Spyware / Malware / Virus Removal

Missing documents and hijack log

41 min read

Looking for the outcome? Ask AI

Gary R

Post #16April 5, 2007, 7:26 PM UTC

Hi stephen, OK about the file, looks like its not there. McAfee's probably blocking the Bullguard removal, we'll deal with it in due course. Meanwhile I'll wait for the Kaspersky log and the rest of the GMER log.

lorna

Post #17April 5, 2007, 9:57 PM UTC

KASPERSKY ONLINE SCANNER REPORT Thursday, April 05, 2007 10:37:27 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 5/04/2007 Kaspersky Anti-Virus database records: 291975 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ Scan Statistics Total number of scanned objects 94824 Number of viruses found 0 Number of infected objects 0 / 0 Number of suspicious objects 0 Duration of the scan process 01:11:22 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\BOPDATA\_Date-20070405_Time-185537062_EnterceptExceptions.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\BOPDATA\_Date-20070405_Time-185537062_EnterceptRules.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\Agent_OX163JXORENX8MZ.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\Common Framework\Db\PrdMgr_OX163JXORENX8MZ.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\History\History.IE5\MSHist012007040520070406\index.dat Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Temp\~DF58FC.tmp Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Temp\~DF5913.tmp Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Temp\~DFFBF9.tmp Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped C:\Program Files\BT Broadband Basic Help\log\mpbtn.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\OX163JXORENX8MZ.ldb Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{3FDC23A7-D4B4-4265-9191-796CA64BF8DD}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\default Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\default.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\software Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\software.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\system Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\system.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\ZLT078f1.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

lorna

Post #18April 5, 2007, 10:01 PM UTC

Gary, This is the rest of the GNMR log.Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F6876390] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [F6876390] vsdatant.sys Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE F1AD9C8A Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE F1AD67C8 Device \FileSystem\Fastfat \Fat IRP_MJ_READ F1AD260A Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE F1AD2AED Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION F1ADD958 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION F1AE0821 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA F1AE938A Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA F1AE8D49 Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS F1AE2BBE Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION F1AE3331 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION F1AF14F4 Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL F1AD9B37 Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL F1AD5948 Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL F1ADF46B Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN F1AF079D Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL F1AEFC4A Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP F1AD62FD Device \FileSystem\Fastfat \Fat IRP_MJ_PNP F1AF01DB Device \FileSystem\Fastfat \Fat FastIoCheckIfPossible F1AEB1F9 —- EOF - GMER 1.0.12 —- All my own work! Lorna

Gary R

Post #19April 6, 2007, 7:55 AM UTC

OK, all your scans have come back clean.

The entries in your GMER log are caused by your Firewall (vsdatant is the driver for Zone Alarm) and your Anti-Virus (EntApi.dll is part of McAfee), no signs of any Rootkit activity.

The Kaspersky findings are mostly dat and log files created by legit processes on your computer, they're flagged because they can't be scanned because their parent process is active thus are marked as "locked".

There's a couple of locked Temp files which I can't find info for, I'd like to know what the parent process is.

Download Unlocker and install it to your computer.

Navigate to C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Temp\~DF58FC.tmp (or any file there with the DF****.tmp format)
Right click on it and from the right click menu click on Unlocker.
A Window will appear. Note the Process and Process path which is displayed.
Send me that information please.
Do not attempt to use Unlocker to unlock the file.
Exit out of Unlocker.

It will probably turn out to be your Anti-Virus or something equally inoquous, but better to be safe.

Can't think of any reason why you're losing files, certainly we've not managed to find any Malware reasons for their disappearance so far, but it would be sensible to ensure you've got your files backed up.

Could be you've got some kind of Hard Disk problems and these are preliminary symptoms, but they're outside of my experience.

As for the unremovable HJT entry.

It's most probable that McAfee is preventing its removal. You need to go offline, disable the real-time protection features of McAfee, then try removing the Bullguard entry with HJT.

I don't use McAfee, so can't instruct you how to disable the particular version of their software that you may have. If you don't know how to do it let me know and I'll see if one of the other helpers has details (let me know which version you have installed if you do).

lorna

Post #20April 6, 2007, 12:17 PM UTC

Hi Gary, Dowloaded the unlocker but no sign of the DF tmp files, have searched all places I think. Any idea why all our documents now have this big OX code after them? Thank you.

Gary R

Post #21April 6, 2007, 2:11 PM UTC

Hi Lorna,

The files will be in the location I gave.

C:\Documents and Settings\Lorna Caswell.OX163JXORENX8MZ\Local Settings\Temp

However the folder will be hidden unless you do the following (sorry I thought I'd asked you to do this earlier).

Make sure that you can see hidden files and folders.

