944 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sbeio.dll
[2011/05/22 19:30:49 | 000,177,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mpg2splt.ax
[2011/05/22 19:30:49 | 000,153,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sbeio.dll
[2011/05/22 19:30:45 | 001,398,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfc42.dll
[2011/05/22 19:30:45 | 001,360,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfc42u.dll
[2011/05/22 19:30:45 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc42u.dll
[2011/05/22 19:30:45 | 001,136,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc42.dll
[2011/05/22 19:30:44 | 000,104,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cabview.dll
[2011/05/22 19:30:44 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cabview.dll
[2011/05/22 19:20:10 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wintrust.dll
[2011/05/22 19:20:10 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wintrust.dll
[2011/05/22 18:41:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\YouTube Downloader Toolbar
[2011/05/22 18:40:29 | 002,621,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2011/05/22 18:40:29 | 000,057,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2011/05/22 18:40:29 | 000,043,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2011/05/22 18:33:22 | 000,700,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2011/05/22 18:33:22 | 000,575,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuapi.dll
[2011/05/22 18:33:22 | 000,098,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2011/05/22 18:33:22 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wudriver.dll
[2011/05/22 18:33:22 | 000,038,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2011/05/22 18:33:22 | 000,035,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wups.dll
[2011/05/22 18:32:56 | 000,185,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2011/05/22 18:32:56 | 000,171,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuwebv.dll
[2011/05/22 18:32:56 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2011/05/22 18:32:56 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuapp.exe
[2011/05/22 18:21:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Windows Live
[2011/05/19 00:24:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dealio Toolbar
[2011/05/09 00:56:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\ICHAZURA
[2011/05/09 00:43:30 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overflow
[2011/05/09 00:43:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Overflow
[2011/05/09 00:25:09 | 000,000,000 | —D | C] – C:\Overflow
[2011/05/08 17:00:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Purple software delight
[2011/05/08 16:58:55 | 000,000,000 | —D | C] – C:\Purple software delight
[2011/05/04 21:31:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\サマー☆きゃんぷ
[3 C:\Users\Administrator\AppData\Local\*.tmp files -> C:\Users\Administrator\AppData\Local\*.tmp -> ]
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/10/19 22:05:41 | 000,727,450 | R— | M] () – C:\アニヲタの幼稚で気持ち悪い行動について.html
[2011/10/19 22:05:41 | 000,727,450 | R— | M] () – C:\Windows\アニヲタの幼稚で気持ち悪い行動について.html
[2011/10/19 22:05:41 | 000,727,450 | R— | M] () – C:\Windows\SysNative\アニヲタの幼稚で気持ち悪い行動について.html
[2011/10/08 09:46:40 | 000,005,931 | R— | M] () – C:\Windows\SysNative\pedo.vbe
[2011/10/08 09:46:40 | 000,005,931 | R— | M] () – C:\Windows\pedo.vbe
[2011/10/08 09:46:40 | 000,005,931 | R— | M] () – C:\Users\Administrator\pedo.vbe
[2011/10/08 09:46:40 | 000,005,931 | R— | M] () – C:\ProgramData\pedo.vbe
[2011/10/08 09:46:40 | 000,005,931 | R— | M] () – C:\pedo.vbe
[2011/08/15 00:30:52 | 000,130,722 | R— | M] () – C:\Windows\SysNative\_殺人犯__ペド__キモヲタ_ 山口芳寛 容疑者(２０) 『少女の裸などを描いたポルノ漫画に興味』.jpg
[2011/08/15 00:30:52 | 000,130,722 | R— | M] () – C:\Windows\_殺人犯__ペド__キモヲタ_ 山口芳寛 容疑者(２０) 『少女の裸などを描いたポルノ漫画に興味』.jpg
[2011/06/02 07:41:09 | 000,707,456 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/06/02 07:41:09 | 000,598,702 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/06/02 07:41:09 | 000,104,716 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/06/02 07:17:46 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/02 00:15:47 | 000,002,000 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/02 00:15:47 | 000,002,000 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/01 19:41:15 | 000,000,903 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2011/06/01 18:33:28 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Users\Administrator\Desktop\OTL.exe
[2011/06/01 18:29:54 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Administrator\Desktop\HiJackThis.exe
[2011/06/01 18:22:58 | 000,000,004 | —- | M] () – C:\Users\Administrator\tray.pid
[2011/06/01 18:14:08 | 000,000,570 | —- | M] () – C:\Users\Administrator\AppData\Roaming\SMRResults162.dat
[2011/06/01 01:24:35 | 000,000,676 | —- | M] () – C:\Users\Administrator\Desktop\でりばらっ！-deliverance of strays-.lnk
[2011/05/31 22:53:51 | 000,195,584 | —- | M] () – C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/31 21:49:18 | 000,001,418 | —- | M] () – C:\Users\Administrator\Desktop\My DAP Downloads.lnk
[2011/05/31 10:05:44 | 000,000,000 | R— | M] () – C:\女児を襲うだけでなく、みんなで空想の女児の絵を描いて見せ合う会まで_(55587).folder
[2011/05/31 10:00:00 | 000,012,151 | R— | M] () – C:\Users\Administrator\setup.vbe
[2011/05/31 10:00:00 | 000,012,151 | R— | M] () – C:\ProgramData\setup.vbe
[2011/05/30 22:17:26 | 836,703,341 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/05/30 21:57:48 | 000,002,327 | —- | M] () – C:\Users\Public\Desktop\Norton Security Suite.lnk
[2011/05/30 21:54:14 | 002,551,606 | —- | M] () – C:\Windows\SysNative\drivers\N360x64\0501000.01D\Cat.DB
[2011/05/30 16:45:40 | 000,174,200 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2011/05/30 16:45:40 | 000,007,488 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2011/05/30 16:45:40 | 000,000,855 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2011/05/30 15:12:54 | 000,000,903 | —- | M] () – C:\Users\Administrator\Desktop\Norton Installation Files.lnk
[2011/05/30 13:45:37 | 000,000,000 | R— | M] () – C:\Windows\SysNative\Pedophilia_is_a_terrorist_group_82029.inf
[2011/05/30 12:11:37 | 000,008,484 | —- | M] () – C:\Users\Administrator\AppData\Local\d3d9caps.dat
[2011/05/30 10:07:55 | 000,000,000 | R— | M] () – C:\boot.ini　　　　　　　　　　　　　　　　　　　　　　　　　　1035.vbe
[2011/05/30 02:49:17 | 000,001,460 | —- | M] () – C:\Users\Administrator\AppData\Local\d3d9caps64.dat
[2011/05/30 02:42:34 | 000,000,000 | R— | M] () – C:\女児を襲うだけでなく、みんなで空想の女児の絵を描いて見せ合う会まで(_10384_).folder
[2011/05/27 18:09:06 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/05/26 00:15:57 | 000,386,440 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2011/05/25 00:25:34 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2011/05/25 00:25:09 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011/05/25 00:14:39 | 000,008,798 | —- | M] () – C:\Windows\SysWow64\icrav03.rat
[2011/05/25 00:14:39 | 000,008,798 | —- | M] () – C:\Windows\SysNative\icrav03.rat
[2011/05/25 00:14:39 | 000,001,988 | —- | M] () – C:\Windows\SysWow64\ticrf.rat
[2011/05/25 00:14:39 | 000,001,988 | —- | M] () – C:\Windows\SysNative\ticrf.rat
[2011/05/25 00:14:31 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2011/05/25 00:14:31 | 000,161,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msls31.dll
[2011/05/25 00:14:30 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2011/05/25 00:14:30 | 001,427,456 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2011/05/25 00:14:30 | 000,580,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2011/05/25 00:14:30 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2011/05/25 00:14:30 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2011/05/25 00:14:30 | 000,353,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\dxtmsft.dll
[2011/05/25 00:14:30 | 000,231,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2011/05/25 00:14:30 | 000,223,232 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\dxtrans.dll
[2011/05/25 00:14:30 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2011/05/25 00:14:30 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2011/05/25 00:14:30 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2011/05/25 00:14:30 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2011/05/25 00:14:30 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2011/05/25 00:14:30 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2011/05/25 00:14:30 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2011/05/25 00:14:30 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2011/05/25 00:14:30 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2011/05/25 00:14:30 | 000,072,822 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2011/05/25 00:14:30 | 000,072,704 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2011/05/25 00:14:30 | 000,066,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2011/05/25 00:14:30 | 000,063,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2011/05/25 00:14:30 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2011/05/25 00:14:30 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2011/05/25 00:14:30 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2011/05/25 00:14:29 | 002,303,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2011/05/25 00:14:29 | 001,797,632 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9.dll
[2011/05/25 00:14:29 | 000,818,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2011/05/25 00:14:29 | 000,716,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2011/05/25 00:14:29 | 000,267,776 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2011/05/25 00:14:29 | 000,248,320 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2011/05/25 00:14:29 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2011/05/25 00:14:29 | 000,222,208 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2011/05/25 00:14:29 | 000,197,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2011/05/25 00:14:29 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2011/05/25 00:14:29 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2011/05/25 00:14:29 | 000,160,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2011/05/25 00:14:29 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2011/05/25 00:14:29 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2011/05/25 00:14:29 | 000,136,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\advpack.dll
[2011/05/25 00:14:29 | 000,135,168 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2011/05/25 00:14:29 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2011/05/25 00:14:29 | 000,123,392 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2011/05/25 00:14:29 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2011/05/25 00:14:29 | 000,114,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\advpack.dll
[2011/05/25 00:14:29 | 000,114,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2011/05/25 00:14:29 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2011/05/25 00:14:29 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2011/05/25 00:14:29 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2011/05/25 00:14:29 | 000,091,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2011/05/25 00:14:29 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2011/05/25 00:14:29 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2011/05/25 00:14:29 | 000,049,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2011/05/25 00:14:29 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2011/05/25 00:14:29 | 000,035,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\imgutil.dll
