Smittad av Antivirus 2008 Xp

19 augusti, 2008

Tack Anjuna!

Där nämns inget om fildelning i alla fall.

19 augusti, 2008

tack anjuna! :thumbsup:

20 augusti, 2008

här kommer avenger loggen:

[log]

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

File "C:\srdyxdh.exe" deleted successfully.

File "C:\WINDOWS\system32\pla.ax" deleted successfully.

File "C:\WINDOWS\system32\nvrsul32.dll" deleted successfully.

File "C:\WINDOWS\system32\__c00675A2.dat" deleted successfully.

File "C:\WINDOWS\system32\sgm.c" deleted successfully.

File "C:\WINDOWS\system32\3.fe" deleted successfully.

File "C:\WINDOWS\system32\cmgmk.ak" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[/log]

När jag startat om datorn (de som avenger gjorde) så fick jag upp ett felmeddelande:

Windows - Ingen disk

Exception Processing message c0000013 Parameters 75b6bf9c 4 75b6bf9c

Först när jag efter några klickanden fick bort meddelandet så gick min trådlösa nätverksmottagare (usb från linksys) igång?

Och i mappen C:\Program Files\apdvbmg finns filen winadmact.dll

20 augusti, 2008

Här är loggen från suspect file:

[log]

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)

System directory: C:\WINDOWS

SystemScan file: C:\Documents and Settings\AdamEkstromBackaholm\Desktop\sys59016.exe

Running in: User mode

Date: 2008-08-20

Time: 12:28:41

Output limited to:

-Recent files

===================== RECENT FILES =====================

Showing files newer than 30 days

----- recent files in C:13-08-2008 21:20:54 2 byte 7 days old -- -2070740813

19-08-2008 15:28:12 (DIR) 0 byte 1 days old -- Bases

19-08-2008 15:36:47 (DIR) 0 byte 1 days old -- Downloads

19-08-2008 19:58:47 (DIR) 0 byte 1 days old -- Kaspersky

19-08-2008 19:58:52 320 byte 1 days old -- vlist.log

20-08-2008 12:05:50 56 byte 0 days old -- xcrashdump.dat

20-08-2008 12:10:01 (DIR) 0 byte 0 days old -- Program Files

20-08-2008 12:10:01 1686 byte 0 days old -- avenger.txt

20-08-2008 12:10:08 (DIR)2145386496 byte 0 days old -- pagefile.sys

20-08-2008 12:10:55 (DIR) 0 byte 0 days old -- Avenger

20-08-2008 12:21:12 (DIR) 0 byte 0 days old -- WINDOWS

20-08-2008 12:21:36 557 byte 0 days old -- test.txt

----- recent files in C:\WINDOWS13-08-2008 17:39:23 349632 byte 7 days old -- setupact.log