Click Start.
Click My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Click Yes to confirm.
Uncheck the Hide file extensions for known file types.
Uncheck Hide protected operating system files a pop up will appear, answer Yes
Click OK.

Search manually rather than use the Search engine that comes with Windows.

If the files are not present don't worry the parent programme has probably deleted them (as it should), and they were just present when Kaspersky was doing its scan, I'm just being as thorough as I can.

Don't know why you're getting the OX163JXORENX8MZ hoped we'd find something with all the scans we've run. I've never come across anything like it before, I'm going to have to refer and see if any of my colleagues knows about it.

Are you still losing files?

What sort of files are the ones that are disappearing (text, pictures etc.) and are they related to any particular programme?

Have you backed up your "good" files? If not do so.

pumpkinpie

Post #22April 6, 2007, 7:29 PM UTC

Hi Gary, Stephen again. You had said to view hidden files and folders, perhaps I just missed them. Anyway, I called my Mum who found one, DF96E7.tmp however she tells me the unlocker said no locking handle found although unlocker can help you deal with the object. I asked about process and process path but she said there was nowt else. Her folders appear to have deserted her documents, she found them in docs and settings and could use them for a while but most are now empty. Don't know if this helps. Many thanks.

Gary R

Post #23April 6, 2007, 7:33 PM UTC last edited April 6, 2007, 7:35 PM UTC

Hi lorna,

Had a discussion with some of my colleagues, and you seem to have a fairly unique problem, certainly none of them has any direct experience of a problem like yours, however they have given me a few suggestions towards trying to discover what the problem is.

OK, lets see if we can see if the number is connected to your computer.

Download RegSearch by Bobbi Flekman.

Create a folder in your C: drive C:\Regsearch, and extract all the files from the zip archive into that folder.
Double click regsearch.exe to launch the programme.
Copy/Paste the following into the Search Box OX163JXORENX8MZ.
Click OK.

Regsearch will now search your Registry for the required strings, when it is finished it will open a Notepad file RegSearch.txt, saved to the Regsearch folder. (Note: It will take some time for the scan to complete, usually between 15-30 mins, but possibly longer dependant upon the number of entries in your registry).

Copy/Paste that file into your next post please.