[2011/05/25 00:14:29 | 000,012,288 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2011/05/25 00:14:29 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2011/05/25 00:14:29 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2011/05/25 00:14:28 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2011/05/25 00:14:28 | 001,492,992 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2011/05/25 00:14:28 | 000,697,344 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2011/05/25 00:14:28 | 000,603,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2011/05/25 00:14:28 | 000,534,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2011/05/25 00:14:28 | 000,452,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2011/05/25 00:14:28 | 000,448,512 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2011/05/25 00:14:28 | 000,282,112 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2011/05/25 00:14:28 | 000,236,544 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2011/05/25 00:14:28 | 000,173,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2011/05/25 00:14:28 | 000,165,888 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2011/05/25 00:14:28 | 000,160,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2011/05/25 00:14:28 | 000,149,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2011/05/25 00:14:28 | 000,103,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2011/05/25 00:14:28 | 000,096,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2011/05/25 00:14:28 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2011/05/25 00:14:28 | 000,085,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2011/05/25 00:14:28 | 000,082,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2011/05/25 00:14:28 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2011/05/25 00:14:28 | 000,072,822 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2011/05/25 00:14:28 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2011/05/25 00:14:28 | 000,039,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2011/05/25 00:14:28 | 000,030,720 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2011/05/25 00:13:17 | 003,548,672 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mf.dll
[2011/05/25 00:13:17 | 002,873,344 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mf.dll
[2011/05/25 00:13:17 | 001,257,984 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MFH264Dec.dll
[2011/05/25 00:13:17 | 001,204,224 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\shdocvw.dll
[2011/05/25 00:13:17 | 000,979,456 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\MFH264Dec.dll
[2011/05/25 00:13:17 | 000,748,544 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\stobject.dll
[2011/05/25 00:13:17 | 000,428,544 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MFHEAACdec.dll
[2011/05/25 00:13:17 | 000,377,344 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mfmp4src.dll
[2011/05/25 00:13:17 | 000,357,376 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\MFHEAACdec.dll
[2011/05/25 00:13:17 | 000,345,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mfreadwrite.dll
[2011/05/25 00:13:17 | 000,302,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mfmp4src.dll
[2011/05/25 00:13:17 | 000,278,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mfplat.dll
[2011/05/25 00:13:17 | 000,261,632 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mfreadwrite.dll
[2011/05/25 00:13:17 | 000,209,920 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mfplat.dll
[2011/05/25 00:13:17 | 000,195,072 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mfps.dll
[2011/05/25 00:13:17 | 000,098,816 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mfps.dll
[2011/05/25 00:13:17 | 000,034,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mfpmp.exe
[2011/05/25 00:13:15 | 002,002,944 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2011/05/25 00:13:15 | 001,172,480 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10warp.dll
[2011/05/25 00:13:15 | 000,834,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2011/05/25 00:13:15 | 000,683,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d2d1.dll
[2011/05/25 00:13:15 | 000,566,272 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2011/05/25 00:13:15 | 000,486,400 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10level9.dll
[2011/05/25 00:13:15 | 000,231,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\XpsRasterService.dll
[2011/05/25 00:13:14 | 003,068,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\xpsservices.dll
[2011/05/25 00:13:14 | 001,554,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\xpsservices.dll
[2011/05/25 00:13:14 | 001,461,760 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\OpcServices.dll
[2011/05/25 00:13:14 | 001,268,224 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10.dll
[2011/05/25 00:13:14 | 001,032,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\printfilterpipelinesvc.exe
[2011/05/25 00:13:14 | 001,029,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10.dll
[2011/05/25 00:13:14 | 000,847,360 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\OpcServices.dll
[2011/05/25 00:13:14 | 000,625,152 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxgi.dll
[2011/05/25 00:13:14 | 000,478,720 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\dxgi.dll
[2011/05/25 00:13:14 | 000,366,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\winspool.drv
[2011/05/25 00:13:14 | 000,327,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2011/05/25 00:13:14 | 000,287,232 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10core.dll
[2011/05/25 00:13:14 | 000,219,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1core.dll
[2011/05/25 00:13:14 | 000,196,096 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1.dll
[2011/05/25 00:13:14 | 000,189,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10core.dll
[2011/05/25 00:13:14 | 000,160,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1.dll
[2011/05/25 00:13:14 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\XpsRasterService.dll
[2011/05/25 00:13:14 | 000,047,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\cdd.dll
[2011/05/25 00:13:14 | 000,035,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\printfilterpipelineprxy.dll
[2011/05/25 00:12:48 | 000,003,584 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\drivers\en-US\dxgkrnl.sys.mui
[2011/05/25 00:12:46 | 001,209,856 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecs.dll
[2011/05/25 00:12:46 | 000,792,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\d3d11.dll
[2011/05/25 00:12:46 | 000,519,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\d3d11.dll
[2011/05/25 00:12:46 | 000,449,024 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WMPhoto.dll
[2011/05/25 00:12:46 | 000,411,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\PhotoMetadataHandler.dll
[2011/05/25 00:12:46 | 000,369,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\WMPhoto.dll
[2011/05/25 00:12:46 | 000,328,192 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxdiag.exe
[2011/05/25 00:12:46 | 000,321,024 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\PhotoMetadataHandler.dll
[2011/05/25 00:12:46 | 000,262,656 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxdiagn.dll
[2011/05/25 00:12:46 | 000,252,928 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\dxdiag.exe
[2011/05/25 00:12:46 | 000,245,248 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WindowsCodecsExt.dll
[2011/05/25 00:12:46 | 000,195,584 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\dxdiagn.dll
[2011/05/25 00:12:46 | 000,189,440 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\WindowsCodecsExt.dll
[2011/05/24 23:28:17 | 000,000,159 | RH– | M] () – C:\Windows\ctfile.rfc
[2011/05/23 23:20:25 | 000,001,989 | —- | M] () – C:\Users\Public\Desktop\11eyes -Resona Forma-.lnk
[2011/05/23 01:13:50 | 000,000,732 | —- | M] () – C:\Users\Public\Desktop\へんし～ん!!! ～パンツになってクンクンペロペロ～.lnk
[2011/05/15 05:55:16 | 000,194,305 | R— | M] () – C:\Windows\キモヲタを表現してみました.jpg
[2011/05/15 05:55:16 | 000,194,305 | R— | M] () – C:\Windows\SysNative\キモヲタを表現してみました.jpg
[2011/05/15 02:51:38 | 000,101,106 | R— | M] () – C:\Windows\SysNative\【キモヲタそっくり】 「うるせぇ、クソババア！」 ＤＱＮ小学生、規範意識の低下、コミュニケーション能力の不足、子供甘やかした結果.jpg
[2011/05/15 02:51:38 | 000,101,106 | R— | M] () – C:\Windows\【キモヲタそっくり】 「うるせぇ、クソババア！」 ＤＱＮ小学生、規範意識の低下、コミュニケーション能力の不足、子供甘やかした結果.jpg
[2011/05/12 22:06:22 | 000,012,857 | R— | M] () – C:\女児のパンチラ画像.vbe
[2011/05/12 22:06:22 | 000,012,857 | R— | M] () – C:\Windows\女児のパンチラ画像.vbe
[2011/05/12 22:06:22 | 000,012,857 | R— | M] () – C:\Windows\SysNative\女児のパンチラ画像.vbe
[2011/05/11 05:15:02 | 000,727,450 | R— | M] () – C:\キモヲタの言うアニメってなに？ [性的嗜好] 工作員に洗脳された アニヲタの幼稚で気持ち悪い行動について.html
[2011/05/11 05:15:02 | 000,727,450 | R— | M] () – C:\Windows\キモヲタの言うアニメってなに？ [性的嗜好] 工作員に洗脳された アニヲタの幼稚で気持ち悪い行動について.html
[2011/05/11 05:15:02 | 000,727,450 | R— | M] () – C:\Windows\SysNative\キモヲタの言うアニメってなに？ [性的嗜好] 工作員に洗脳された アニヲタの幼稚で気持ち悪い行動について.html
[2011/05/11 00:43:53 | 000,002,617 | —- | M] () – C:\Users\Administrator\Desktop\あかときっ！ －夢こそまされ恋の魔砲－.lnk
[2011/05/10 18:21:05 | 000,000,172 | —- | M] () – C:\Windows\SysNative\drivers\N360x64\0501000.01D\isolate.ini
[2011/05/10 13:57:50 | 000,164,803 | R— | M] () – C:\Windows\SysNative\[殺人犯][ペド][キモヲタ] 山口芳寛 容疑者(２０) 腐りまくったキモヲタ同人誌によって引き起こされた卑劣犯罪.jpg
[2011/05/10 13:57:50 | 000,164,803 | R— | M] () – C:\Windows\[殺人犯][ペド][キモヲタ] 山口芳寛 容疑者(２０) 腐りまくったキモヲタ同人誌によって引き起こされた卑劣犯罪.jpg
[2011/05/08 17:00:58 | 000,000,850 | —- | M] () – C:\Users\Public\Desktop\Primary Step.LNK
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\Windows\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\Windows\SysNative\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\Windows\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\Windows\SysNative\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\Windows\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe
[2011/05/08 11:16:50 | 000,005,341 | R— | M] () – C:\Windows\SysNative\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\SysNative\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\SysNative\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\SysNative\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\SysNative\【明らかに有害図書の影響】【キモヲタ犯罪】 有害な社会環境を作り出すキモヲタ 屁理屈　我がまま　幼稚なヲタク.jpg .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\Windows\【明らかに有害図書の影響】【キモヲタ犯罪】 有害な社会環境を作り出すキモヲタ 屁理屈　我がまま　幼稚なヲタク.jpg .vbe
[2011/05/08 11:16:34 | 000,005,124 | R— | M] () – C:\【明らかに有害図書の影響】【キモヲタ犯罪】 有害な社会環境を作り出すキモヲタ 屁理屈　我がまま　幼稚なヲタク.jpg .vbe
[2011/05/07 21:36:48 | 000,000,870 | —- | M] () – C:\Users\Administrator\Desktop\サマー☆きゃんぷ - Shortcut.lnk
[3 C:\Users\Administrator\AppData\Local\*.tmp files -> C:\Users\Administrator\AppData\Local\*.tmp -> ]
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
Post #6
Your computer is an absolute mess. I do not know if we will ever get it clean. Downloading shared files (torrents) and porn are guaranteed ways to mess up your computer.

Let's see what we can do.

Double click on OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Processes

:OTL
PRC - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
SRV - (Application Updater) – C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {6E19037A-12E3-4295-8915-ED48BC341614}:1.3.328.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - HKLM\software\mozilla\Firefox\Extensions\\{6E19037A-12E3-4295-8915-ED48BC341614}: C:\Program Files (x86)\RelevantKnowledge [2011/05/30 17:37:06 | 000,000,000 | —D | M]
[2011/05/19 00:24:09 | 000,000,000 | —D | M] (Dealio Toolbar) – C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF
[2011/05/30 17:37:06 | 000,000,000 | —D | M] (RelevantKnowledge) – C:\PROGRAM FILES (X86)\RELEVANTKNOWLEDGE
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
[2011/05/19 00:24:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dealio Toolbar
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL log.