13-08-2008 18:01:55 750 byte 7 days old -- win.ini

13-08-2008 18:04:12 (DIR) 0 byte 7 days old -- $NtUninstallKB951066$

13-08-2008 18:04:16 10554 byte 7 days old -- KB951066.log

13-08-2008 18:04:32 20321 byte 7 days old -- KB953838-IE7.log

13-08-2008 18:04:34 (DIR) 0 byte 7 days old -- $NtUninstallKB952287$

13-08-2008 18:04:37 16150 byte 7 days old -- KB952287.log

13-08-2008 18:04:39 (DIR) 0 byte 7 days old -- $NtUninstallKB951072-v2$

13-08-2008 18:04:42 35276 byte 7 days old -- KB951072-v2.log

13-08-2008 18:06:09 (DIR) 0 byte 7 days old -- $NtUninstallKB950974$

13-08-2008 18:06:10 22163 byte 7 days old -- KB950974.log

13-08-2008 18:06:12 (DIR) 0 byte 7 days old -- $NtUninstallKB953839$

13-08-2008 18:06:14 15224 byte 7 days old -- KB953839.log

13-08-2008 18:06:15 (DIR) 0 byte 7 days old -- $hf_mig$

13-08-2008 18:06:16 (DIR) 0 byte 7 days old -- $NtUninstallKB946648$

13-08-2008 18:06:18 16744 byte 7 days old -- KB946648.log

13-08-2008 18:06:18 1374 byte 7 days old -- imsins.BAK

13-08-2008 18:06:20 (DIR) 0 byte 7 days old -- $NtUninstallKB952954$

13-08-2008 18:06:21 131124 byte 7 days old -- updspapi.log

13-08-2008 18:06:22 389858 byte 7 days old -- msmqinst.log

13-08-2008 18:06:22 62532 byte 7 days old -- msgsocm.log

13-08-2008 18:06:22 142082 byte 7 days old -- plusoc.log

13-08-2008 18:06:22 63183 byte 7 days old -- tabletoc.log

13-08-2008 18:06:22 575177 byte 7 days old -- tsoc.log

13-08-2008 18:06:22 68044 byte 7 days old -- ocmsn.log

13-08-2008 18:06:22 231858 byte 7 days old -- netfxocm.log

13-08-2008 18:06:22 252437 byte 7 days old -- ntdtcsetup.log

13-08-2008 18:06:22 597876 byte 7 days old -- ocgen.log

13-08-2008 18:06:22 1379566 byte 7 days old -- iis6.log

13-08-2008 18:06:22 1374 byte 7 days old -- imsins.log

13-08-2008 18:06:22 419094 byte 7 days old -- comsetup.log

13-08-2008 18:06:22 1259798 byte 7 days old -- FaxSetup.log

13-08-2008 18:06:22 (DIR) 0 byte 7 days old -- inf

13-08-2008 18:06:22 22695 byte 7 days old -- KB952954.log

13-08-2008 18:06:23 69507 byte 7 days old -- ehOCGen.log

13-08-2008 18:06:23 150429 byte 7 days old -- MedCtrOC.log

13-08-2008 18:16:27 0 byte 7 days old -- 0.log

13-08-2008 21:21:00 (DIR) 0 byte 7 days old -- Help

18-08-2008 14:31:40 171125 byte 2 days old -- wmsetup.log

18-08-2008 16:54:03 (DIR) 0 byte 2 days old -- Registration

18-08-2008 22:05:57 (DIR) 0 byte 2 days old -- Installer

18-08-2008 23:47:53 (DIR) 0 byte 2 days old -- Tasks

20-08-2008 11:57:20 32438 byte 0 days old -- SchedLgU.Txt

20-08-2008 12:02:00 413858 byte 0 days old -- ntbtlog.txt

20-08-2008 12:10:01 (DIR) 0 byte 0 days old -- system32

20-08-2008 12:10:19 2048 byte 0 days old -- bootstat.dat

20-08-2008 12:10:45 50 byte 0 days old -- wiaservc.log

20-08-2008 12:12:41 1364950 byte 0 days old -- WindowsUpdate.log

20-08-2008 12:13:33 578671 byte 0 days old -- setupapi.log

20-08-2008 12:21:35 (DIR) 0 byte 0 days old -- temp

20-08-2008 12:28:31 (DIR) 0 byte 0 days old -- Prefetch

----- recent files in C:\WINDOWS\Downloaded Program Files

----- recent files in C:\WINDOWS\system

----- recent files in C:\WINDOWS\system3203-08-2008 12:08:13 6692 byte 17 days old -- jupdate-1.6.0_07-b06.log

05-08-2008 20:11:02 15888504 byte 15 days old -- MRT.exe

13-08-2008 18:04:39 609356 byte 7 days old -- TZLog.log

13-08-2008 18:15:10 73451 byte 7 days old -- nvapps.xml

13-08-2008 21:20:51 577536 byte 7 days old -- user32.DLL.bad

13-08-2008 21:26:49 0 byte 7 days old -- 8fb0c462-.txt

13-08-2008 22:11:10 143104 byte 7 days old -- guard32.dll

15-08-2008 10:09:06 1158 byte 5 days old -- wpa.dbl

16-08-2008 12:35:24 (DIR) 0 byte 4 days old -- dllcache

16-08-2008 21:29:03 (DIR) 0 byte 4 days old -- wbem

16-08-2008 21:29:03 507832 byte 4 days old -- PerfStringBackup.INI

16-08-2008 21:29:03 72864 byte 4 days old -- perfc009.dat

16-08-2008 21:29:03 428540 byte 4 days old -- perfh009.dat

19-08-2008 19:02:47 577536 byte 1 days old -- user32.dll

20-08-2008 12:10:01 (DIR) 0 byte 0 days old -- drivers

20-08-2008 12:13:29 (DIR) 0 byte 0 days old -- CatRoot2

----- recent files in C:\WINDOWS\system32\drivers30-07-2008 20:07:52 17144 byte 21 days old -- mbam.sys

30-07-2008 20:07:56 38472 byte 21 days old -- mbamswissarmy.sys

13-08-2008 21:20:55 30976 byte 7 days old -- ipinzkzbpaqkd.sys.bad

13-08-2008 21:20:57 233 byte 7 days old -- atmapi.sys.bad

13-08-2008 21:21:10 9757 byte 7 days old -- str.sys.bad

13-08-2008 22:11:10 87056 byte 7 days old -- cmdguard.sys

13-08-2008 22:11:10 24208 byte 7 days old -- cmdhlp.sys

13-08-2008 22:11:10 79760 byte 7 days old -- inspect.sys

19-08-2008 20:46:09 233 byte 1 days old -- atmapi.sys

----- recent files in C:\WINDOWS\temp20-08-2008 12:10:51 0 byte 0 days old -- T30DebugLogFile.txt

----- recent files in C:\Program Files03-08-2008 12:08:13 (DIR) 0 byte 17 days old -- Java

13-08-2008 18:04:28 (DIR) 0 byte 7 days old -- Internet Explorer

13-08-2008 18:06:17 (DIR) 0 byte 7 days old -- Messenger

13-08-2008 21:52:53 (DIR) 0 byte 7 days old -- Common Files

13-08-2008 21:53:22 (DIR) 0 byte 7 days old -- SUPERAntiSpyware

13-08-2008 22:11:11 (DIR) 0 byte 7 days old -- COMODO

13-08-2008 22:21:02 (DIR) 0 byte 7 days old -- Trend Micro

13-08-2008 22:48:00 (DIR) 0 byte 7 days old -- apdvbmg

15-08-2008 10:23:19 (DIR) 0 byte 5 days old -- Malwarebytes' Anti-Malware

20-08-2008 12:11:40 (DIR) 0 byte 0 days old -- Mozilla Firefox

12-08-2008 23:04:03 (DIR) 0 byte 8 days old -- PhotomatixPro3

----- recent files in C:\Program Files\Common Files13-08-2008 21:52:53 (DIR) 0 byte 7 days old -- Wise Installation Wizard

----- recent files in C:\Documents and Settings\AdamEkstromBackaholm\Application Data29-07-2008 16:57:43 (DIR) 0 byte 22 days old -- Adobe