lorna

Post #24April 7, 2007, 10:46 AM UTC

Hi Gary, This exercise took less than a minute. Here is the result. Lorna Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.2.0 ; Results at 07/04/2007 11:41:26 for strings: ; 'ox163jxorenx8mz' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\BVRP Software\Classic PhoneTools\PhoneBook\Settings] "StartUpFilePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Address Book\\Lorna Caswell.wab" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f750201-1362-4815-a476-88533de61d0c}\InprocServer32] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f750201-1362-4815-a476-88533de61d0c}\ToolboxBitmap32] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll, 101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\Update\6.0\Preferences\Components\Setup:6.0\Dir0] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Accessories\\Entertainment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\Update\6.0\Preferences\Components\Setup:6.0\File6] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Accessories\\Entertainment\\RealPlayer.lnk" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F750250-1362-4815-A476-88533DE61D0C}\2.0\0\win32] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F750250-1362-4815-A476-88533DE61D0C}\2.0\HELPDIR] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent] "OldName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\hijackthis.exe" "Path"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DocFolderPaths] "Lorna Caswell"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "John Caswell"="C:\\Documents and Settings\\John Caswell.OX163JXORENX8MZ\\My Documents" "GRANDCHILDREN"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\My Documents" "Cat Club"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders] "Personal"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints\GRANDCHILDREN] "PictureSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Aviemore 2003\\Picture 111.jpg" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints\Lorna Caswell] "PictureSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Ceres, Jen and David 05\\DSCN1046.JPG" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Start Menu\\Programs\\Acclaim Entertainment\\"="1" "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Start Menu\\Programs\\Acclaim Entertainment\\Fur Fighters Demo\\"="" "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Application Data\\Microsoft\\Installer\\{2DA948A2-4FF9-44C2-BDC8-7A0EC9E5D415}\\"="" "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Application Data\\Microsoft\\Installer\\"="" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\"="" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06E25E96337B3D1108E8000CF43A92AA] "00000000000000000000000000000000"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Works\\Portfolio\\Sample.wsb" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5DDEAD35CE684A5489877D118DCB2C98\InstallProperties] "InstallSource"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Desktop\\MC3\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\08F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\18F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\easyupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\28F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\liborca.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\38F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\liborca_comm.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\48F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\ofxml.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\58F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\ofutils.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Products\00F73955B96A9404D8A3C1779247B2F6\InstallProperties] "InstallSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache2" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache3" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache4" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis] "UninstallString"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\HijackThis.exe /uninstall" "DisplayIcon"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\HijackThis.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{53DAEDD5-86EC-45A4-9878-D711D8BCC289}] "InstallSource"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Desktop\\MC3\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53DAEDD5-86EC-45A4-9878-D711D8BCC289}] "InstallSource"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Desktop\\MC3\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{55937F00-A69B-4049-8D3A-1C7729742B6F}] "InstallSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Canon S330\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\Canon S330" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" "url"="http://ox163jxorenx8mz/" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\CAPTURE FAX BVRP\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\CAPTURE FAX BVRP" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "DefaultDomainName"="OX163JXORENX8MZ" "AltDefaultDomainName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SOFTWARE\Motive\Asst] "EPID"="ox163jxorenx8mz;405d328241a5a32e000f03c0" [HKEY_LOCAL_MACHINE\SOFTWARE\Motive\Telco\btbb\Prefs] "ContactKey"="ox163jxorenx8mz;405d328241a5a32e000f03c0" [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield] "szLastScanned"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers\Canon S330\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\Canon S330" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" "url"="http://ox163jxorenx8mz/" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers\CAPTURE FAX BVRP\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\CAPTURE FAX BVRP" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\hivelist] "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\NTUSER.DAT" "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004_Classes"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters] "NV Hostname"="ox163jxorenx8mz" "Hostname"="ox163jxorenx8mz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\ComputerName\ComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters] "NV Hostname"="ox163jxorenx8mz" "Hostname"="ox163jxorenx8mz" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\Canon S330\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\Canon S330" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" "url"="http://ox163jxorenx8mz/" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\CAPTURE FAX BVRP\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\CAPTURE FAX BVRP" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist] "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\NTUSER.DAT" "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004_Classes"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] "NV Hostname"="ox163jxorenx8mz" "Hostname"="ox163jxorenx8mz" [HKEY_CURRENT_USER\Control Panel\Desktop] "OriginalWallpaper"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Wallpaper1.bmp" [HKEY_CURRENT_USER\Software\BVRP Software\Classic PhoneTools\PhoneBook\Settings] "OpenedFile"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Address Book\\Lorna Caswell.wab" [HKEY_CURRENT_USER\Software\Kodak\GallerySetup] "LivePool"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup" "Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb" "Root"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software" [HKEY_CURRENT_USER\Software\Kodak Gallery\Easy Upload\2.0] "FileOpenStartDirectory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding" [HKEY_CURRENT_USER\Software\Microsoft\GDIPlus] "FontCachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Save Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\" [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentFileList] "File0"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Photo\\MPEGI VCD\\NTSC\\Tutorial.mpg" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Photo\\Children03.wav" "File3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\Sebastian_Kehl_popout1.wmv" "File4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\koty.wmv" "File5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\youaresobeautiful.wmv" "File6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\copper_clappers.wmv" "File7"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\massage.WMV" "File8"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\MMERGE0.wmv" [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences] "TrackFoldersDirectories0"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Videos" [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Setup\CreatedLinks] "Shortcut2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Accessories\\Entertainment\\Windows Media Player.lnk" "Shortcut3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Windows Media Player.lnk" "Shortcut4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Windows Media Player.lnk" [HKEY_CURRENT_USER\Software\Microsoft\MovieMaker] "Collections Path"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Movie Maker\\Windows Movie Maker.COL" "Import Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\" "Record Path"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Videos\\" [HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook] "Machine Name"="OX163JXORENX8MZ" [HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Journal] "Outlook Item Log File"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Outlook\\outitems.log" "Item Log File"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Outlook\\offitems.log" [HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security] "OutlookSecureTempFolder"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\" [HKEY_CURRENT_USER\Software\Microsoft\Office\Common] "FontBmpCache"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Office\\fbc8.tmp" [HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Address Book\\Lorna Caswell.wab" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List] "File1"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Ralph and Mabs.jpg" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\The Hall.JPG" "File3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\The Hall.jpg" "File4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Anniversaries\\Ceres\\Picture 203.jpg" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\My Documents.lnk" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\updatecdr4_53_71.exe" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\GMER log.txt" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\conservatory shot.jpg" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\hijackthis.log" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\SDFix.exe" "h"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\scan.html" "i"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\desktop.ini" "j"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\avg75free_446a965.