Then please see if you can do this:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Post #7
Here is the OTL log: All processes killed ========== PROCESSES ========== ========== OTL ========== No active process named Program Files was found! Service Application Updater stopped successfully! Service Application Updater deleted successfully! C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe moved successfully. Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems Prefs.js: {6E19037A-12E3-4295-8915-ED48BC341614}:1.3.328.4 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6E19037A-12E3-4295-8915-ED48BC341614} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6E19037A-12E3-4295-8915-ED48BC341614}\ not found. C:\Program Files (x86)\RelevantKnowledge\components folder moved successfully. C:\Program Files (x86)\RelevantKnowledge folder moved successfully. C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF\chrome\skin folder moved successfully. C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF\chrome\locale\EN-US folder moved successfully. C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF\chrome\locale folder moved successfully. C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF\chrome\content folder moved successfully. C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF\chrome folder moved successfully. C:\PROGRAM FILES (X86)\DEALIO TOOLBAR\FF folder moved successfully. Folder C:\PROGRAM FILES (X86)\RELEVANTKNOWLEDGE\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully. C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll moved successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully. C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully. C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ not found. File C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.4\youtubedownloaderToolbarIE.dll not found. 64bit-Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. File C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. File C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully. C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe moved successfully. C:\Program Files (x86)\Dealio Toolbar\Res folder moved successfully. C:\Program Files (x86)\Dealio Toolbar\IE\4.4 folder moved successfully. C:\Program Files (x86)\Dealio Toolbar\IE folder moved successfully. C:\Program Files (x86)\Dealio Toolbar folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 2479970 bytes ->Temporary Internet Files folder emptied: 26431974 bytes ->Java cache emptied: 52807387 bytes ->FireFox cache emptied: 56316645 bytes ->Flash cache emptied: 285539 bytes User: All Users User: AppData User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 41044 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 1564672 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 86591 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 52663 bytes RecycleBin emptied: 408616 bytes Total Files Cleaned = 134.00 mb OTL by OldTimer - Version 3.2.23.0 log created on 06042011_113925 Files\Folders moved on Reboot… C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AU2ZTUMJ\addons-tracker-v4[1].htm moved successfully. Registry entries deleted on Reboot…
Post #9
Here is the Malwarebytes log: Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6772 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 6/5/2011 2:05:32 AM mbam-log-2011-06-05 (02-05-32).txt Scan type: Quick scan Objects scanned: 509999 Time elapsed: 31 minute(s), 37 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 7 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 4 Files Infected: 10 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: c:\program files (x86)\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\GamevanceText.Linker.1 (Adware.GameVance) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\GamevanceText.Linker (Adware.GameVance) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\GamevanceText.DLL (Adware.GameVance) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\AppDataLow\gvtl (Adware.GameVance) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\WTXPCOM\COMPONENTS\WIDGITOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: WIDGITOOLBARFF.DLL -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: c:\programdata\microsoft\Windows\start menu\Programs\relevantknowledge (Spyware.MarketScore) -> Quarantined and deleted successfully. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed] (Adware.GamesVance) -> Delete on reboot. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome (Adware.GamesVance) -> Quarantined and deleted successfully. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components (Adware.GamesVance) -> Quarantined and deleted successfully. Files Infected: c:\program files (x86)\common files\Spigot\wtxpcom\components\widgitoolbarff.dll (Adware.WidgiToolbar) -> Quarantined and deleted successfully. c:\Windows\index.html (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\programdata\microsoft\Windows\start menu\Programs\relevantknowledge\about relevantknowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. c:\programdata\microsoft\Windows\start menu\Programs\relevantknowledge\privacy policy and user license agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. c:\programdata\microsoft\Windows\start menu\Programs\relevantknowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. c:\programdata\microsoft\Windows\start menu\Programs\relevantknowledge\uninstall instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome.manifest (Adware.GamesVance) -> Quarantined and deleted successfully. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\install.rdf (Adware.GamesVance) -> Quarantined and deleted successfully. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\gvtextlinks.jar (Adware.GamesVance) -> Quarantined and deleted successfully. c:\Users\administrator\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\gvtlf.xpt (Adware.GamesVance) -> Quarantined and deleted successfully.
Post #10
ryoga99,

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #11
Here is the ComboFix log: ComboFix 11-06-05.02 - Administrator 5/2011 Sun 12:52:31.1.8 - x64 Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Downloaded Installers c:\program files (x86)\Downloaded Installers\{B77844E9-6AB1-4395-8E80-C2D16BD0EFD8}\setup.msi c:\program files (x86)\Mozilla Firefox\extensions\[removed] c:\program files (x86)\Search Settings c:\programdata\【明らかに有害図書の影響】【キモヲタ犯罪】 腐ったアニメ・コミックで日本を汚すのが目的　工作員の為の同人活動 .txt　　 .vbe c:\programdata\alsignup_vista.exe c:\programdata\恋愛対象として 小学生の女の子が好き　山口芳寛　容疑者(20)　有害図書で頭がおかしくなった証拠.txt 　　　　　　　　 　　　　 .vbe C:\text.txt c:\users\Administrator\【明らかに有害図書の影響】【キモヲタ犯罪】 腐ったアニメ・コミックで日本を汚すのが目的　工作員の為の同人活動 .txt　　 .vbe c:\users\Administrator\AppData\Roaming\BDL+D c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\36024\____.hld c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\36024\____.sys c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\38369\____.hld c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\38369\____.sys c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\38371\____.hld c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\38371\____.sys c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\39482\____.hld c:\users\Administrator\AppData\Roaming\BDL+D\GYUT.TO\39482\____.sys c:\users\Administrator\恋愛対象として 小学生の女の子が好き　山口芳寛　容疑者(20)　有害図書で頭がおかしくなった証拠.txt 　　　　　　　　 　　　　 .vbe c:\users\Default\【明らかに有害図書の影響】【キモヲタ犯罪】 腐ったアニメ・コミックで日本を汚すのが目的　工作員の為の同人活動 .txt　　 .vbe c:\users\Default\恋愛対象として 小学生の女の子が好き　山口芳寛　容疑者(20)　有害図書で頭がおかしくなった証拠.txt 　　　　　　　　 　　　　 .vbe c:\windows\01.jpg c:\windows\02.jpg c:\windows\03.jpg c:\windows\04.jpg c:\windows\05.jpg c:\windows\06.jpg c:\windows\07.jpg c:\windows\08.jpg c:\windows\09.jpg c:\windows\11.jpg c:\windows\12.jpg c:\windows\13.jpg c:\windows\14.jpg c:\windows\15.jpg c:\windows\16.jpg c:\windows\17.jpg c:\windows\system32\1.jpg c:\windows\system32\AutoRun.inf c:\windows\system32\boot.vbs c:\windows\system32\help.html c:\windows\system32\index.html c:\windows\SysWow64\Data c:\windows\SysWow64\drivers\npf.sys c:\windows\SysWow64\Packet.dll c:\windows\SysWow64\wpcap.dll J:\Autorun.inf J:\install.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_NPF . . ((((((((((((((((((((((((( Files Created from 2011-05-05 to 2011-06-05 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-08 14:46 . 2011-05-30 08:16 5931 —-a-r- C:\pedo.vbe 2011-05-30 15:07 . 2011-05-30 15:07 0 —-a-r- C:\boot.ini　　　　　　　　　　　　　　　　　　　　　　　　　　1035.vbe 2011-05-26 00:51 . 2010-06-24 16:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-05-25 05:14 . 2011-05-25 05:14 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-05-25 05:14 . 2011-05-25 05:14 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-05-25 05:14 . 2011-05-25 05:14 1389056 —-a-w- c:\windows\system32\wininet.dll 2011-05-25 05:14 . 2011-05-25 05:14 76800 —-a-w- c:\windows\system32\tdc.ocx 2011-05-25 05:14 . 2011-05-25 05:14 603648 —-a-w- c:\windows\system32\vbscript.dll 2011-05-25 05:14 . 2011-05-25 05:14 160256 —-a-w- c:\windows\system32\wextract.exe 2011-05-25 05:13 . 2011-05-25 05:13 748544 —-a-w- c:\windows\system32\stobject.dll 2011-05-25 05:13 . 2011-05-25 05:13 231936 —-a-w- c:\windows\system32\XpsRasterService.dll 2011-05-25 05:13 . 2011-05-25 05:13 366592 —-a-w- c:\windows\system32\winspool.drv 2011-05-25 05:13 . 2011-05-25 05:13 35840 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2011-05-25 05:13 . 2011-05-25 05:13 3068416 —-a-w- c:\windows\system32\xpsservices.dll 2011-05-25 05:13 . 2011-05-25 05:13 1032192 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2011-05-25 05:12 . 2011-05-25 05:12 449024 —-a-w- c:\windows\system32\WMPhoto.dll 2011-05-25 05:12 . 2011-05-25 05:12 411648 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-05-25 05:12 . 2011-05-25 05:12 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-05-25 05:12 . 2011-05-25 05:12 1209856 —-a-w- c:\windows\system32\WindowsCodecs.dll 2011-05-13 03:06 . 2011-05-30 08:16 12857 —-a-r- C:\女児のパンチラ画像.vbe 2011-05-13 03:06 . 2011-05-30 08:16 12857 —-a-r- c:\windows\system32\女児のパンチラ画像.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\自分の娘をモデルに撮影も 児童ポルノグループを摘発、違法画像５００万点を押収 .doc 　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\日本でポルノを作り、ポルノで日本文化を語るキモヲタの正体はテロリスト.txt　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\山口芳寛　容疑者(20).txt 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\自分の娘をモデルに撮影も 児童ポルノグループを摘発、違法画像５００万点を押収 .doc 　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\日本でポルノを作り、ポルノで日本文化を語るキモヲタの正体はテロリスト.txt　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\山口芳寛　容疑者(20).txt 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\【明らかに有害図書の影響】【キモヲタ犯罪】 有害な社会環境を作り出すキモヲタ 屁理屈　我がまま　幼稚なヲタク.