13-08-2008 21:22:04 (DIR) 0 byte 7 days old -- Uniblue

13-08-2008 21:53:20 (DIR) 0 byte 7 days old -- SUPERAntiSpyware.com

13-08-2008 22:11:13 (DIR) 0 byte 7 days old -- Comodo

15-08-2008 10:23:19 (DIR) 0 byte 5 days old -- Malwarebytes

16-08-2008 22:29:57 (DIR) 0 byte 4 days old -- Hamachi

20-08-2008 12:27:41 (DIR) 0 byte 0 days old -- SiteAdvisor

----- recent files in C:\DOCUME~1\ADAMEK~1\LOCALS~1\Temp13-08-2008 20:50:21 0 byte 7 days old -- Twunk002.MTX

13-08-2008 20:56:16 340 byte 7 days old -- MSI48760.LOG

13-08-2008 21:21:07 32768 byte 7 days old -- twe49.tmp

13-08-2008 21:21:07 517 byte 7 days old -- win4A.tmp

13-08-2008 21:21:16 0 byte 7 days old -- win4C.tmp

13-08-2008 21:21:16 28010 byte 7 days old -- win4B.tmp

13-08-2008 21:21:31 43267 byte 7 days old -- win4D.tmp

13-08-2008 21:21:31 0 byte 7 days old -- win4E.tmp

13-08-2008 21:21:58 141877 byte 7 days old -- win4F.tmp

13-08-2008 21:21:58 0 byte 7 days old -- win50.tmp

13-08-2008 21:22:12 0 byte 7 days old -- win58.tmp

13-08-2008 21:22:12 36394 byte 7 days old -- win51.tmp

13-08-2008 22:06:37 4161 byte 7 days old -- win5B.tmp

15-08-2008 16:12:36 1727 byte 5 days old -- java_install_reg.log

16-08-2008 21:07:35 340 byte 4 days old -- MSIa5225.LOG

18-08-2008 14:14:29 0 byte 2 days old -- IMG3.tmp

18-08-2008 14:40:11 2 byte 2 days old -- PrePict.htm

19-08-2008 14:22:00 4 byte 1 days old -- Twain001.Mtx

19-08-2008 14:22:00 156 byte 1 days old -- Twunk001.MTX

19-08-2008 14:22:30 899 byte 1 days old -- TWAIN.LOG

20-08-2008 12:11:00 (DIR) 0 byte 0 days old -- WPDNSE

20-08-2008 12:11:05 (DIR) 0 byte 0 days old -- WER0aa2.dir00

20-08-2008 12:11:32 16384 byte 0 days old -- ~DFF1E3.tmp

20-08-2008 12:16:00 130363 byte 0 days old -- jusched.log

20-08-2008 12:18:17 (DIR) 0 byte 0 days old -- {DCD3471D-4DDA-4DC2-8B9F-A662D0C362AC}

20-08-2008 12:21:08 4897 byte 0 days old -- DIAGNOSTIC_S2.gif

20-08-2008 12:26:57 0 byte 0 days old -- IMG4.tmp

20-08-2008 12:28:21 (DIR) 0 byte 0 days old -- nsu6.tmp

20-08-2008 12:28:21 16384 byte 0 days old -- ~DFD1F6.tmp

20-08-2008 12:28:21 67 byte 0 days old -- systemscan.ini

==========================================

Scan completed in 0 minutes

End of report

[/log]

20 augusti, 2008

Och i mappen C:\Program Files\apdvbmg finns filen winadmact.dll

Skanna filen på virustotal.

Blir det samma konstigheter om du startar om datorn igen?

Ta bort filen C:\WINDOWS\system32\8fb0c462-.txt

Går det att ta bort alla tmp-filerna i C:\DOCUME~1\ADAMEK~1\LOCALS~1\Temp ? För det är många kvar där som kom samtidigt med infektionen.

20 augusti, 2008

Den här skannern verkar fungera bättre.

Ladda ner OTScanIT till Skrivbordet

http://download.bleepingcomputer.com/oldtimer/OTScanIt.exe

Dubbelklicka på den för att packa upp filerna och då kommer det att skapas en mapp OTScanIt på Skrivbordet.

Stäng alla andra program.

Öppna mappen OTScanIt och dubbelklicka på OTScanIt.exe för att starta programmet (om det är Vista så högerklicka och välj Kör som administratör i stället).

Bocka för:

Scan all users

Under Drivers välj Non-Microsoft

Under Rootkit Search välj Yes

Ändra inte någon annan inställning.

Tryck på Run Scan för att starta skanningen.

Gör inget annat medan den håller på.

När den är klar så kommer Anteckningar upp med loggen.

Kopiera den och klistra in i ditt svar.

Edit: Helt ändrat

[inlägget ändrat 2008-08-20 13:46:16 av Cecilia]

20 augusti, 2008

så, nu har jag gjort det mesta du skrev.