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\doc] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\test questions.doc" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Standing Order2.doc" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Standing Order.doc" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\SUPER JUICES.doc" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\website copy.doc" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning\\LiveDrvPack_Patch.exe" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning\\zlsSetup_60_667_000.exe" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\zlsSetup_61_744_001_en.exe" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\zlsSetup_65_731_000_en.exe" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\KODAK EASYSHARE Gallery Upload Software, V2.0.exe" "f"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\avg75free_446a965.exe" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\updatecdr4_53_71.exe" "h"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\SDFix.exe" "j"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning\\LiveDrvUni-Pack(ENG).exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\htm] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Zone Labs ZoneAlarm Download.htm" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Kodak Alison S & B's Wedding.htm" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\html] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\scan.html" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\ini] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\desktop.ini" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\jpg] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\conservatory shot.jpg" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Photo 1.JPG" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Ceres wall.jpg" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1377.JPG" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Photo 3.JPG" "f"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Photo 4.JPG" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1373.JPG" "h"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1375.JPG" "i"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1376.JPG" "j"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1383.JPG" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\lnk] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\My Documents.lnk" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\hijackthis.log" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mht] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Home insurance Policy documents Policy summary - Tesco Personal Finance.mht" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\PDF] "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\orderform.pdf" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\PPP] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Newsletter - 2005.PPP" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Cat Club Newsletter 2005.PPP" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\TXT] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\adawarelog.TXT" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\GMER log.txt" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\WDB] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\Membership\\MEM04.WDB" "b"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\2005.wdb" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\wps] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Meeting 24 Oct 04.wps" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Begging Letter Labels.wps" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Cauliflower Soup.wps" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Car Ins Change.wps" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change2.wps" "f"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change3.wps" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change3 Bonus Transfer.wps" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\xlr] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\Membership\\Life04.xlr" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders] "AppData"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data" "Cookies"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Cookies" "Desktop"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop" "Favorites"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Favorites" "NetHood"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\NetHood" "Personal"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "PrintHood"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\PrintHood" "Recent"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Recent" "SendTo"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\SendTo" "Start Menu"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu" "Templates"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Templates" "Programs"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs" "Startup"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Startup" "Local Settings"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings" "Local AppData"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data" "Cache"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files" "History"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\History" "My Pictures"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures" "My Music"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Music" "Administrative Tools"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Administrative Tools" "CD Burning"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning" "My Video"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Videos" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9863F141-7A33-4c9a-A5F2-96996461B216}] "DisplayIcon"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb\\Setup.exe,0" "UninstallString"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb\\Setup.exe /APR-REMOVE" "ModifyPath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb\\Setup.exe /APR-MODIFY" [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam] @="OX163JXORENX8MZ" [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\U3\\000018451960ADAB\\LaunchPad.exe"="LaunchPa Application" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\U3\\000018451960ADAB\\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\\Exec\\master.exe"="My Flash Application" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\V71V3LSW\\avgas-setup-7.5.0.50[1].exe"="avgas-setup-7.5.0.50[1]" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\FileFind[1]\\FileFind.exe"="FileFind" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\gmer.exe"="gmer" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\HijackThis.exe"="HijackThis" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\97FZ5LCE\\unlocker1.8.5[1].exe"="unlocker1.8.5[1]" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\regsearch\\regsearch.exe"="regsearch" [HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\General] "ComputerName"="OX163JXORENX8MZ" [HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace] "LocalBase"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNS.XML" "DTDFile"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNS.DTD" "LocalDelta"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNSD.XML" "RemoteDelta"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNSR.XML" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\050c945818305643a479e26563984415] "001e6700"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Outlook\\Outlook.pst" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046] "001e0324"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Outlook\\archive.pst" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\47f89adf8c484e4fbbf39e02a36087db] "001e6700"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Outlook\\archive.pst" [HKEY_CURRENT_USER\Software\Microsoft\Works\7.0\Common\Templates] "TemplateDirectory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Template" [HKEY_CURRENT_USER\Software\Microsoft\Works\7.0\WordProcessor\Temp] "Open File Name"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change2.wps" [HKEY_CURRENT_USER\Software\Newsoft\Quick Path\Selected Path] "DESTINATION PATH"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" [HKEY_CURRENT_USER\Software\Newsoft Folder Selector\Quick Path\Selected Path] "Path2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "Path3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\ImageFolio" "Path4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Data Sources" "Path5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\FINANCIALS" "Path6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\ImageFolio\\Samples" "Path7"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Photo" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\filemenu] "filemenu4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\V71V3LSW\\FileFind[1].zip" "filemenu5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\R58XK7K3\\gmer[1].zip" "filemenu6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\TF3FTDSA\\hijackthis[1].zip" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\select] "select2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\WIZARD] "ExtractTo"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\WIZDIR] "WIZDIR2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "WIZDIR5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\V71V3LSW" "WIZDIR6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\R58XK7K3" "WIZDIR7"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\TF3FTDSA" [HKEY_CURRENT_USER\Software\Nikon\Common\Temp] "TempFolder"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temp" [HKEY_CURRENT_USER\Software\Nikon\Nikon View\Acquire\Destination] "Folder"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures" [HKEY_CURRENT_USER\Software\Nikon\NikonViewEditor\3.0\Recent File List] "File1"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Anniversaries\\Ena's 90th Birthday\\DSCN1530.JPG" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Img0011\\DSCN1389.JPG" "File3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Img0010\\DSCN1344.JPG" "File4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Img0010\\DSCN1345.JPG" [HKEY_CURRENT_USER\Software\Serif\PagePlus\6.0\Directories] "PPPFileDir"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" [HKEY_CURRENT_USER\Software\Serif\PagePlus\6.0\Recent PPP List] "File1"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Cat Club Newsletter 2005.PPP" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Newsletter - 2005.PPP" [HKEY_CURRENT_USER\Volatile Environment] "LOGONSERVER"="\\\\OX163JXORENX8MZ" "APPDATA"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data" "HOMEPATH"="\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ" ; End Of The Log…