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\キモヲタの言う文化ってなに？　頭の中はズリネタでいっぱい.txt　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\キモヲタの言うアニメってなに？　頭の中は性的な事でいっぱい.txt　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\キモヲタの言う文化ってなに？　頭の中はズリネタでいっぱい.txt　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\キモヲタの言うアニメってなに？　頭の中は性的な事でいっぱい.txt　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\【明らかに有害図書の影響】【キモヲタ犯罪】 腐ったアニメ・コミックで日本を汚すのが目的　工作員の為の同人活動 .doc .vbe 2011-04-20 02:43 . 2010-11-07 16:22 466456 —-a-w- c:\windows\system32\wrap_oal.dll 2011-04-20 02:43 . 2010-11-07 16:22 444952 —-a-w- c:\windows\SysWow64\wrap_oal.dll 2011-04-20 02:43 . 2010-11-07 16:22 122904 —-a-w- c:\windows\system32\OpenAL32.dll 2011-04-20 02:43 . 2010-11-07 16:22 109080 —-a-w- c:\windows\SysWow64\OpenAL32.dll 2011-04-09 23:55 . 2011-04-09 23:55 15453336 —-a-w- c:\windows\SysWow64\xlive.dll 2011-04-09 23:55 . 2011-04-09 23:55 13642904 —-a-w- c:\windows\SysWow64\xlivefnt.dll 2011-03-29 02:17 . 2011-03-29 02:17 49152 —-a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}\NewShortcut6_33A23D1E17A941AC9D985A884FB5B32E.exe 2011-03-29 02:17 . 2011-03-29 02:17 49152 —-a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}\NewShortcut1_33A23D1E17A941AC9D985A884FB5B32E_2.exe 2011-03-12 22:52 . 2011-05-25 12:33 1653760 —-a-w- c:\windows\system32\XpsPrint.dll 2011-03-07 21:56 . 2011-05-30 08:16 2536 —-a-r- C:\win.vbe 2011-03-07 21:56 . 2011-05-30 08:16 2536 —-a-r- c:\windows\system32\win.vbe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-02-28 00:01 3911776 —-a-w- c:\program files (x86)\ConduitEngine\ConduitEngin0.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 20:23 1385864 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngin0.dll" [2011-02-28 3911776] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "Steam"="c:\program files (x86)\Steam\steam.exe" [2010-11-17 1242448] "DownloadAccelerator"="c:\program files (x86)\DAP\DAP.EXE" [2010-11-30 2836656] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "P17RunE"="P17RunE.dll" [2008-03-28 14848] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "VolPanel"="c:\program files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2007-02-28 180224] "CarboniteSetupLite"="c:\program files (x86)\Carbonite\CarbonitePreinstaller.exe" [2010-05-03 283792] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "QuickTime Task"="c:\program files (x86)\QT Lite\QTTask.exe" [2010-11-29 421888] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-07 421160] "LifeChatSetup"="D:\setupstb.exe" [2009-09-28 378728] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2010-1-23 0] SDK Tray Menu.lnk - c:\sun\SDK\jdk\bin\javaw.exe [2009-8-30 139264] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-05-23 79360] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\DAUpdaterSvc.Service.exe [2010-12-01 25832] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS [x] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110518.001\BHDrvx64.sys [2011-05-18 1127032] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110603.003\IDSvia64.sys [2011-03-14 476792] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0501000.01D\Ironx64.SYS [x] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360x64\0501000.01D\SYMTDIV.SYS [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe [2011-04-17 130008] S2 UCManSvc;UCManSvc;c:\program files (x86)\SoftDenchi\UCManSvc.exe [2010-03-12 241808] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-05-30 136824] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}] 2010-02-18 18:01 396800 —-a-w- c:\program files (x86)\DAP\DAPIELoader64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "pedoip"="mshta http:" [X] "hentai"="mshta http:" [X] "animekun"="mshta http:" [X] "namikarem"="mshta http:" [X] "namikare"="mshta http:" [X] "rhelp"="url" [X] "rkimoi"="url" [X] "romake2"="url" [X] "rindex1"="url" [X] "rindex2"="mshta" [X] "pedo_ip_"="mshta http:" [X] "hentaic_"="mshta http:" [X] "aniwota_"="mshta http:" [X] "namikare_m"="mshta http:" [X] "namipedo_"="mshta http:" [X] "3omake_"="mshta http:" [X] "kimowot_a"="mshta http:" [X] "kusope_do"="mshta http:" [X] "kimoiwo_"="mshta http:" [X] "omake_1"="mshta http:" [X] "1omake_"="mshta http:" [X] "yahooj_"="mshta http:" [X] "2_omake"="mshta http:" [X] "t_1"="telnet.exe [removed]" [X] "4omake"="mshta http:" [X] "t_2"="mshta http:" [X] "cult_"="mshta http:" [X] "ttttt"="telnet.exe [removed]:500" [X] "winx_"="mshta http:" [X] "cult2_"="mshta http:" [X] "Share_DLP"="mshta http:" [X] "kusai_"="mshta http:" [X] "geroki_mo"="mshta http:" [X] "pedohentai"="mshta http:" [X] "kusopedo2"="mshta http:" [X] "pedo"="mshta http:" [X] "112"="mshta http:" [X] "kusohentai"="mshta http:" [X] "unko"="mshta http:" [X] "kusoanime2"="mshta http:" [X] "start"="mshta http:" [X] "anime"="mshta http:" [X] "max"="mshta http:" [X] "namikarem2kuso"="mshta http:" [X] "namirei"="mshta http:" [X] "kusolog"="mshta http:" [X] "GOGO"="url" [X] "omake2"="url" [X] "松本優樹（２４）"="mshta http:" [X] "kusofuck1"="mshta http:" [X] "kusofuck2"="mshta http:" [X] "pedo_2"="mshta http:" [X] "N014"="mshta http:" [X] "hentai_2"="mshta http:" [X] "N013"="mshta http:" [X] "anime2"="mshta http:" [X] "012"="mshta http:" [X] "namikarem_2"="mshta http:" [X] "011"="mshta http:" [X] "log"="mshta http:" [X] "010"="mshta http:" [X] "009"="mshta http:" [X] "008"="mshta http:" [X] "fuck1"="mshta http:" [X] "fuck2"="mshta http:" [X] "pedoz"="mshta http:" [X] "hentaiz"="mshta http:" [X] "animez"="mshta http:" [X] "namikaremz"="mshta http:" [X] "omake2z"="url" [X] "MyDocuments"="mshta http:" [X] "p2p_pedo"="mshta http:" [X] "namikarez"="mshta http:" [X] "pedo2"="mshta http:" [X] "hentai2"="mshta http:" [X] "namikarem2"="mshta http:" [X] "namikare2"="mshta http:" [X] "helpz2"="url" [X] "kimois2"="url" [X] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-31 171520] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6430208] "Skytel"="Skytel.exe" [2008-06-25 1826816] "roshioki"="wscript.exe" [2009-04-11 166912] "romake1"="wscript.exe" [2009-04-11 166912] "ryahoo"="wscript.exe" [2009-04-11 166912] "testc_"="wscript.exe" [2009-04-11 166912] "sva"="wscript.exe" [2009-04-11 166912] "oshioki"="wscript.exe" [2009-04-11 166912] "Explorer"="wscript.exe" [2009-04-11 166912] "help"="url.dll" [2011-05-25 236544] "kusoshioki2"="wscript.exe" [2009-04-11 166912] "Internet"="url.dll" [2011-05-25 236544] "kimoi"="url.dll" [2011-05-25 236544] "kusohelp2"="url.dll" [2011-05-25 236544] "omake1"="wscript.exe" [2009-04-11 166912] "Internet Explorer"="wscript.exe" [2009-04-11 166912] "kusokimoi2"="url.dll" [2011-05-25 236544] "omake4"="url.dll" [2011-05-25 236544] "yahoo"="wscript.exe" [2009-04-11 166912] "Service"="wscript.exe" [2009-04-11 166912] "kusomakedayoO"="wscript.exe" [2009-04-11 166912] "fuckpedo"="wscript.exe" [2009-04-11 166912] "exp"="wscript.exe" [2009-04-11 166912] "kusomake3"="url.dll" [2011-05-25 236544] "kusohoo2"="wscript.exe" [2009-04-11 166912] "fuckpedo2kuso"="wscript.exe" [2009-04-11 166912] "zip"="wscript.exe" [2009-04-11 166912] "oshioki2"="wscript.exe" [2009-04-11 166912] "help2"="url.dll" [2011-05-25 236544] "kimoi2"="url.dll" [2011-05-25 236544] "007"="wscript.exe" [2009-04-11 166912] "omakedayoO"="wscript.exe" [2009-04-11 166912] "006"="url.dll" [2011-05-25 236544] "omake3"="url.dll" [2011-05-25 236544] "005"="url.dll" [2011-05-25 236544] "yahoo2"="wscript.exe" [2009-04-11 166912] "004"="wscript.exe" [2009-04-11 166912] "fuckpedo2_"="wscript.exe" [2009-04-11 166912] "003"="url.dll" [2011-05-25 236544] "002"="wscript.exe" [2009-04-11 166912] "001"="url.dll" [2011-05-25 236544] "oshiokiz"="wscript.exe" [2009-04-11 166912] "helpz"="url.dll" [2011-05-25 236544] "kimoiz"="url.dll" [2011-05-25 236544] "omake1z"="wscript.exe" [2009-04-11 166912] "spare"="wscript.exe" [2009-04-11 166912] "oshiokii2"="wscript.exe" [2009-04-11 166912] "omakedayo"="wscript.exe" [2009-04-11 166912] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "ero"="mshta http:" [X] "update"="mshta http:" [X] "helpman"="url" [X] "kimoioyaji"="url" [X] "Internez Explorer"="url" [X] "sound"="mshta http:" [X] "ZIP1"="mshta http:" [X] "ZIP2"="mshta http:" [X] "ZIP3"="mshta http:" [X] "ZIP4"="mshta http:" [X] "1B2"="mshta http:" [X] "pedo"="mshta http:" [X] "hentai"="mshta http:" [X] "anime"="mshta http:" [X] "namikarem"="mshta http:" [X] "namikare"="mshta http:" [X] "omake2"="url" [X] "geropedo"="mshta http:" [X] "kuseehentai"="mshta http:" [X] "Microsoft"="wscript.exe" [2009-04-11 166912] "omakenanoda"="wscript.exe" [2009-04-11 166912] "Windowz"="wscript.exe" [2009-04-11 166912] "ohkimoi"="wscript.exe" [2009-04-11 166912] "0B1"="c:\boot.vbe" [2010-01-07 4906] "0B2"="sub.vbe" [2006-09-20 6413] "0B3"="wscript.exe" [2009-04-11 166912] "0B4"="wscript.exe" [2009-04-11 166912] "0B5"="wscript.exe" [2009-04-11 166912] "0B6"="wscript.exe" [2009-04-11 166912] "0B7"="wscript.exe" [2009-04-11 166912] "reg1"="wscript.exe" [2009-04-11 166912] "regsub2"="wscript.exe" [2009-04-11 166912] "namireg"="wscript.exe" [2009-04-11 166912] "ZIP5"="wscript.exe" [2009-04-11 166912] "ZIP6"="wscript.exe" [2009-04-11 166912] "1B3"="wscript.exe" [2009-04-11 166912] "1B4"="wscript.exe" [2009-04-11 166912] "oshioki"="wscript.exe" [2009-04-11 166912] "help"="url.dll" [2011-05-25 236544] "kimoi"="url.dll" [2011-05-25 236544] "omake1"="wscript.exe" [2009-04-11 166912] "yahoo"="wscript.exe" [2009-04-11 166912] "fuckpedo"="wscript.exe" [2009-04-11 166912] "service"="wscript.exe" [2009-04-11 166912] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.speedbit.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: &Clean Traces - c:\program files (x86)\DAP\Privacy Package\dapcleanerie.htm IE: &Download with &DAP - c:\program files (x86)\DAP\dapextie.htm IE: Download &all with DAP - c:\program files (x86)\DAP\dapextie2.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.smellslikevictory.net/SMF/ . - - - - ORPHANS REMOVED - - - - . Toolbar-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file) Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{88C7F2AA-F93F-432C-8F0E-B7D85967A527} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-CoreFLAC Audio Decoder+Source Filter - c:\windows\system32\CoreFLACDecoder-uninstall.exe AddRemove-DUEE_TUKUTUKU - c:\program files (x86)\DUEE\TUKUTUKU\uninstall.exe AddRemove-JGICJFKIJGLKICLNICLPICMGICMMIKHJIJIAIBGAIDFIIDIJIDEDIDIAIBJFIDFIIDEMIDIFIDIJIBGA - c:\vanadis\魔物娘たちとの楽園～スライム＆スキュラ～_DL版\_uninst.exe AddRemove-Love×Evolution - c:\evee\Love×Evolution\Uninstaller.exe AddRemove-Lula Inside - c:\games\TRIADA\Lula Inside\Uninst.isu AddRemove-MOV Player_is1 - c:\program files (x86)\MOV Player\unins000.exe AddRemove-Mystery P.I. - Stolen in San Francisco - c:\program files (x86)\PopCap Games\Mystery P.I. - Stolen in San Francisco\PopUninstall.exe AddRemove-{78DBA0F5-56C4-4EF9-BBF2-CC69C0A1A738} - c:\program files (x86)\暁WORKS\るいは智を呼ぶＦＤ\Uninstall.exe AddRemove-{99b2f2d4-9744-44bc-85f7-d3af784ab037} - c:\program files (x86)\Apricot\oukasengoku\maiduninstaller.exe AddRemove-ティンクルベル カジノ★パラダイス - c:\program files (x86)\ティンクルベル\ＴＢカジノ★パラダイス\LSUin000.exe AddRemove-俺サマのラグナRock_is1 - c:\program files (x86)\あかべぇそふとつぅTRY\俺サマのラグナRock\unins000.exe AddRemove-先生っ！　