Loggen från virus total

[log]

Antivirus Version Senaste Uppdatering Resultat

AhnLab-V3 2008.8.19.0 2008.08.20 -

AntiVir 7.8.1.23 2008.08.20 -

Authentium 5.1.0.4 2008.08.20 -

Avast 4.8.1195.0 2008.08.19 -

AVG 8.0.0.161 2008.08.20 Win32/Heur

BitDefender 7.2 2008.08.20 -

CAT-QuickHeal 9.50 2008.08.19 -

ClamAV 0.93.1 2008.08.19 -

DrWeb 4.44.0.09170 2008.08.20 -

eSafe 7.0.17.0 2008.08.19 -

eTrust-Vet 31.6.6036 2008.08.19 -

Ewido 4.0 2008.08.20 -

F-Prot 4.4.4.56 2008.08.19 -

F-Secure 7.60.13501.0 2008.08.20 -

Fortinet 3.14.0.0 2008.08.20 -

GData 2.0.7306.1023 2008.08.20 -

Ikarus T3.1.1.34.0 2008.08.20 -

K7AntiVirus 7.10.421 2008.08.19 -

Kaspersky 7.0.0.125 2008.08.20 -

McAfee 5364 2008.08.19 -

Microsoft 1.3807 2008.08.20 -

NOD32v2 3370 2008.08.20 -

Norman 5.80.02 2008.08.20 -

Panda 9.0.0.4 2008.08.19 -

PCTools 4.4.2.0 2008.08.19 -

Prevx1 V2 2008.08.20 -

Rising 20.58.22.00 2008.08.20 -

Sophos 4.32.0 2008.08.20 Mal/EncPk-DG

Sunbelt 3.1.1546.1 2008.08.15 -

Symantec 10 2008.08.20 -

TheHacker 6.3.0.5.054 2008.08.19 -

TrendMicro 8.700.0.1004 2008.08.20 -

VBA32 3.12.8.3 2008.08.19 -

ViRobot 2008.8.20.1342 2008.08.20 -

VirusBuster 4.5.11.0 2008.08.19 -

Webwasher-Gateway 6.6.2 2008.08.20 -

[/log]

C:\WINDOWS\system32\8fb0c462-.txt är bortagen

Och nej alla tmp filerna går inte ta bort.

~DFF1E3 går inte o ta bort, inte heller IMG7, det står att de används av ett annat program.

Har även gjort en MBAM scan.

[log]

Malwarebytes' Anti-Malware 1.24

Databasversion: 1054

Windows 5.1.2600 Service Pack 2

13:50:02 2008-08-20

mbam-log-8-20-2008 (13-50-02).txt

Skanningstyp: Fullständig skanning (C:\|D:\|K:\|)

Antal skannade objekt: 206117

Förfluten tid: 1 hour(s), 17 minute(s), 51 second(s)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 1

Infekterade registervärden: 0

Infekterade registerdataposter: 0

Infekterade mappar: 0

Infekterade filer: 1

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

(Inga illasinnade poster hittades)

Infekterade registernycklar:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00675a2 (Trojan.Agent) -> Quarantined and deleted successfully.

Infekterade registervärden:

(Inga illasinnade poster hittades)

Infekterade registerdataposter:

(Inga illasinnade poster hittades)

Infekterade mappar:

(Inga illasinnade poster hittades)

Infekterade filer:

C:\System Volume Information\_restore{D3082CFB-DDFE-4DF0-9644-2FC454148387}\RP435\A0127543.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

[/log]

Jag startar om datorn och laddar ner OTscanIT efter det.

20 augusti, 2008

Ta bort mappen C:\Program Files\apdvbmg

~DFF1E3 går inte o ta bort, inte heller IMG7, det står att de används av ett annat program.

Men det är bara de två filerna kvar där nu? För i förra loggen så fanns det mer än 20 filer i mappen.

Hur stora är de två filerna?

20 augusti, 2008

de är bara de två tmp filerna. Och de är på 16Kb vardera.

Sen finns de ju andra filer där, men jag tolkade det som du bara ville ha bort tmp filerna?

C:\Program Files\apdvbmg är skrivskyddad, ska jag ta bort den ändå?

20 augusti, 2008

C:\Program Files\apdvbmg är skrivskyddad, ska jag ta bort den ändå?

Japp, den innehöll ju en infekterad fil

Bara sådana filer som twe49.tmp, win4A.tmp... är borta ur tmp-mappen så.

20 augusti, 2008

jag testade att ta bort den, men skrivskyddet kommer tillbaka även fast man tagit bort de....hur ska jag göra för att ta bort mappen?

20 augusti, 2008

Okej, går det att ta bort filen?

Om inte heller det funkar så fortsätt med resten bara.

20 augusti, 2008

ok, de fungerade inte att ta bort varken mappen eller filen.

nu är det bara 2 tmp filer i temp mappen, ~DFADA.tmp & IMG4.tmp

Jag fortsätter med scanningen nu.

20 augusti, 2008

av någon anledning kan jag inte lägga upp loggem just nu, så jag försöker igen senare...

20 augusti, 2008

Det är inte så att den är för stor igen?

Men jag ska iväg nu på 1-2 timmar.

20 augusti, 2008

jag har testat o dela upp den i 2, men jag kan testa igen med ännu mindre delar åt gången.