Gary R

Post #25April 7, 2007, 2:38 PM UTC

Hi lorna, That's quite a log. OK, gonna have to ask some of the Registry experts to look this over, there's quite a bit going on that I'm not familiar with, so could be a while before I get back to you. I'll post back here as soon as we've got anything to tell you.

Gary R

Post #26April 7, 2007, 8:13 PM UTC

Hi lorna,

There are signs of a worm http://www.sophos.com/virusinfo/analyses/w32nyxemc.html in your registry settings, this one deletes files. Don't know why it didn't show in earlier scans, may be just remnants of some earlier infection but needs to be removed.

Download NYXEMGUI.COM to your Desktop.
Double click it to run it.
Click Go.

This only looks like part of the problem, and I'm still waiting for expert advice on the other findings in your registry log.

After you've run the programme can you do a further regsearch using the same procedure and settings as before, so we can see what has been removed and what remains to be attended to.

Please post the log back here.

pumpkinpie

Post #27April 7, 2007, 9:28 PM UTC

Gary excellent stuff, I'm popping over to my parents tomorrow for easter, I'll make sure this gets done tomorrow and reply. Happy easter to you. PS this investigation is helping my Mum's PC skills!

Gary R

Post #28April 7, 2007, 9:50 PM UTC

Happy Easter to you all as well Stephen, talk to you tomorrow.