シてあげる - c:\program files (x86)\桃色劇場\先生っ！　シてあげる\UNINST.EXE AddRemove-操心術０ - c:\studio槞恋\操心術０\Uninstaller.exe AddRemove-1005080179.elitistjerks.com - c:\program files (x86)\Microsoft Silverlight\4.0.51204.0\Silverlight.Configuration.exe AddRemove-JINKI_TRIAL1 - c:\program files (x86)\GIGA\JINKI_TRIAL1\Uninstall.exe AddRemove-りとるらびっつ～わがままツインテール - c:\program files (x86)\WHITESOFT\りとるらびっつ\UNINST.EXE AddRemove-りぼる・さもなー - c:\revol\bootmenu.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360] "ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\5.1.0.29\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\10mile\ﾞ0ｾ0ﾗ*・ﾖ0] "AbnormalTerminateFlg"="0" "WinStat"="1" "JoyUse"="0" "FullScreenFit"="0" "RegWidth3"="0" "RegHeight3"="0" "FastModeFlg_AR"="1" "AutoSpeed"="295" "MojiSpeed"="1837" "EffectSpeed"="1000" "VoiceVolume"="1000" "MusicVolume"="80" "SoundVolume"="1000" "AbnormalMovieTerminateFlg"="0" "LOADSAVE_PAGE"="101" "NANIDO"="0" "GameSpeed"="1" "TOPMOST"="0" "FullScFreq"="0" "FullScBits"="0" "WinPosX"="46" "WinPosY"="46" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (Administrator) "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,c9,24, 81,35,19,d4,04,94,c7,16,24,74,4a,21,d3 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1d,dc, ca,72,f1,30,0d,a6,7f,db,65,c3,87,ca,bc "{FF6C3CF0-4B15-11D1-ABED-709549C10000}"=hex:51,66,7a,6c,4c,1d,3b,1b,e0,21,78, ee,22,1e,ba,5f,b1,e6,37,d5,4b,83,42,15 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (Administrator) "Timestamp"=hex:0d,7d,e1,02,a2,1e,cc,01 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,59,67,33,3f,61,1e,50,41,8a,67,32,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,59,67,33,3f,61,1e,50,41,8a,67,32,\ "6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,14,90,ed,44,bb,de,c9,46,80,a9,25,\ . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0] "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,20,cf,04,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\ "Changed"=dword:00000000 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HQuc0*0ｷ0f0B0R0・] "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,e0,78,24,00,00,00,00,00,00,00, 00,00,00,00,00,06,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\ "Changed"=dword:00000000 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*0*0*k04*r・匠R\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*+*匠Rﾑ0ﾃ0ｯ0\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.CDA" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.LDB\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\notepad.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.M3U" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.MHT" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.MHT" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MP3" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ratDVD\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\mplayerc.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.URL" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAV" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAX" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMA" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMD" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMS" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMZ" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WPL" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\SecuROM\License information*] "datasecu"=hex:45,9a,83,d4,26,a1,60,20,85,03,62,6d,db,09,d8,13,f0,ea,7c,20,b9, f6,46,a1,a8,56,80,d1,9c,fd,ce,52,f1,65,5e,87,bd,53,8a,d3,37,6c,5a,31,58,52,\ "rkeysecu"=hex:e4,e5,f1,95,82,9e,4e,23,28,f8,a0,53,67,11,18,df . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\TEATIME\K`a+*H*] "INSTALLDIR"="j:\\TEATIME\\恋愛＋H\\" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・] "InstMode"=hex:00,00,00,00 "InstPath"="c:\\Program Files (x86)\\桃色劇場\\先生っ！　シてあげる" "DataPath"="c:\\Users\\Administrator\\Documents\\桃色劇場\\先生っ！　シてあげる\\" "GUIDGameExplorerInstall"=hex:a1,28,7b,1c,84,9c,ca,4d,a1,b8,c4,d4,2b,63,e9,01 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・\System] "gbFullScreenFlag"=hex:00,00,00,00 "gbFullWindow"=hex:00,00,00,00 "gnWindowLeft"=hex:2d,02,00,00 "gnWindowTop"=hex:e3,00,00,00 "gdwWindowWidth"=hex:20,03,00,00 "gdwWindowHeight"=hex:58,02,00,00 "gdwWindowBpp"=hex:18,00,00,00 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0] "DisplayName"="ティンクルベル カジノ★パラダイス" "UninstallString"="c:\\Program Files (x86)\\ティンクルベル\\ＴＢカジノ★パラダイス\\LSUin000.exe \"c:\\Program Files (x86)\\ティンクルベル\\ＴＢカジノ★パラダイス\\LSUin000.lil\"" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HQuc0*0ｷ0f0B0R0・] "DisplayName"="先生っ！　シてあげる" "UninstallString"="c:\\Program Files (x86)\\桃色劇場\\先生っ！　シてあげる\\UNINST.EXE" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\S*t*u*d*i*o*ｪ尻`\ﾍdﾃ_S・] "InstalledFolder"="c:\\Studio邪恋\\操心術０" . ———————— Other Running Processes ———————— . c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\windows\SysWOW64\DllHost.exe c:\windows\SysWOW64\rundll32.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe c:\program files (x86)\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe c:\progra~2\GRETECH\GOMPLA~1\GOM.exe . ************************************************************************** . Completion time: 2011-06-05 13:52:19 - machine was rebooted ComboFix-quarantined-files.txt 2011-06-05 18:52 . Pre-Run: 75,130,331,136 bytes free Post-Run: 76,865,413,120 bytes free . - - End Of File - - AFBB6BCB7FFFED9C4050157B6594F2B6
Post #12
ryoga99,

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\pedo.vbe

Folder::
c:\program files (x86)\ConduitEngine
c:\program files (x86)\McAfee Security Scan

Registry::
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=-
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pedoip"=-
"hentai"=-
"animekun"=-
"namikarem"=-
"namikare"=-
"rhelp"=-
"rkimoi"=-
"romake2"=-
"rindex1"=-
"rindex2"=-
"pedo_ip_"=-
"hentaic_"=-
"aniwota_"=-
"namikare_m"=-
"namipedo_"=-
"3omake_"=-
"kimowot_a"=-
"kusope_do"=-
"kimoiwo_"=-
"omake_1"=-
"1omake_"=-
"yahooj_"=-
"2_omake"=-
"t_1"=-
"4omake"=-
"t_2"=-
"cult_"=-
"ttttt"=-
"winx_"=-
"cult2_"=-
"Share_DLP"=-
"kusai_"=-
"geroki_mo"=-
"pedohentai"=-
"kusopedo2"=-
"pedo"=-
"112"=-
"kusohentai"=-
"unko"=-
"kusoanime2"=-
"start"=-
"anime"=-
"max"=-
"namikarem2kuso"=-
"namirei"=-
"kusolog"=-
"GOGO"=-
"omake2"=-
"松本優樹（２４）"=-
"kusofuck1"=-
"kusofuck2"=-
"pedo_2"=-
"N014"=-
"hentai_2"=-
"N013"=-
"anime2"=-
"012"=-
"namikarem_2"=-
"011"=-
"log"=-
"010"=-
"009"=-
"008"=-
"fuck1"=-
"fuck2"=-
"pedoz"=-
"hentaiz"=-
"animez"=-
"namikaremz"=-
"omake2z"=-
"MyDocuments"=-
"p2p_pedo"=-
"namikarez"=-
"pedo2"=-
"hentai2"=-
"namikarem2"=-
"namikare2"=-
"helpz2"=-
"kimois2"=-
"roshioki"=-
"romake1"=-
"ryahoo"=-
"testc_"=-
"sva"=-
"oshioki"=-
"Explorer"=-
"help"=-
"kusoshioki2"=-
"Internet"=-
"kimoi"=-
"kusohelp2"=-
"omake1"=-
"Internet Explorer"=-
"omake4"=-
"yahoo"=-
"Service"=-
"kusomakedayoO"=-
"fuckpedo"=-
"exp"=-
"kusomake3"=-
"kusohoo2"=-
"fuckpedo2kuso"=-
"zip"=-
"oshioki2"=-
"help2"=-
"kimoi2"=-
"007"=-
"omakedayoO"=-
"006"=-
"omake3"=-
"005"=-
"yahoo2"=-
"004"=-
"fuckpedo2_"=-
"003"=-
"002"=-
"001"=-
"oshiokiz"=-
"helpz"=-
"kimoiz"=-
"omake1z"=-
"spare"=-
"oshiokii2"=-
"omakedayo"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ero"=-
"update"=-
"helpman"=-
"kimoioyaji"=-
"Internez Explorer"=-
"sound"=-
"ZIP1"=-
"ZIP2"=-
"ZIP3"=-
"ZIP4"=-
"1B2"=-
"pedo"=-
"hentai"=-
"anime"=-
"namikarem"=-
"namikare"=-
"omake2"=-
"geropedo"=-
"kuseehentai"=-
"Microsoft"=-
"omakenanoda"=-
"Windowz"=-
"ohkimoi"=-
"0B1"=-
"0B2"=-
"0B3"=-
"0B4"=-
"0B5"=-
"0B6"=-
"0B7"=-
"reg1"=-
"regsub2"=-
"namireg"=-
"ZIP5"=-
"ZIP6"=-
"1B3"=-
"1B4"=-
"oshioki"=-
"help"=-
"kimoi"=-
"omake1"=-
"yahoo"=-
"fuckpedo"=-
"service"=-

Driver::
McComponentHostService

regnull::
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\10mile\ﾞ0ｾ0ﾗ*・ﾖ0]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\Approved Extensions]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HQuc0*0ｷ0f0B0R0・]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*0*0*k04*r・匠R\OpenWithList]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*+*匠Rﾑ0ﾃ0ｯ0\OpenWithList]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.LDB\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ratDVD\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0\OpenWithList]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\SecuROM\License information*]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\TEATIME\K`a+*H*]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・\System]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HQuc0*0ｷ0f0B0R0・]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\S*t*u*d*i*o*ｪ尻`\ﾍdﾃ_S・]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #13