20 augusti, 2008

Här kommer loggen frpn OTscanIt del 1/4

[log]

OTScanIt logfile created on: 2008-08-20 15:02:48

OTScanIt by OldTimer - Version 1.0.16.2 Folder = C:\Documents and Settings\AdamEkstromBackaholm\Desktop\OTScanIt

Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.11)

Locale: 0000041D | Country: Sverige | Language: SVE | Date Format: yyyy-MM-dd

2,00 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 79,42% Memory free

3,85 Gb Paging File | 3,46 Gb Available in Paging File | 89,94% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 113,76 Gb Total Space | 58,16 Gb Free Space | 51,13% Space Free | Partition Type: NTFS

Drive D: | 114,22 Gb Total Space | 6,79 Gb Free Space | 5,94% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Drive K: | 465,65 Gb Total Space | 337,41 Gb Free Space | 72,46% Space Free | Partition Type: FAT32

Computer Name: ADAM

Current User Name: AdamEkstromBackaholm

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

[Processes - Non-Microsoft Only]

memcheck.exe -> %SystemDrive%\Acer\Empowering Technology\ePerformance\MemCheck.exe -> Acer Inc. [Ver = 2.0.2008.0 | Size = 28672 bytes | Modified Date = 2006-05-11 16:22:48 | Attr = ]

adskscsrv.exe -> %CommonProgramFiles%\Autodesk Shared\Service\AdskScSrv.exe -> Autodesk [Ver = 2.70.000 | Size = 72704 bytes | Modified Date = 2007-02-20 21:55:30 | Attr = ]

aluschedulersvc.exe -> %ProgramFiles%\Symantec\LiveUpdate\AluSchedulerSvc.exe -> Symantec Corporation [Ver = 3.2.0.43 | Size = 554616 bytes | Modified Date = 2007-01-31 23:11:41 | Attr = ]

mdnsresponder.exe -> %ProgramFiles%\Bonjour\mDNSResponder.exe -> Apple Computer, Inc. [Ver = 1,0,3,1 | Size = 229376 bytes | Modified Date = 2006-02-28 13:42:38 | Attr = ]

lssrvc.exe -> %CommonProgramFiles%\LightScribe\LSSrvc.exe -> Hewlett-Packard Company [Ver = 1.4.74.1 | Size = 73728 bytes | Modified Date = 2006-02-17 15:26:32 | Attr = ]

pifsvc.exe -> %CommonProgramFiles%\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -> Symantec Corporation [Ver = 1.2.0.18 | Size = 517768 bytes | Modified Date = 2007-03-12 18:30:14 | Attr = ]

nvsvc32.exe -> %SystemRoot%\system32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9136 | Size = 155715 bytes | Modified Date = 2006-07-12 00:19:00 | Attr = ]

symlcsvc.exe -> %CommonProgramFiles%\Symantec Shared\CCPD-LC\symlcsvc.exe -> Symantec Corporation [Ver = 1.9.1.1088 | Size = 1174664 bytes | Modified Date = 2007-04-27 17:58:57 | Attr = ]

wlservice.exe -> %ProgramFiles%\Linksys\WUSB300N\WLService.exe -> [Ver = 1, 0, 0, 9 | Size = 53307 bytes | Modified Date = 2005-07-04 16:46:04 | Attr = ]

wusb300n.exe -> %ProgramFiles%\Linksys\WUSB300N\WUSB300N.exe -> Linksys [Ver = 1.0.2.72 | Size = 5278720 bytes | Modified Date = 2006-10-25 14:54:36 | Attr = ]

rthdcpl.exe -> %SystemRoot%\RTHDCPL.exe -> Realtek Semiconductor Corp. [Ver = 2.0.6.9 | Size = 16208384 bytes | Modified Date = 2006-06-01 02:48:00 | Attr = ]

eragent.exe -> %SystemDrive%\Acer\Empowering Technology\eRecovery\eRAgent.exe -> Acer Inc. [Ver = 1.0.0.16 | Size = 413696 bytes | Modified Date = 2006-06-01 15:40:54 | Attr = ]

jusched.exe -> %ProgramFiles%\Java\jre1.6.0_07\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 144784 bytes | Modified Date = 2008-06-10 04:27:04 | Attr = ]

sysmonitor.exe -> %SystemRoot%\system32\SysMonitor.exe -> [Ver = 1.0.1.0 | Size = 49152 bytes | Modified Date = 2006-04-18 20:54:50 | Attr = ]

hpwuschd2.exe -> %ProgramFiles%\HP\HP Software Update\hpwuSchd2.exe -> Hewlett-Packard Company [Ver = 2, 0, 39, 0 | Size = 49152 bytes | Modified Date = 2004-02-12 14:38:56 | Attr = ]

hpcmpmgr.exe -> %ProgramFiles%\HP\hpcoretech\hpcmpmgr.exe -> Hewlett-Packard Company [Ver = 2.1.1.0 | Size = 241664 bytes | Modified Date = 2004-05-12 16:18:56 | Attr = ]

pifsvc.exe -> %CommonProgramFiles%\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -> Symantec Corporation [Ver = 1.2.0.18 | Size = 517768 bytes | Modified Date = 2007-03-12 18:30:14 | Attr = ]

isuspm.exe -> %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe -> Macrovision Corporation [Ver = 5, 01, 100, 47363 | Size = 213936 bytes | Modified Date = 2006-03-20 18:34:50 | Attr = ]

superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 4, 15, 0, 1000 | Size = 1506544 bytes | Modified Date = 2008-05-28 10:33:34 | Attr = ]

acer.empowering.framework.launcher.exe -> %SystemDrive%\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe -> Acer Inc. [Ver = 2.3.2022.0 | Size = 45056 bytes | Modified Date = 2006-06-01 18:51:32 | Attr = ]

zdwlan.exe -> %ProgramFiles%\Acer WLAN 11g USB Dongle\ZDWlan.exe -> X-Micro Technology Corp. [Ver = 2, 21, 0, 0 | Size = 745472 bytes | Modified Date = 2005-11-16 20:25:14 | Attr = ]

otscanit.exe -> %UserProfile%\Desktop\OTScanIt\OTScanIt.exe -> OldTimer Tools [Ver = 1.0.16.2 | Size = 397312 bytes | Modified Date = 2008-07-12 09:29:54 | Attr = ]