lorna

Post #29April 8, 2007, 10:57 AM UTC last edited April 9, 2007, 10:10 AM UTC

Hi Gary, here's another log, Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.2.0 ; Results at 08/04/2007 11:53:33 for strings: ; 'ox163jxorenx8mz' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\BVRP Software\Classic PhoneTools\PhoneBook\Settings] "StartUpFilePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Address Book\\Lorna Caswell.wab" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f750201-1362-4815-a476-88533de61d0c}\InprocServer32] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f750201-1362-4815-a476-88533de61d0c}\ToolboxBitmap32] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll, 101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\Update\6.0\Preferences\Components\Setup:6.0\Dir0] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Accessories\\Entertainment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\RealNetworks\Update\6.0\Preferences\Components\Setup:6.0\File6] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Accessories\\Entertainment\\RealPlayer.lnk" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F750250-1362-4815-A476-88533DE61D0C}\2.0\0\win32] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F750250-1362-4815-A476-88533DE61D0C}\2.0\HELPDIR] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent] "OldName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\hijackthis.exe" "Path"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DocFolderPaths] "Lorna Caswell"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "John Caswell"="C:\\Documents and Settings\\John Caswell.OX163JXORENX8MZ\\My Documents" "GRANDCHILDREN"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\My Documents" "Cat Club"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders] "Personal"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints\GRANDCHILDREN] "PictureSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Aviemore 2003\\Picture 111.jpg" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints\Lorna Caswell] "PictureSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Ceres, Jen and David 05\\DSCN1046.JPG" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Start Menu\\Programs\\Acclaim Entertainment\\"="1" "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Start Menu\\Programs\\Acclaim Entertainment\\Fur Fighters Demo\\"="" "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Application Data\\Microsoft\\Installer\\{2DA948A2-4FF9-44C2-BDC8-7A0EC9E5D415}\\"="" "C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Application Data\\Microsoft\\Installer\\"="" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\"="" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06E25E96337B3D1108E8000CF43A92AA] "00000000000000000000000000000000"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Works\\Portfolio\\Sample.wsb" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5DDEAD35CE684A5489877D118DCB2C98\InstallProperties] "InstallSource"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Desktop\\MC3\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\08F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\axofupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\18F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\easyupld_201-23.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\28F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\liborca.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\38F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\liborca_comm.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\48F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\ofxml.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Components\58F73955B96A9404D8A3C1779247B2F6] "00F73955B96A9404D8A3C1779247B2F6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software\\Easy Upload\\ofutils.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1957994488-1644491937-839522115-1004\Products\00F73955B96A9404D8A3C1779247B2F6\InstallProperties] "InstallSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache2" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache3" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4] "CachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\Cache4" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HijackThis] "UninstallString"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\HijackThis.exe /uninstall" "DisplayIcon"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\HijackThis.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{53DAEDD5-86EC-45A4-9878-D711D8BCC289}] "InstallSource"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Desktop\\MC3\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53DAEDD5-86EC-45A4-9878-D711D8BCC289}] "InstallSource"="C:\\Documents and Settings\\GRANDCHILDREN.OX163JXORENX8MZ\\Desktop\\MC3\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{55937F00-A69B-4049-8D3A-1C7729742B6F}] "InstallSource"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Canon S330\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\Canon S330" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" "url"="http://ox163jxorenx8mz/" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\CAPTURE FAX BVRP\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\CAPTURE FAX BVRP" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "DefaultDomainName"="OX163JXORENX8MZ" "AltDefaultDomainName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SOFTWARE\Motive\Asst] "EPID"="ox163jxorenx8mz;405d328241a5a32e000f03c0" [HKEY_LOCAL_MACHINE\SOFTWARE\Motive\Telco\btbb\Prefs] "ContactKey"="ox163jxorenx8mz;405d328241a5a32e000f03c0" [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield] "szLastScanned"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\index.dat" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers\Canon S330\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\Canon S330" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" "url"="http://ox163jxorenx8mz/" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers\CAPTURE FAX BVRP\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\CAPTURE FAX BVRP" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\hivelist] "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\NTUSER.DAT" "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004_Classes"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters] "NV Hostname"="ox163jxorenx8mz" "Hostname"="ox163jxorenx8mz" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\ComputerName\ComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters] "NV Hostname"="ox163jxorenx8mz" "Hostname"="ox163jxorenx8mz" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\Canon S330\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\Canon S330" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" "url"="http://ox163jxorenx8mz/" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\CAPTURE FAX BVRP\DsSpooler] "uNCName"="\\\\ox163jxorenx8mz\\CAPTURE FAX BVRP" "serverName"="ox163jxorenx8mz" "shortServerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist] "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\NTUSER.DAT" "\\REGISTRY\\USER\\S-1-5-21-1957994488-1644491937-839522115-1004_Classes"="\\Device\\HarddiskVolume2\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog] "ComputerName"="OX163JXORENX8MZ" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] "NV Hostname"="ox163jxorenx8mz" "Hostname"="ox163jxorenx8mz" [HKEY_CURRENT_USER\Control Panel\Desktop] "OriginalWallpaper"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Wallpaper1.bmp" [HKEY_CURRENT_USER\Software\BVRP Software\Classic PhoneTools\PhoneBook\Settings] "OpenedFile"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Address Book\\Lorna Caswell.wab" [HKEY_CURRENT_USER\Software\Kodak\GallerySetup] "LivePool"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup" "Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb" "Root"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Kodak EasyShare Gallery Software" [HKEY_CURRENT_USER\Software\Kodak Gallery\Easy Upload\2.0] "FileOpenStartDirectory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding" [HKEY_CURRENT_USER\Software\Microsoft\GDIPlus] "FontCachePath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer] "Download Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Save Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\" [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentFileList] "File0"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Photo\\MPEGI VCD\\NTSC\\Tutorial.mpg" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Photo\\Children03.wav" "File3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\Sebastian_Kehl_popout1.wmv" "File4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\koty.wmv" "File5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\youaresobeautiful.wmv" "File6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\copper_clappers.wmv" "File7"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\massage.WMV" "File8"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\MMERGE0.wmv" [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Preferences] "TrackFoldersDirectories0"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Videos" [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Setup\CreatedLinks] "Shortcut2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Accessories\\Entertainment\\Windows Media Player.lnk" "Shortcut3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Windows Media Player.lnk" "Shortcut4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Windows Media Player.lnk" [HKEY_CURRENT_USER\Software\Microsoft\MovieMaker] "Collections Path"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Movie Maker\\Windows Movie Maker.COL" "Import Directory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\" "Record Path"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Videos\\" [HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook] "Machine Name"="OX163JXORENX8MZ" [HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Journal] "Outlook Item Log File"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Outlook\\outitems.log" "Item Log File"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Outlook\\offitems.log" [HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security] "OutlookSecureTempFolder"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\" [HKEY_CURRENT_USER\Software\Microsoft\Office\Common] "FontBmpCache"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Office\\fbc8.tmp" [HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name] @="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Microsoft\\Address Book\\Lorna Caswell.wab" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List] "File1"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Ralph and Mabs.jpg" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\The Hall.JPG" "File3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\OLK15\\The Hall.jpg" "File4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Anniversaries\\Ceres\\Picture 203.jpg" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\nyxemgui.com" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\updatecdr4_53_71.exe" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\GMER log.txt" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\conservatory shot.jpg" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\hijackthis.log" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\SDFix.exe" "h"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\scan.html" "i"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\desktop.ini" "j"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\avg75free_446a965.