Here is the latest ComboFix log: ComboFix 11-06-05.06 - Administrator 5/2011 Sun 23:32:52.1.8 - x64 Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Administrator\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "C:\pedo.vbe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_McComponentHostService . . ((((((((((((((((((((((((( Files Created from 2011-05-06 to 2011-06-06 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-05-30 15:07 . 2011-05-30 15:07 0 —-a-r- C:\boot.ini　　　　　　　　　　　　　　　　　　　　　　　　　　1035.vbe 2011-05-26 00:51 . 2010-06-24 16:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-05-25 05:14 . 2011-05-25 05:14 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-05-25 05:14 . 2011-05-25 05:14 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-05-25 05:14 . 2011-05-25 05:14 1389056 —-a-w- c:\windows\system32\wininet.dll 2011-05-25 05:14 . 2011-05-25 05:14 76800 —-a-w- c:\windows\system32\tdc.ocx 2011-05-25 05:14 . 2011-05-25 05:14 603648 —-a-w- c:\windows\system32\vbscript.dll 2011-05-25 05:14 . 2011-05-25 05:14 160256 —-a-w- c:\windows\system32\wextract.exe 2011-05-25 05:13 . 2011-05-25 05:13 748544 —-a-w- c:\windows\system32\stobject.dll 2011-05-25 05:13 . 2011-05-25 05:13 231936 —-a-w- c:\windows\system32\XpsRasterService.dll 2011-05-25 05:13 . 2011-05-25 05:13 366592 —-a-w- c:\windows\system32\winspool.drv 2011-05-25 05:13 . 2011-05-25 05:13 35840 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2011-05-25 05:13 . 2011-05-25 05:13 3068416 —-a-w- c:\windows\system32\xpsservices.dll 2011-05-25 05:13 . 2011-05-25 05:13 1032192 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2011-05-25 05:12 . 2011-05-25 05:12 449024 —-a-w- c:\windows\system32\WMPhoto.dll 2011-05-25 05:12 . 2011-05-25 05:12 411648 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-05-25 05:12 . 2011-05-25 05:12 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-05-25 05:12 . 2011-05-25 05:12 1209856 —-a-w- c:\windows\system32\WindowsCodecs.dll 2011-05-25 00:14 . 2009-10-03 03:12 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-05-13 03:06 . 2011-05-30 08:16 12857 —-a-r- C:\女児のパンチラ画像.vbe 2011-05-13 03:06 . 2011-05-30 08:16 12857 —-a-r- c:\windows\system32\女児のパンチラ画像.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\自分の娘をモデルに撮影も 児童ポルノグループを摘発、違法画像５００万点を押収 .doc 　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\日本でポルノを作り、ポルノで日本文化を語るキモヲタの正体はテロリスト.txt　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\山口芳寛　容疑者(20).txt 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\自分の娘をモデルに撮影も 児童ポルノグループを摘発、違法画像５００万点を押収 .doc 　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\日本でポルノを作り、ポルノで日本文化を語るキモヲタの正体はテロリスト.txt　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\山口芳寛　容疑者(20).txt 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\【明らかに有害図書の影響】【キモヲタ犯罪】 有害な社会環境を作り出すキモヲタ 屁理屈　我がまま　幼稚なヲタク.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\キモヲタの言う文化ってなに？　頭の中はズリネタでいっぱい.txt　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\キモヲタの言うアニメってなに？　頭の中は性的な事でいっぱい.txt　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\キモヲタの言う文化ってなに？　頭の中はズリネタでいっぱい.txt　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\キモヲタの言うアニメってなに？　頭の中は性的な事でいっぱい.txt　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\【明らかに有害図書の影響】【キモヲタ犯罪】 腐ったアニメ・コミックで日本を汚すのが目的　工作員の為の同人活動 .doc .vbe 2011-04-20 02:43 . 2010-11-07 16:22 466456 —-a-w- c:\windows\system32\wrap_oal.dll 2011-04-20 02:43 . 2010-11-07 16:22 444952 —-a-w- c:\windows\SysWow64\wrap_oal.dll 2011-04-20 02:43 . 2010-11-07 16:22 122904 —-a-w- c:\windows\system32\OpenAL32.dll 2011-04-20 02:43 . 2010-11-07 16:22 109080 —-a-w- c:\windows\SysWow64\OpenAL32.dll 2011-04-09 23:55 . 2011-04-09 23:55 15453336 —-a-w- c:\windows\SysWow64\xlive.dll 2011-04-09 23:55 . 2011-04-09 23:55 13642904 —-a-w- c:\windows\SysWow64\xlivefnt.dll 2011-03-29 02:17 . 2011-03-29 02:17 49152 —-a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}\NewShortcut6_33A23D1E17A941AC9D985A884FB5B32E.exe 2011-03-29 02:17 . 2011-03-29 02:17 49152 —-a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}\NewShortcut1_33A23D1E17A941AC9D985A884FB5B32E_2.exe 2011-03-12 22:52 . 2011-05-25 12:33 1653760 —-a-w- c:\windows\system32\XpsPrint.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 20:23 1385864 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "Steam"="c:\program files (x86)\Steam\steam.exe" [2010-11-17 1242448] "DownloadAccelerator"="c:\program files (x86)\DAP\DAP.EXE" [2010-11-30 2836656] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "P17RunE"="P17RunE.dll" [2008-03-28 14848] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "VolPanel"="c:\program files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2007-02-28 180224] "CarboniteSetupLite"="c:\program files (x86)\Carbonite\CarbonitePreinstaller.exe" [2010-05-03 283792] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "QuickTime Task"="c:\program files (x86)\QT Lite\QTTask.exe" [2010-11-29 421888] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-07 421160] "LifeChatSetup"="D:\setupstb.exe" [2009-09-28 378728] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2010-1-23 0] SDK Tray Menu.lnk - c:\sun\SDK\jdk\bin\javaw.exe [2009-8-30 139264] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-05-23 79360] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\DAUpdaterSvc.Service.exe [2010-12-01 25832] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S2 UCManSvc;UCManSvc;c:\program files (x86)\SoftDenchi\UCManSvc.exe [2010-03-12 241808] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}] 2010-02-18 18:01 396800 —-a-w- c:\program files (x86)\DAP\DAPIELoader64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "pedoip"="mshta http:" [X] "hentai"="mshta http:" [X] "animekun"="mshta http:" [X] "namikarem"="mshta http:" [X] "namikare"="mshta http:" [X] "rhelp"="url" [X] "rkimoi"="url" [X] "romake2"="url" [X] "rindex1"="url" [X] "rindex2"="mshta" [X] "pedo_ip_"="mshta http:" [X] "hentaic_"="mshta http:" [X] "aniwota_"="mshta http:" [X] "namikare_m"="mshta http:" [X] "namipedo_"="mshta http:" [X] "3omake_"="mshta http:" [X] "kimowot_a"="mshta http:" [X] "kusope_do"="mshta http:" [X] "kimoiwo_"="mshta http:" [X] "omake_1"="mshta http:" [X] "1omake_"="mshta http:" [X] "yahooj_"="mshta http:" [X] "2_omake"="mshta http:" [X] "t_1"="telnet.exe [removed]" [X] "4omake"="mshta http:" [X] "t_2"="mshta http:" [X] "cult_"="mshta http:" [X] "ttttt"="telnet.exe [removed]:500" [X] "winx_"="mshta http:" [X] "cult2_"="mshta http:" [X] "Share_DLP"="mshta http:" [X] "kusai_"="mshta http:" [X] "geroki_mo"="mshta http:" [X] "pedohentai"="mshta http:" [X] "kusopedo2"="mshta http:" [X] "pedo"="mshta http:" [X] "112"="mshta http:" [X] "kusohentai"="mshta http:" [X] "unko"="mshta http:" [X] "kusoanime2"="mshta http:" [X] "anime"="mshta http:" [X] "max"="mshta http:" [X] "namikarem2kuso"="mshta http:" [X] "namirei"="mshta http:" [X] "kusolog"="mshta http:" [X] "GOGO"="url" [X] "omake2"="url" [X] "松本優樹（２４）"="mshta http:" [X] "kusofuck1"="mshta http:" [X] "kusofuck2"="mshta http:" [X] "pedo_2"="mshta http:" [X] "N014"="mshta http:" [X] "hentai_2"="mshta http:" [X] "N013"="mshta http:" [X] "anime2"="mshta http:" [X] "012"="mshta http:" [X] "namikarem_2"="mshta http:" [X] "011"="mshta http:" [X] "log"="mshta http:" [X] "010"="mshta http:" [X] "009"="mshta http:" [X] "008"="mshta http:" [X] "fuck1"="mshta http:" [X] "fuck2"="mshta http:" [X] "pedoz"="mshta http:" [X] "hentaiz"="mshta http:" [X] "animez"="mshta http:" [X] "namikaremz"="mshta http:" [X] "omake2z"="url" [X] "MyDocuments"="mshta http:" [X] "p2p_pedo"="mshta http:" [X] "namikarez"="mshta http:" [X] "pedo2"="mshta http:" [X] "hentai2"="mshta http:" [X] "namikarem2"="mshta http:" [X] "namikare2"="mshta http:" [X] "helpz2"="url" [X] "kimois2"="url" [X] "start"="mshta http:" [X] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-31 171520] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6430208] "Skytel"="Skytel.exe" [2008-06-25 1826816] "roshioki"="wscript.exe" [2009-04-11 166912] "romake1"="wscript.exe" [2009-04-11 166912] "ryahoo"="wscript.exe" [2009-04-11 166912] "testc_"="wscript.exe" [2009-04-11 166912] "sva"="wscript.exe" [2009-04-11 166912] "oshioki"="wscript.exe" [2009-04-11 166912] "kusoshioki2"="wscript.exe" [2009-04-11 166912] "kimoi"="url.dll" [2011-05-25 236544] "kusohelp2"="url.dll" [2011-05-25 236544] "omake1"="wscript.exe" [2009-04-11 166912] "kusokimoi2"="url.dll" [2011-05-25 236544] "omake4"="url.dll" [2011-05-25 236544] "yahoo"="wscript.exe" [2009-04-11 166912] "kusomakedayoO"="wscript.exe" [2009-04-11 166912] "fuckpedo"="wscript.exe" [2009-04-11 166912] "exp"="wscript.exe" [2009-04-11 166912] "kusomake3"="url.dll" [2011-05-25 236544] "kusohoo2"="wscript.exe" [2009-04-11 166912] "fuckpedo2kuso"="wscript.exe" [2009-04-11 166912] "zip"="wscript.exe" [2009-04-11 166912] "oshioki2"="wscript.exe" [2009-04-11 166912] "help2"="url.dll" [2011-05-25 236544] "kimoi2"="url.dll" [2011-05-25 236544] "007"="wscript.exe" [2009-04-11 166912] "omakedayoO"="wscript.exe" [2009-04-11 166912] "006"="url.dll" [2011-05-25 236544] "omake3"="url.dll" [2011-05-25 236544] "005"="url.dll" [2011-05-25 236544] "yahoo2"="wscript.exe" [2009-04-11 166912] "004"="wscript.exe" [2009-04-11 166912] "fuckpedo2_"="wscript.exe" [2009-04-11 166912] "003"="url.dll" [2011-05-25 236544] "002"="wscript.exe" [2009-04-11 166912] "001"="url.dll" [2011-05-25 236544] "oshiokiz"="wscript.exe" [2009-04-11 166912] "helpz"="url.dll" [2011-05-25 236544] "kimoiz"="url.dll" [2011-05-25 236544] "omake1z"="wscript.exe" [2009-04-11 166912] "spare"="wscript.exe" [2009-04-11 166912] "oshiokii2"="wscript.exe" [2009-04-11 166912] "omakedayo"="wscript.exe" [2009-04-11 166912] "Explorer"="wscript.exe" [2009-04-11 166912] "Internet"="url.dll" [2011-05-25 236544] "Internet Explorer"="wscript.exe" [2009-04-11 166912] "Service"="wscript.exe" [2009-04-11 166912] "help"="url.dll" [2011-05-25 236544] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "sound"="mshta http:" [X] "ZIP1"="mshta http:" [X] "ZIP2"="mshta http:" [X] "ZIP3"="mshta http:" [X] "ZIP4"="mshta http:" [X] "1B2"="mshta http:" [X] "pedo"="mshta http:" [X] "hentai"="mshta http:" [X] "anime"="mshta http:" [X] "namikarem"="mshta http:" [X] "namikare"="mshta http:" [X] "omake2"="url" [X] "geropedo"="mshta http:" [X] "kuseehentai"="mshta http:" [X] "ero"="mshta http:" [X] "update"="mshta http:" [X] "helpman"="url" [X] "kimoioyaji"="url" [X] "Internez Explorer"="url" [X] "0B6"="wscript.exe" [2009-04-11 166912] "0B7"="wscript.exe" [2009-04-11 166912] "reg1"="wscript.exe" [2009-04-11 166912] "regsub2"="wscript.exe" [2009-04-11 166912] "namireg"="wscript.exe" [2009-04-11 166912] "ZIP5"="wscript.exe" [2009-04-11 166912] "ZIP6"="wscript.exe" [2009-04-11 166912] "1B3"="wscript.exe" [2009-04-11 166912] "1B4"="wscript.exe" [2009-04-11 166912] "oshioki"="wscript.exe" [2009-04-11 166912] "help"="url.dll" [2011-05-25 236544] "kimoi"="url.dll" [2011-05-25 236544] "omake1"="wscript.exe" [2009-04-11 166912] "yahoo"="wscript.exe" [2009-04-11 166912] "fuckpedo"="wscript.exe" [2009-04-11 166912] "service"="wscript.exe" [2009-04-11 166912] "Microsoft"="wscript.exe" [2009-04-11 166912] "omakenanoda"="wscript.exe" [2009-04-11 166912] "Windowz"="wscript.exe" [2009-04-11 166912] "ohkimoi"="wscript.exe" [2009-04-11 166912] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.speedbit.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: &Clean Traces - c:\program files (x86)\DAP\Privacy Package\dapcleanerie.htm IE: &Download with &DAP - c:\program files (x86)\DAP\dapextie.htm IE: Download &all with DAP - c:\program files (x86)\DAP\dapextie2.