[Win32 Services - Non-Microsoft Only]

(Automatic LiveUpdate Scheduler) Automatic LiveUpdate Scheduler [Win32_Own | Auto | Running] -> %ProgramFiles%\Symantec\LiveUpdate\AluSchedulerSvc.exe -> Symantec Corporation [Ver = 3.2.0.43 | Size = 554616 bytes | Modified Date = 2007-01-31 23:11:41 | Attr = ]

(CLTNetCnService) Symantec Lic NetConnect service [Win32_Shared | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\ccSvcHst.exe -> File not found

(COMSysApp) COM+ System Application [Win32_Own | On_Demand | Stopped] -> -> File not found

(FLEXnet Licensing Service) FLEXnet Licensing Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -> Macrovision Europe Ltd. [Ver = 11.03.005 | Size = 654848 bytes | Modified Date = 2007-12-06 22:44:48 | Attr = ]

(LiveUpdate Notice Ex) LiveUpdate Notice Service Ex [Win32_Shared | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\ccSvcHst.exe -> File not found

(LiveUpdate Notice Service) LiveUpdate Notice Service [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -> Symantec Corporation [Ver = 1.2.0.18 | Size = 517768 bytes | Modified Date = 2007-03-12 18:30:14 | Attr = ]

(MDM) Machine Debug Manager [Win32_Own | Auto | Stopped] -> -> File not found

(mi-raysat_3dsmax9_32) mental ray 3.5 Satellite (32-bit) [Win32_Own | Auto | Stopped] -> -> File not found

(SolidWorks Licensing Service) SolidWorks Licensing Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\SolidWorks Shared\Service\SolidWorksLicensing.exe -> SolidWorks [Ver = 2.65.010 | Size = 69632 bytes | Modified Date = 2006-12-27 14:24:46 | Attr = ]

(usnjsvc) Messenger Sharing Folders USN Journal Reader Service [Win32_Own | On_Demand | Stopped] -> -> File not found

[Driver Services - Non-Microsoft Only]

(catchme) catchme [Kernel | On_Demand | Stopped] -> %SystemDrive%\DOCUME~1\ADAMEK~1\LOCALS~1\Temp\catchme.sys -> File not found

(HDAudBus) Microsoft UAA Bus Driver for High Definition Audio [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\Hdaudbus.sys -> Windows ® Server 2003 DDK provider [Ver = 5.10.01.5013 built by: WinDDK | Size = 138752 bytes | Modified Date = 2005-01-07 17:07:18 | Attr = ]

(IntcAzAudAddService) Service for Realtek HD Audio (WDM) [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\RtkHDAud.Sys -> Realtek Semiconductor Corp. [Ver = 5.10.00.5265 built by: WinDDK | Size = 4284928 bytes | Modified Date = 2006-06-05 22:09:26 | Attr = ]

(RTLWUSB) NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\System32\DRIVERS\wg111v2.sys -> File not found

(Secdrv) Secdrv [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\secdrv.sys -> Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K. [Ver = 4.03.086 | Size = 20480 bytes | Modified Date = 2007-11-13 12:25:53 | Attr = R ]

(yukonwxp) NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\yk51x86.sys -> Marvell [Ver = 8.53.4.3 built by: WinDDK | Size = 244864 bytes | Modified Date = 2006-06-29 10:53:00 | Attr = ]

(ZD1211BU(ZyDAS)) ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS) [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\ZD1211BU.sys -> ZyDAS Technology Corporation [Ver = 6, 3, 0, 0 | Size = 402432 bytes | Modified Date = 2005-10-28 11:38:18 | Attr = ]

(ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS) [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\ZD1211U.sys -> ZyDAS Technology Corporation [Ver = 4.11.0.0 | Size = 280064 bytes | Modified Date = 2005-10-04 15:38:24 | Attr = ]

[Registry - Non-Microsoft Only]

< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->

-> [] -> File not found

Acer Empowering Technology Monitor -> %SystemRoot%\system32\SysMonitor.exe [C:\WINDOWS\system32\SysMonitor.exe] -> [Ver = 1.0.1.0 | Size = 49152 bytes | Modified Date = 2006-04-18 20:54:50 | Attr = ]

Alcmtr -> %SystemRoot%\Alcmtr.exe [ALCMTR.EXE] -> Realtek Semiconductor Corp. [Ver = 1.6.0.2 | Size = 69632 bytes | Modified Date = 2005-05-03 04:43:28 | Attr = ]

eRecoveryService -> %SystemDrive%\Acer\Empowering Technology\eRecovery\eRAgent.exe [C:\Acer\Empowering Technology\eRecovery\eRAgent.exe] -> Acer Inc. [Ver = 1.0.0.16 | Size = 413696 bytes | Modified Date = 2006-06-01 15:40:54 | Attr = ]

HP Component Manager -> %ProgramFiles%\HP\hpcoretech\hpcmpmgr.exe ["C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"] -> Hewlett-Packard Company [Ver = 2.1.1.0 | Size = 241664 bytes | Modified Date = 2004-05-12 16:18:56 | Attr = ]

HP Software Update -> %ProgramFiles%\HP\HP Software Update\hpwuSchd2.exe ["C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"] -> Hewlett-Packard Company [Ver = 2, 0, 39, 0 | Size = 49152 bytes | Modified Date = 2004-02-12 14:38:56 | Attr = ]