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\com] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\nyxemgui.com" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\doc] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\test questions.doc" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Standing Order2.doc" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Standing Order.doc" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\SUPER JUICES.doc" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\website copy.doc" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning\\LiveDrvPack_Patch.exe" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning\\zlsSetup_60_667_000.exe" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\zlsSetup_61_744_001_en.exe" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\zlsSetup_65_731_000_en.exe" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\KODAK EASYSHARE Gallery Upload Software, V2.0.exe" "f"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\avg75free_446a965.exe" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\updatecdr4_53_71.exe" "h"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\SDFix.exe" "j"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning\\LiveDrvUni-Pack(ENG).exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\htm] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Zone Labs ZoneAlarm Download.htm" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Kodak Alison S & B's Wedding.htm" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\html] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\scan.html" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\ini] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\desktop.ini" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\jpg] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\conservatory shot.jpg" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Photo 1.JPG" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Ceres wall.jpg" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1377.JPG" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Photo 3.JPG" "f"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Photo 4.JPG" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1373.JPG" "h"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1375.JPG" "i"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1376.JPG" "j"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Wedding SB\\Wedding\\DSCN1383.JPG" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\lnk] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\My Documents.lnk" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\log] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\hijackthis.log" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mht] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Home insurance Policy documents Policy summary - Tesco Personal Finance.mht" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\PDF] "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\orderform.pdf" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\PPP] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Newsletter - 2005.PPP" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Cat Club Newsletter 2005.PPP" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\TXT] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\adawarelog.TXT" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\GMER log.txt" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\WDB] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\Membership\\MEM04.WDB" "b"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\2005.wdb" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\wps] "a"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Meeting 24 Oct 04.wps" "b"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Begging Letter Labels.wps" "c"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Cauliflower Soup.wps" "d"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Car Ins Change.wps" "e"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change2.wps" "f"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change3.wps" "g"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change3 Bonus Transfer.wps" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\xlr] "a"="C:\\Documents and Settings\\Cat Club.OX163JXORENX8MZ\\My Documents\\Membership\\Life04.xlr" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders] "AppData"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data" "Cookies"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Cookies" "Desktop"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop" "Favorites"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Favorites" "NetHood"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\NetHood" "Personal"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "PrintHood"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\PrintHood" "Recent"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Recent" "SendTo"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\SendTo" "Start Menu"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu" "Templates"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Templates" "Programs"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs" "Startup"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Startup" "Local Settings"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings" "Local AppData"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data" "Cache"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files" "History"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\History" "My Pictures"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures" "My Music"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Music" "Administrative Tools"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Start Menu\\Programs\\Administrative Tools" "CD Burning"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\CD Burning" "My Video"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Videos" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9863F141-7A33-4c9a-A5F2-96996461B216}] "DisplayIcon"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb\\Setup.exe,0" "UninstallString"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb\\Setup.exe /APR-REMOVE" "ModifyPath"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\KodakGallery\\EasyShareSetup\\$SETUP_140007_28a1bb\\Setup.exe /APR-MODIFY" [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam] @="OX163JXORENX8MZ" [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\U3\\000018451960ADAB\\LaunchPad.exe"="LaunchPa Application" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\U3\\000018451960ADAB\\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\\Exec\\master.exe"="My Flash Application" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\V71V3LSW\\avgas-setup-7.5.0.50[1].exe"="avgas-setup-7.5.0.50[1]" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\FileFind[1]\\FileFind.exe"="FileFind" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\gmer.exe"="gmer" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\hijackthis[1]\\HijackThis.exe"="HijackThis" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\97FZ5LCE\\unlocker1.8.5[1].exe"="unlocker1.8.5[1]" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped\\regsearch\\regsearch.exe"="regsearch" "C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop\\nyxemgui.com"="nyxemgui" [HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\General] "ComputerName"="OX163JXORENX8MZ" [HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Namespace] "LocalBase"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNS.XML" "DTDFile"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNS.DTD" "LocalDelta"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNSD.XML" "RemoteDelta"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Windows Media\\10.0\\WMSDKNSR.XML" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\050c945818305643a479e26563984415] "001e6700"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Outlook\\Outlook.pst" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046] "001e0324"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Outlook\\archive.pst" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\47f89adf8c484e4fbbf39e02a36087db] "001e6700"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Application Data\\Microsoft\\Outlook\\archive.pst" [HKEY_CURRENT_USER\Software\Microsoft\Works\7.0\Common\Templates] "TemplateDirectory"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data\\Template" [HKEY_CURRENT_USER\Software\Microsoft\Works\7.0\WordProcessor\Temp] "Open File Name"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\CARS\\Car Ins Change2.wps" [HKEY_CURRENT_USER\Software\Newsoft\Quick Path\Selected Path] "DESTINATION PATH"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" [HKEY_CURRENT_USER\Software\Newsoft Folder Selector\Quick Path\Selected Path] "Path2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "Path3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\ImageFolio" "Path4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Data Sources" "Path5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\FINANCIALS" "Path6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\ImageFolio\\Samples" "Path7"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Photo" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\filemenu] "filemenu4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\V71V3LSW\\FileFind[1].zip" "filemenu5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\R58XK7K3\\gmer[1].zip" "filemenu6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\TF3FTDSA\\hijackthis[1].zip" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\select] "select2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Desktop" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\WIZARD] "ExtractTo"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Unzipped" [HKEY_CURRENT_USER\Software\Nico Mak Computing\WinZip\WIZDIR] "WIZDIR2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" "WIZDIR5"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\V71V3LSW" "WIZDIR6"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\R58XK7K3" "WIZDIR7"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temporary Internet Files\\Content.IE5\\TF3FTDSA" [HKEY_CURRENT_USER\Software\Nikon\Common\Temp] "TempFolder"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Local Settings\\Temp" [HKEY_CURRENT_USER\Software\Nikon\Nikon View\Acquire\Destination] "Folder"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures" [HKEY_CURRENT_USER\Software\Nikon\NikonViewEditor\3.0\Recent File List] "File1"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Anniversaries\\Ena's 90th Birthday\\DSCN1530.JPG" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Img0011\\DSCN1389.JPG" "File3"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Img0010\\DSCN1344.JPG" "File4"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\My Pictures\\Img0010\\DSCN1345.JPG" [HKEY_CURRENT_USER\Software\Serif\PagePlus\6.0\Directories] "PPPFileDir"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents" [HKEY_CURRENT_USER\Software\Serif\PagePlus\6.0\Recent PPP List] "File1"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Cat Club Newsletter 2005.PPP" "File2"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\My Documents\\Newsletter - 2005.PPP" [HKEY_CURRENT_USER\Volatile Environment] "LOGONSERVER"="\\\\OX163JXORENX8MZ" "APPDATA"="C:\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ\\Application Data" "HOMEPATH"="\\Documents and Settings\\Lorna Caswell.OX163JXORENX8MZ" ; End Of The Log… The nyxemgui came back clean. Thanks again Lorna and Stephen

Gary R

Post #30April 9, 2007, 7:14 AM UTC last edited April 9, 2007, 10:35 AM UTC

Hi lorna,

I'd like to look at details of some Registry Keys.

Click Start > Run then type Notepad click OK.
This will open an empty Notepad file.
Copy/Paste the text in the box below into it.

@ echo off

reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" >> "%userprofile%"\Desktop\UserShellFolders.txt

reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" >> "%userprofile%"\Desktop\ShellFolders.txt

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" >> "%userprofile%"\Desktop\SessionEnvironment.txt

reg query "HKEY_CURRENT_USER\Environment" >> "%userprofile%"\Desktop\Environment.txt

Notepad.exe %userprofile%\Desktop\UserShellFolders.txt
Notepad.exe %userprofile%\Desktop\ShellFolders.txt
Notepad.exe %userprofile%\Desktop\SessionEnvironment.txt
Notepad.exe %userprofile%\Desktop\Environment.txt

Click on Format and check Wordwrap is unchecked.
Save as RegQuery.bat Save as file type All Files or it won't work.
Now double click on RegQuery.bat to run it.
4 files UserShellFolders.txt, ShellFolders.txt, SessionEnvironment.txt, Environment.txt should be open on your Desktop (they'll be under one another so it'll probably just look like one).
Copy/Paste the contents of those files into your next post please.

You can delete the files and also RegQuery.bat after you've posted the details.

NOW

Download Deckard's System Scanner (DSS) to your Desktop. (Note: You must be logged onto an account with administrator privileges).

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy/Paste the contents of main.txt and extra.txt into your next post as well please.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Missing documents and hijack log

✨ Ask AI

Ask AI