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.smellslikevictory.net/SMF/ . - - - - ORPHANS REMOVED - - - - . Toolbar-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) AddRemove-conduitEngine - c:\program files (x86)\ConduitEngine\ConduitEngineUninstall.exe AddRemove-McAfee Security Scan - c:\program files (x86)\McAfee Security Scan\uninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\10mile\ﾞ0ｾ0ﾗ*・ﾖ0] "AbnormalTerminateFlg"="0" "WinStat"="1" "JoyUse"="0" "FullScreenFit"="0" "RegWidth3"="0" "RegHeight3"="0" "FastModeFlg_AR"="1" "AutoSpeed"="295" "MojiSpeed"="1837" "EffectSpeed"="1000" "VoiceVolume"="1000" "MusicVolume"="80" "SoundVolume"="1000" "AbnormalMovieTerminateFlg"="0" "LOADSAVE_PAGE"="101" "NANIDO"="0" "GameSpeed"="1" "TOPMOST"="0" "FullScFreq"="0" "FullScBits"="0" "WinPosX"="46" "WinPosY"="46" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (Administrator) "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,c9,24, 81,35,19,d4,04,94,c7,16,24,74,4a,21,d3 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1d,dc, ca,72,f1,30,0d,a6,7f,db,65,c3,87,ca,bc "{FF6C3CF0-4B15-11D1-ABED-709549C10000}"=hex:51,66,7a,6c,4c,1d,3b,1b,e0,21,78, ee,22,1e,ba,5f,b1,e6,37,d5,4b,83,42,15 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (Administrator) "Timestamp"=hex:0d,7d,e1,02,a2,1e,cc,01 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,59,67,33,3f,61,1e,50,41,8a,67,32,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,59,67,33,3f,61,1e,50,41,8a,67,32,\ "6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,14,90,ed,44,bb,de,c9,46,80,a9,25,\ . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0] "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,20,cf,04,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\ "Changed"=dword:00000000 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HQuc0*0ｷ0f0B0R0・] "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,e0,78,24,00,00,00,00,00,00,00, 00,00,00,00,00,06,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\ "Changed"=dword:00000000 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*0*0*k04*r・匠R\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*+*匠Rﾑ0ﾃ0ｯ0\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.CDA" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.LDB\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\notepad.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.M3U" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.MHT" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.MHT" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MP3" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ratDVD\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\mplayerc.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.URL" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAV" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAX" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMA" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMD" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMS" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMZ" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WPL" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\SecuROM\License information*] "datasecu"=hex:45,9a,83,d4,26,a1,60,20,85,03,62,6d,db,09,d8,13,f0,ea,7c,20,b9, f6,46,a1,a8,56,80,d1,9c,fd,ce,52,f1,65,5e,87,bd,53,8a,d3,37,6c,5a,31,58,52,\ "rkeysecu"=hex:e4,e5,f1,95,82,9e,4e,23,28,f8,a0,53,67,11,18,df . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\TEATIME\K`a+*H*] "INSTALLDIR"="j:\\TEATIME\\恋愛＋H\\" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・] "InstMode"=hex:00,00,00,00 "InstPath"="c:\\Program Files (x86)\\桃色劇場\\先生っ！　シてあげる" "DataPath"="c:\\Users\\Administrator\\Documents\\桃色劇場\\先生っ！　シてあげる\\" "GUIDGameExplorerInstall"=hex:a1,28,7b,1c,84,9c,ca,4d,a1,b8,c4,d4,2b,63,e9,01 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・\System] "gbFullScreenFlag"=hex:00,00,00,00 "gbFullWindow"=hex:00,00,00,00 "gnWindowLeft"=hex:2d,02,00,00 "gnWindowTop"=hex:e3,00,00,00 "gdwWindowWidth"=hex:20,03,00,00 "gdwWindowHeight"=hex:58,02,00,00 "gdwWindowBpp"=hex:18,00,00,00 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0] "DisplayName"="ティンクルベル カジノ★パラダイス" "UninstallString"="c:\\Program Files (x86)\\ティンクルベル\\ＴＢカジノ★パラダイス\\LSUin000.exe \"c:\\Program Files (x86)\\ティンクルベル\\ＴＢカジノ★パラダイス\\LSUin000.lil\"" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HQuc0*0ｷ0f0B0R0・] "DisplayName"="先生っ！　シてあげる" "UninstallString"="c:\\Program Files (x86)\\桃色劇場\\先生っ！　シてあげる\\UNINST.EXE" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\S*t*u*d*i*o*ｪ尻`\ﾍdﾃ_S・] "InstalledFolder"="c:\\Studio邪恋\\操心術０" . ———————— Other Running Processes ———————— . c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\windows\SysWOW64\rundll32.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe c:\program files (x86)\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe . ************************************************************************** . Completion time: 2011-06-06 00:18:07 - machine was rebooted ComboFix-quarantined-files.txt 2011-06-06 05:18 ComboFix2.txt 2011-06-05 18:52 . Pre-Run: 81,945,346,048 bytes free Post-Run: 81,991,847,936 bytes free . - - End Of File - - 5BB4386D4D1F6D1BD1739E1B515B6A7F
Post #14
Well… only half of the script worked.

Let's try again.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Registry::
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=-
[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pedoip"=-
"hentai"=-
"animekun"=-
"namikarem"=-
"namikare"=-
"rhelp"=-
"rkimoi"=-
"romake2"=-
"rindex1"=-
"rindex2"=-
"pedo_ip_"=-
"hentaic_"=-
"aniwota_"=-
"namikare_m"=-
"namipedo_"=-
"3omake_"=-
"kimowot_a"=-
"kusope_do"=-
"kimoiwo_"=-
"omake_1"=-
"1omake_"=-
"yahooj_"=-
"2_omake"=-
"t_1"=-
"4omake"=-
"t_2"=-
"cult_"=-
"ttttt"=-
"winx_"=-
"cult2_"=-
"Share_DLP"=-
"kusai_"=-
"geroki_mo"=-
"pedohentai"=-
"kusopedo2"=-
"pedo"=-
"112"=-
"kusohentai"=-
"unko"=-
"kusoanime2"=-
"start"=-
"anime"=-
"max"=-
"namikarem2kuso"=-
"namirei"=-
"kusolog"=-
"GOGO"=-
"omake2"=-
"松本優樹（２４）"=-
"kusofuck1"=-
"kusofuck2"=-
"pedo_2"=-
"N014"=-
"hentai_2"=-
"N013"=-
"anime2"=-
"012"=-
"namikarem_2"=-
"011"=-
"log"=-
"010"=-
"009"=-
"008"=-
"fuck1"=-
"fuck2"=-
"pedoz"=-
"hentaiz"=-
"animez"=-
"namikaremz"=-
"omake2z"=-
"MyDocuments"=-
"p2p_pedo"=-
"namikarez"=-
"pedo2"=-
"hentai2"=-
"namikarem2"=-
"namikare2"=-
"helpz2"=-
"kimois2"=-
"roshioki"=-
"romake1"=-
"ryahoo"=-
"testc_"=-
"sva"=-
"oshioki"=-
"Explorer"=-
"help"=-
"kusoshioki2"=-
"Internet"=-
"kimoi"=-
"kusohelp2"=-
"omake1"=-
"Internet Explorer"=-
"omake4"=-
"yahoo"=-
"Service"=-
"kusomakedayoO"=-
"fuckpedo"=-
"exp"=-
"kusomake3"=-
"kusohoo2"=-
"fuckpedo2kuso"=-
"zip"=-
"oshioki2"=-
"help2"=-
"kimoi2"=-
"007"=-
"omakedayoO"=-
"006"=-
"omake3"=-
"005"=-
"yahoo2"=-
"004"=-
"fuckpedo2_"=-
"003"=-
"002"=-
"001"=-
"oshiokiz"=-
"helpz"=-
"kimoiz"=-
"omake1z"=-
"spare"=-
"oshiokii2"=-
"omakedayo"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ero"=-
"update"=-
"helpman"=-
"kimoioyaji"=-
"Internez Explorer"=-
"sound"=-
"ZIP1"=-
"ZIP2"=-
"ZIP3"=-
"ZIP4"=-
"1B2"=-
"pedo"=-
"hentai"=-
"anime"=-
"namikarem"=-
"namikare"=-
"omake2"=-
"geropedo"=-
"kuseehentai"=-
"Microsoft"=-
"omakenanoda"=-
"Windowz"=-
"ohkimoi"=-
"0B1"=-
"0B2"=-
"0B3"=-
"0B4"=-
"0B5"=-
"0B6"=-
"0B7"=-
"reg1"=-
"regsub2"=-
"namireg"=-
"ZIP5"=-
"ZIP6"=-
"1B3"=-
"1B4"=-
"oshioki"=-
"help"=-
"kimoi"=-
"omake1"=-
"yahoo"=-
"fuckpedo"=-
"service"=-

Driver::
McComponentHostService

regnull::
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\10mile\ﾞ0ｾ0ﾗ*・ﾖ0]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\Approved Extensions]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HQuc0*0ｷ0f0B0R0・]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*0*0*k04*r・匠R\OpenWithList]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*+*匠Rﾑ0ﾃ0ｯ0\OpenWithList]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.LDB\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ratDVD\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0\OpenWithList]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\SecuROM\License information*]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\TEATIME\K`a+*H*]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・]
[HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・\System]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HQuc0*0ｷ0f0B0R0・]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\S*t*u*d*i*o*ｪ尻`\ﾍdﾃ_S・]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #15
Here is the new ComboFix log: ComboFix 11-06-05.06 - Administrator 6/2011 Mon 7:19.1.8 - x64 Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Administrator\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2011-05-06 to 2011-06-06 ))))))))))))))))))))))))))))))) . . . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-05-30 15:07 . 2011-05-30 15:07 0 —-a-r- C:\boot.ini　　　　　　　　　　　　　　　　　　　　　　　　　　1035.vbe 2011-05-26 00:51 . 2010-06-24 16:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-05-25 05:14 . 2011-05-25 05:14 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-05-25 05:14 . 2011-05-25 05:14 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-05-25 05:14 . 2011-05-25 05:14 1389056 —-a-w- c:\windows\system32\wininet.dll 2011-05-25 05:14 . 2011-05-25 05:14 76800 —-a-w- c:\windows\system32\tdc.ocx 2011-05-25 05:14 . 2011-05-25 05:14 603648 —-a-w- c:\windows\system32\vbscript.dll 2011-05-25 05:14 . 2011-05-25 05:14 160256 —-a-w- c:\windows\system32\wextract.exe 2011-05-25 05:13 . 2011-05-25 05:13 748544 —-a-w- c:\windows\system32\stobject.dll 2011-05-25 05:13 . 2011-05-25 05:13 231936 —-a-w- c:\windows\system32\XpsRasterService.dll 2011-05-25 05:13 . 2011-05-25 05:13 366592 —-a-w- c:\windows\system32\winspool.drv 2011-05-25 05:13 . 2011-05-25 05:13 35840 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2011-05-25 05:13 . 2011-05-25 05:13 3068416 —-a-w- c:\windows\system32\xpsservices.dll 2011-05-25 05:13 . 2011-05-25 05:13 1032192 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2011-05-25 05:12 . 2011-05-25 05:12 449024 —-a-w- c:\windows\system32\WMPhoto.dll 2011-05-25 05:12 . 2011-05-25 05:12 411648 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-05-25 05:12 . 2011-05-25 05:12 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-05-25 05:12 . 2011-05-25 05:12 1209856 —-a-w- c:\windows\system32\WindowsCodecs.dll 2011-05-25 00:14 . 2009-10-03 03:12 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-05-13 03:06 . 2011-05-30 08:16 12857 —-a-r- C:\女児のパンチラ画像.vbe 2011-05-13 03:06 . 2011-05-30 08:16 12857 —-a-r- c:\windows\system32\女児のパンチラ画像.