ISUSPM -> %CommonProgramFiles%\InstallShield\UpdateService\ISUSPM.exe ["C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler] -> Macrovision Corporation [Ver = 5, 01, 100, 47363 | Size = 213936 bytes | Modified Date = 2006-03-20 18:34:50 | Attr = ]

KernelFaultCheck -> [%systemroot%\system32\dumprep 0 -k] -> File not found

LaunchApp -> %SystemRoot%\Alaunch.exe [Alaunch] -> Acer Inc. [Ver = 2.2.0.3 | Size = 524288 bytes | Modified Date = 2006-03-16 06:56:22 | Attr = ]

QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> Apple Computer, Inc. [Ver = 7.1.5a38 | Size = 282624 bytes | Modified Date = 2007-02-20 22:16:18 | Attr = ]

RTHDCPL -> %SystemRoot%\RTHDCPL.exe [RTHDCPL.EXE] -> Realtek Semiconductor Corp. [Ver = 2.0.6.9 | Size = 16208384 bytes | Modified Date = 2006-06-01 02:48:00 | Attr = ]

SkyTel -> %SystemRoot%\SkyTel.exe [skyTel.EXE] -> Realtek Semiconductor Corp. [Ver = 1.0.0.0 | Size = 2879488 bytes | Modified Date = 2006-05-16 04:04:26 | Attr = ]

SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_07\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"] -> Sun Microsystems, Inc. [Ver = 6.0.70.6 | Size = 144784 bytes | Modified Date = 2008-06-10 04:27:04 | Attr = ]

Symantec PIF AlertEng -> %CommonProgramFiles%\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe ["C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"] -> Symantec Corporation [Ver = 1.2.0.18 | Size = 517768 bytes | Modified Date = 2007-03-12 18:30:14 | Attr = ]

UserFaultCheck -> [%systemroot%\system32\dumprep 0 -u] -> File not found

< OptionalComponents [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ ->

IMAIL-> Installed = 1 ->

MAPI-> Installed = 1 ->

MSFS-> Installed = 1 ->

< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->

-> [] -> File not found

A00F6ADF6.exe -> %SystemDrive%\DOCUME~1\ADAMEK~1\LOCALS~1\Temp\_A00F6ADF6.exe [C:\DOCUME~1\ADAMEK~1\LOCALS~1\Temp\_A00F6ADF6.exe] -> File not found

SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe [C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe] -> SUPERAntiSpyware.com [Ver = 4, 15, 0, 1000 | Size = 1506544 bytes | Modified Date = 2008-05-28 10:33:34 | Attr = ]

< Run [HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\] > -> HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->

-> [] -> File not found

A00F6ADF6.exe -> %SystemDrive%\DOCUME~1\ADAMEK~1\LOCALS~1\Temp\_A00F6ADF6.exe [C:\DOCUME~1\ADAMEK~1\LOCALS~1\Temp\_A00F6ADF6.exe] -> File not found

SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe [C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe] -> SUPERAntiSpyware.com [Ver = 4, 15, 0, 1000 | Size = 1506544 bytes | Modified Date = 2008-05-28 10:33:34 | Attr = ]

< AdamEkstromBackaholm Startup Folder > -> C:\Documents and Settings\AdamEkstromBackaholm\Start Menu\Programs\Startup ->

%UserProfile%\Start Menu\Programs\Startup\Adobe Gamma.lnk -> %CommonProgramFiles%\Adobe\Calibration\Adobe Gamma Loader.exe -> Adobe Systems, Inc. [Ver = 1, 0, 0, 1 | Size = 113664 bytes | Modified Date = 2005-03-16 20:16:50 | Attr = ]

< Administrator Startup Folder > -> C:\Documents and Settings\Administrator\Start Menu\Programs\Startup ->

< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup ->

%AllUsersProfile%\Start Menu\Programs\Startup\Acer Empowering Technology.lnk -> %SystemDrive%\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe -> Acer Inc. [Ver = 2.3.2022.0 | Size = 45056 bytes | Modified Date = 2006-06-01 18:51:32 | Attr = ]

%AllUsersProfile%\Start Menu\Programs\Startup\Acer WLAN 11g USB Dongle.lnk -> %ProgramFiles%\Acer WLAN 11g USB Dongle\ZDWlan.exe -> X-Micro Technology Corp. [Ver = 2, 21, 0, 0 | Size = 745472 bytes | Modified Date = 2005-11-16 20:25:14 | Attr = ]

%AllUsersProfile%\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 7.1.0.2008042300 | Size = 29696 bytes | Modified Date = 2008-04-23 03:38:16 | Attr = ]

< Claes Startup Folder > -> C:\Documents and Settings\Claes\Start Menu\Programs\Startup ->

< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup ->

< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs ->

*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls ->

C:\WINDOWS\system32\guard32.dll -> %SystemRoot%\system32\guard32.dll -> [Ver = | Size = 143104 bytes | Modified Date = 2008-08-13 22:11:10 | Attr = ]

*MultiFile Done* -> ->

< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad ->

{3B6C0668-E410-8E23-EFC1-0118F6CE9275} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\apdvbmg\winadmact.dll [winadmact] -> [Ver = | Size = 122880 bytes | Modified Date = 2008-08-13 22:48:00 | Attr = ]

< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks ->

{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1012 | Size = 77824 bytes | Modified Date = 2008-05-13 10:13:36 | Attr = ]

< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->

< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell ->

c:\windows\explorer.exe -> %SystemRoot%\explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 2007-06-13 12:23:07 | Attr = ]

*MultiFile Done* -> ->

*UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit ->

c:\windows\system32\userinit.exe -> %SystemRoot%\system32\userinit.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 24576 bytes | Modified Date = 2004-08-10 22:00:00 | Attr = ]

*MultiFile Done* -> ->

*UIHost* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost ->

logonui.exe -> %SystemRoot%\system32\logonui.exe -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 514560 bytes | Modified Date = 2004-08-10 22:00:00 | Attr = ]

*MultiFile Done* -> ->

*VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet ->

rundll32 shell32 -> %SystemRoot%\system32\shell32.dll -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 2007-10-26 05:34:01 | Attr = ]

Control_RunDLL "sysdm.cpl" -> %SystemRoot%\system32\sysdm.cpl -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 298496 bytes | Modified Date = 2004-08-10 22:00:00 | Attr = ]

*MultiFile Done* -> ->

< Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

< Winlogon settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

< Winlogon settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

< Winlogon settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

< Winlogon settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

< Winlogon settings [HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005] > -> HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->

< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->

!saswinlogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1046 | Size = 294912 bytes | Modified Date = 2007-04-19 13:41:36 | Attr = ]

WgaLogon -> -> File not found

< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallVisualStyle -> %SystemRoot%\Resources\Themes\Royale\Royale.mss [C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles] -> File not found

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallTheme -> %SystemRoot%\Resources\Themes\Royale.the [C:\WINDOWS\Resources\Themes\Royale.theme] -> File not found

< CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\NoDispBackgroundPage -> 0 ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\NoDispScrSavPage -> 0 ->

< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005] > -> HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\NoDispBackgroundPage -> 0 ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\NoDispScrSavPage -> 0 ->

< CDROM Autorun Settings > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\ -> ->

*DependOnGroup* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DependOnGroup ->

SCSI miniport -> -> File not found

*MultiFile Done* -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ErrorControl -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Group -> SCSI CDROM Class ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Start -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Tag -> 2 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\Type -> 1 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\DisplayName -> CD-ROM Driver ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\ImagePath -> %SystemRoot%\system32\drivers\cdrom.sys [system32\DRIVERS\cdrom.sys] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 49536 bytes | Modified Date = 2004-08-10 22:00:00 | Attr = ]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun -> 1 ->

*AutoRunAlwaysDisable* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRunAlwaysDisable ->

NEC MBR-7 -> -> File not found

NEC MBR-7.4 -> -> File not found

PIONEER CHANGR DRM-1804X -> -> File not found

PIONEER CD-ROM DRM-6324X -> -> File not found

PIONEER CD-ROM DRM-624X -> -> File not found

TORiSAN CD-ROM CDR_C36 -> -> File not found

*MultiFile Done* -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\ -> ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\0 -> IDE\CdRomHL-DT-ST_DVD+-RW_GSA-H21N_______________1.00____\5&1c855ddd&0&0.0.0 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\Count -> 2 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\NextInstance -> 2 ->

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\Enum\\1 -> SCSI\CdRom&Ven_QO5314N&Prod_SSU639V&Rev_1.0\5&68f2289&0&000 ->

< Drives - Autoruns > -> ->

AUTOEXEC.BAT [PATH=%PATH%;C:\PROGRA~1\COMMON~1\MUVEET~1\030625 | ] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] -> [Ver = | Size = 50 bytes | Modified Date = 2006-08-17 16:39:42 | Attr = ]

autorun [] -> K:\autorun [ FAT32 ] -> [Folder | Modified Date = 2007-10-13 04:00:32 | Attr = ]

< HOSTS File > (764 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts ->

192.168.1.100 HP000D9D10AA91 -> ->

< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> ->

HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->

HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896 ->

HKEY_LOCAL_MACHINE\: Main\\Local Page -> %SystemRoot%\system32\blank.htm ->

HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->

HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://sv.intl.acer.yahoo.com ->

HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->

HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->

< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> ->

HKEY_CURRENT_USER\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm ->

HKEY_CURRENT_USER\: Main\\Search Bar -> http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR'>http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR'>http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR'>http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR'>http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR'>http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR ->

HKEY_CURRENT_USER\: Main\\Search Page -> http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR ->

HKEY_CURRENT_USER\: Main\\Start Page -> http://onecare.live.com/site/sv-se/default.htm'>http://onecare.live.com/site/sv-se/default.htm ->

HKEY_CURRENT_USER\: SearchURL\\ -> http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR[Reg Error: Value provider does not exist or could not be read.] ->

HKEY_CURRENT_USER\: URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Yahoo! Toolbar] -> File not found

HKEY_CURRENT_USER\: ProxyEnable -> 0 ->

HKEY_CURRENT_USER\: ProxyOverride -> *.local ->

< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> ->

HKEY_USERS\.DEFAULT\: ProxyEnable -> 0 ->

< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> ->

HKEY_USERS\S-1-5-18\: ProxyEnable -> 0 ->

< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> ->

< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> ->

< Internet Explorer Settings [HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\] > -> ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: Main\\Search Bar -> http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: Main\\Search Page -> http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: Main\\Start Page -> http://onecare.live.com/site/sv-se/default.htm ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: SearchURL\\ -> http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR[Reg Error: Value provider does not exist or could not be read.] ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Yahoo! Toolbar] -> File not found

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: ProxyEnable -> 0 ->

HKEY_USERS\S-1-5-21-1533626090-2165491018-4163756550-1005\: ProxyOverride -> *.local ->

< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. ->

1 domain(s) and sub-domain(s) not assigned to a zone.

< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. ->

< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 2025 domain(s) found. ->