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\自分の娘をモデルに撮影も 児童ポルノグループを摘発、違法画像５００万点を押収 .doc 　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\日本でポルノを作り、ポルノで日本文化を語るキモヲタの正体はテロリスト.txt　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\山口芳寛　容疑者(20).txt 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- C:\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\自分の娘をモデルに撮影も 児童ポルノグループを摘発、違法画像５００万点を押収 .doc 　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\森たかお 筋金入りのペドフィリア 齋藤雅幸（さいとうまさゆき） エロゲ アニヲタ 趣味 ペド絵を描く事 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\有害な社会環境を作り出すキモヲタ 屁理屈 我がまま 幼稚なヲタク.jpg 　　　　　　　　　　　　　　　　　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\日本でポルノを作り、ポルノで日本文化を語るキモヲタの正体はテロリスト.txt　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\山口芳寛　容疑者(20).txt 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\小児性愛的で気持ち悪い糞アニメや有害図書に洗脳されたキモヲタの思想　山口芳寛と同じ危険な連中.txt　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5341 —-a-r- c:\windows\system32\キモヲタ犯罪 過去ニュースリスト .html 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- C:\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\有害な社会環境を作り出すキモヲタの行動を撮影　キモヲタはこんな非常識な事をしています.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\文句は受け付けません　社会の汚物 キモヲタくんの真似をしてみました 下品なアイコラを真似してみました 文句は受け付けません005.jpg 　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\キモヲタ犯罪 過去ニュースリスト .html　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　.vbe 2011-05-08 16:16 . 2011-05-30 08:16 5124 —-a-r- c:\windows\system32\【明らかに有害図書の影響】【キモヲタ犯罪】 有害な社会環境を作り出すキモヲタ 屁理屈　我がまま　幼稚なヲタク.jpg .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\キモヲタの言う文化ってなに？　頭の中はズリネタでいっぱい.txt　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- C:\キモヲタの言うアニメってなに？　頭の中は性的な事でいっぱい.txt　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\摘発されたわいせつグループは一都五県に広がり、漫画家などもいました .doc .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\キモヲタの言う文化ってなに？　頭の中はズリネタでいっぱい.txt　　　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\キモヲタの言うアニメってなに？　頭の中は性的な事でいっぱい.txt　　 .vbe 2011-05-08 16:16 . 2011-05-30 08:16 3424 —-a-r- c:\windows\system32\【明らかに有害図書の影響】【キモヲタ犯罪】 腐ったアニメ・コミックで日本を汚すのが目的　工作員の為の同人活動 .doc .vbe 2011-04-20 02:43 . 2010-11-07 16:22 466456 —-a-w- c:\windows\system32\wrap_oal.dll 2011-04-20 02:43 . 2010-11-07 16:22 444952 —-a-w- c:\windows\SysWow64\wrap_oal.dll 2011-04-20 02:43 . 2010-11-07 16:22 122904 —-a-w- c:\windows\system32\OpenAL32.dll 2011-04-20 02:43 . 2010-11-07 16:22 109080 —-a-w- c:\windows\SysWow64\OpenAL32.dll 2011-04-09 23:55 . 2011-04-09 23:55 15453336 —-a-w- c:\windows\SysWow64\xlive.dll 2011-04-09 23:55 . 2011-04-09 23:55 13642904 —-a-w- c:\windows\SysWow64\xlivefnt.dll 2011-03-29 02:17 . 2011-03-29 02:17 49152 —-a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}\NewShortcut6_33A23D1E17A941AC9D985A884FB5B32E.exe 2011-03-29 02:17 . 2011-03-29 02:17 49152 —-a-r- c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{E5E3B04A-CE27-4B53-92CA-8C96D4EBA24A}\NewShortcut1_33A23D1E17A941AC9D985A884FB5B32E_2.exe 2011-03-12 22:52 . 2011-05-25 12:33 1653760 —-a-w- c:\windows\system32\XpsPrint.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2010-05-26 20:23 1385864 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "Steam"="c:\program files (x86)\Steam\steam.exe" [2010-11-17 1242448] "DownloadAccelerator"="c:\program files (x86)\DAP\DAP.EXE" [2010-11-30 2836656] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "P17RunE"="P17RunE.dll" [2008-03-28 14848] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "VolPanel"="c:\program files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2007-02-28 180224] "CarboniteSetupLite"="c:\program files (x86)\Carbonite\CarbonitePreinstaller.exe" [2010-05-03 283792] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "QuickTime Task"="c:\program files (x86)\QT Lite\QTTask.exe" [2010-11-29 421888] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-07 421160] "LifeChatSetup"="D:\setupstb.exe" [2009-09-28 378728] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] . c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2010-1-23 0] SDK Tray Menu.lnk - c:\sun\SDK\jdk\bin\javaw.exe [2009-8-30 139264] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-05-23 79360] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\steam\steamapps\common\dragon age ultimate edition\bin_ship\DAUpdaterSvc.Service.exe [2010-12-01 25832] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S2 UCManSvc;UCManSvc;c:\program files (x86)\SoftDenchi\UCManSvc.exe [2010-03-12 241808] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}] 2010-02-18 18:01 396800 —-a-w- c:\program files (x86)\DAP\DAPIELoader64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "松本優樹（２４）"="mshta http:" [X] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-31 171520] "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6430208] "Skytel"="Skytel.exe" [2008-06-25 1826816] "kusokimoi2"="url.dll" [2011-05-25 236544] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.speedbit.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: &Clean Traces - c:\program files (x86)\DAP\Privacy Package\dapcleanerie.htm IE: &Download with &DAP - c:\program files (x86)\DAP\dapextie.htm IE: Download &all with DAP - c:\program files (x86)\DAP\dapextie2.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\z2930pdq.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.smellslikevictory.net/SMF/ . - - - - ORPHANS REMOVED - - - - . Toolbar-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) AddRemove-FW_Grisaia - c:\frontwing\グリザイアの果実\uninst.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\10mile\ﾞ0ｾ0ﾗ*・ﾖ0] "AbnormalTerminateFlg"="0" "WinStat"="1" "JoyUse"="0" "FullScreenFit"="0" "RegWidth3"="0" "RegHeight3"="0" "FastModeFlg_AR"="1" "AutoSpeed"="295" "MojiSpeed"="1837" "EffectSpeed"="1000" "VoiceVolume"="1000" "MusicVolume"="80" "SoundVolume"="1000" "AbnormalMovieTerminateFlg"="0" "LOADSAVE_PAGE"="101" "NANIDO"="0" "GameSpeed"="1" "TOPMOST"="0" "FullScFreq"="0" "FullScBits"="0" "WinPosX"="46" "WinPosY"="46" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (Administrator) "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,c9,24, 81,35,19,d4,04,94,c7,16,24,74,4a,21,d3 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1d,dc, ca,72,f1,30,0d,a6,7f,db,65,c3,87,ca,bc "{FF6C3CF0-4B15-11D1-ABED-709549C10000}"=hex:51,66,7a,6c,4c,1d,3b,1b,e0,21,78, ee,22,1e,ba,5f,b1,e6,37,d5,4b,83,42,15 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (Administrator) "Timestamp"=hex:0d,7d,e1,02,a2,1e,cc,01 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,59,67,33,3f,61,1e,50,41,8a,67,32,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,59,67,33,3f,61,1e,50,41,8a,67,32,\ "6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,14,90,ed,44,bb,de,c9,46,80,a9,25,\ . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0] "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,20,cf,04,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\ "Changed"=dword:00000000 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\HQuc0*0ｷ0f0B0R0・] "SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,e0,78,24,00,00,00,00,00,00,00, 00,00,00,00,00,06,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\ "Changed"=dword:00000000 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*0*0*k04*r・匠R\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*+*匠Rﾑ0ﾃ0ｯ0\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AIFF" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.CDA" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.LDB\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\notepad.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.M3U" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.MHT" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.MHT" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MP3" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MPEG" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\GOM.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\FSViewer.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ratDVD\UserChoice] @Denied: (2) (Administrator) "Progid"="Applications\\mplayerc.exe" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.MIDI" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.AU" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice] @Denied: (2) (Administrator) "Progid"="IE.AssocFile.URL" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAV" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WAX" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMA" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMD" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMS" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WMZ" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice] @Denied: (2) (Administrator) "Progid"="WMP11.AssocFile.WPL" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (Administrator) "Progid"="FirefoxHTML" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*B0U0r0\OpenWithList] @Class="Shell" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\SecuROM\License information*] "datasecu"=hex:45,9a,83,d4,26,a1,60,20,85,03,62,6d,db,09,d8,13,f0,ea,7c,20,b9, f6,46,a1,a8,56,80,d1,9c,fd,ce,52,f1,65,5e,87,bd,53,8a,d3,37,6c,5a,31,58,52,\ "rkeysecu"=hex:e4,e5,f1,95,82,9e,4e,23,28,f8,a0,53,67,11,18,df . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\TEATIME\K`a+*H*] "INSTALLDIR"="j:\\TEATIME\\恋愛＋H\\" . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・] "InstMode"=hex:00,00,00,00 "InstPath"="c:\\Program Files (x86)\\桃色劇場\\先生っ！　シてあげる" "DataPath"="c:\\Users\\Administrator\\Documents\\桃色劇場\\先生っ！　シてあげる\\" "GUIDGameExplorerInstall"=hex:a1,28,7b,1c,84,9c,ca,4d,a1,b8,c4,d4,2b,63,e9,01 . [HKEY_USERS\S-1-5-21-3680643605-2179211147-4140270917-500\Software\ChrｇR4X\HQuc0*0ｷ0f0B0R0・\System] "gbFullScreenFlag"=hex:00,00,00,00 "gbFullWindow"=hex:00,00,00,00 "gnWindowLeft"=hex:2d,02,00,00 "gnWindowTop"=hex:e3,00,00,00 "gdwWindowWidth"=hex:20,03,00,00 "gdwWindowHeight"=hex:58,02,00,00 "gdwWindowBpp"=hex:18,00,00,00 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ﾆ0｣0・ｯ0・ﾙ0・ *ｫ0ｸ0ﾎ0&ﾑ0・ﾀ0､0ｹ0] "DisplayName"="ティンクルベル カジノ★パラダイス" "UninstallString"="c:\\Program Files (x86)\\ティンクルベル\\ＴＢカジノ★パラダイス\\LSUin000.exe \"c:\\Program Files (x86)\\ティンクルベル\\ＴＢカジノ★パラダイス\\LSUin000.lil\"" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HQuc0*0ｷ0f0B0R0・] "DisplayName"="先生っ！　シてあげる" "UninstallString"="c:\\Program Files (x86)\\桃色劇場\\先生っ！　シてあげる\\UNINST.EXE" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\S*t*u*d*i*o*ｪ尻`\ﾍdﾃ_S・] "InstalledFolder"="c:\\Studio邪恋\\操心術０" . Completion time: 2011-06-06 07:46:56 ComboFix-quarantined-files.txt 2011-06-06 12:46 ComboFix2.txt 2011-06-06 05:18 ComboFix3.txt 2011-06-05 18:52 . Pre-Run: 95,761,735,680 bytes free Post-Run: 95,655,804,928 bytes free . - - End Of File - - 37E1283770E6894CBCCE489574524BF2

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI