{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.5.0/jin...ndows-i586.cab[Java Plug-in 1.5.0_01] ->
{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.5.0/jin...ndows-i586.cab[Java Plug-in 1.5.0_02] ->
{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.5.0/jin...ndows-i586.cab[Java Plug-in 1.5.0_06] ->
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.6.0/jin...ndows-i586.cab[Java Plug-in 1.6.0_03] ->
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.6.0/jin...ndows-i586.cab[Java Plug-in 1.6.0_05] ->
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.6.0/jin...ndows-i586.cab[Java Plug-in 1.6.0_07] ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] ->
http://java.sun.com/update/1.6.0/jin...ndows-i586.cab[Java Plug-in 1.6.0_07] ->
{D27CDB6E-AE6D-11CF-96B8-444553540000}[HKEY_LOCAL_MACHINE] ->
http://fpdownload.macromedia.com/get...nt/swflash.cab[Shockwave Flash Object] ->
{EF791A6B-FC12-4C68-99EF-FB9E207A39E6}[HKEY_LOCAL_MACHINE] ->
http://download.mcafee.com/molbin/is...87/mcfscan.cab[McFreeScan Class] ->
{FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0}[HKEY_LOCAL_MACHINE] ->
http://download.spyspotter.com/spysp...terInstall.cab[Reg Error: Key does not exist or could not be opened.] ->
DirectAnimation Java Classes[HKEY_LOCAL_MACHINE] -> file://C:\WINDOWS\Java\classes\dajava.cab[Reg Error: Key does not exist or could not be opened.] ->
Microsoft XML Parser for Java[HKEY_LOCAL_MACHINE] -> file://C:\WINDOWS\Java\classes\xmldso.cab[Reg Error: Key does not exist or could not be opened.] ->
< Module Usage Keys [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/DS3.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/DS3.dll\\.Owner -> {DDFFA75A-E81D-4454-89FC-B9FD0631E726} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/DS3.dll\\{DDFFA75A-E81D-4454-89FC-B9FD0631E726} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1018.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1018.dll\\.Owner -> {DBAE7000-01EC-4162-8FEB-8A27AC937CA0} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1018.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1100.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1100.dll\\.Owner -> {DBAE7000-01EC-4162-8FEB-8A27AC937CA0} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1100.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ipixx.ocx\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ipixx.ocx\\.Owner -> {11260943-421B-11D0-8EAC-0000C07D88CF} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ipixx.ocx\\{11260943-421B-11D0-8EAC-0000C07D88CF} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/iSetup.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/iSetup.dll\\.Owner -> {90C9629E-CD32-11D3-BBFB-00105A1F0D68} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/iSetup.dll\\{90C9629E-CD32-11D3-BBFB-00105A1F0D68} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/iSetup.exe\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/iSetup.exe\\.Owner -> {90C9629E-CD32-11D3-BBFB-00105A1F0D68} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/iSetup.exe\\{90C9629E-CD32-11D3-BBFB-00105A1F0D68} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ITDetector.ocx\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ITDetector.ocx\\.Owner -> {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ITDetector.ocx\\{D719897A-B07A-4C0C-AEA9-9B663A28DFCB} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MsnPUpld.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MsnPUpld.dll\\.Owner -> {4F1E5B1A-2A80-42CA-8532-2D05CB959537} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MsnPUpld.dll\\{4F1E5B1A-2A80-42CA-8532-2D05CB959537} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PURen-us.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PURen-us.dll\\.Owner -> {4F1E5B1A-2A80-42CA-8532-2D05CB959537} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PURen-us.dll\\{4F1E5B1A-2A80-42CA-8532-2D05CB959537} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SSCHECK.DLL\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SSCHECK.DLL\\.Owner -> {421A63BA-4632-43E0-A942-3B4AB645BE51} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SSCHECK.DLL\\{421A63BA-4632-43E0-A942-3B4AB645BE51} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SyncroAdX.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SyncroAdX.dll\\.Owner -> {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SyncroAdX.dll\\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/tgctlcm.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/tgctlcm.dll\\.Owner -> {01113300-3E00-11D2-8470-0060089874ED} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/tgctlcm.dll\\{01113300-3E00-11D2-8470-0060089874ED} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/IPX32d56.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/IPX32d56.dll\\.Owner -> {11260943-421B-11D0-8EAC-0000C07D88CF} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/IPX32d56.dll\\{11260943-421B-11D0-8EAC-0000C07D88CF} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/mm32DCMP.DLL\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/mm32DCMP.DLL\\.Owner -> {11260943-421B-11D0-8EAC-0000C07D88CF} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/mm32DCMP.DLL\\{11260943-421B-11D0-8EAC-0000C07D88CF} -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/SYSTEM32/muweb.dll\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/SYSTEM32/muweb.dll\\.Owner -> {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/SYSTEM32/muweb.dll\\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> ->
[Registry - Additional Scans - Non-Microsoft Only]
< BotCheck > -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\DefaultLaunchPermission -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\EnableDCOM -> Y ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\MachineLaunchRestriction -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\MachineAccessRestriction -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{A50398B8-9075-4FBF-A7A1-456BF21937AD} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{AD65A69D-3831-40D7-9629-9B0B50A93843} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{0040D221-54A1-11D1-9DE0-006097042D69} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST\\System.EnterpriseServices.Thunk.dll -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusDisableNotify -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallDisableNotify -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\UpdatesDisableNotify -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusOverride -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallOverride -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\ -> ->
Reg Error: Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ not found. -> ->
Reg Error: Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\ not found. -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ -> ->
*Authentication Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages ->
msv1_0 -> %SystemRoot%\SYSTEM32\msv1_0.dll -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 132608 bytes | Modified Date = 04/13/2008 6:12:00 PM | Attr = ]
C:\WINDOWS\system32\yayaBSIX -> %SystemRoot%\SYSTEM32\yayaBSIX.dll -> [Ver = | Size = 313856 bytes | Modified Date = 11/16/2008 7:53:11 PM | Attr = ]
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Bounds -> 0 [binary data] ->
*Security Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages ->
kerberos -> %SystemRoot%\SYSTEM32\kerberos.dll -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 299520 bytes | Modified Date = 04/13/2008 6:11:56 PM | Attr = ]
msv1_0 -> %SystemRoot%\SYSTEM32\msv1_0.dll -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 132608 bytes | Modified Date = 04/13/2008 6:12:00 PM | Attr = ]
schannel -> %SystemRoot%\SYSTEM32\schannel.dll -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 144384 bytes | Modified Date = 04/13/2008 6:12:05 PM | Attr = ]
wdigest -> %SystemRoot%\SYSTEM32\wdigest.dll -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 49152 bytes | Modified Date = 04/13/2008 6:12:08 PM | Attr = ]
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\LsaPid -> 748 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\SecureBoot -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\auditbaseobjects -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\crashonauditfail -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\disabledomaincreds -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\everyoneincludesanonymous -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\fipsalgorithmpolicy -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\forceguest -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\fullprivilegeauditing -> [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\limitblankpassworduse -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\lmcompatibilitylevel -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\nodefaultadminowner -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\nolmhash -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\restrictanonymous -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\restrictanonymoussam -> 1 ->
*Notification Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Notification Packages ->
scecli -> %SystemRoot%\SYSTEM32\scecli.dll -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 181248 bytes | Modified Date = 04/13/2008 6:12:05 PM | Attr = ]
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\ImpersonatePrivilegeUpgradeToolHasRun -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\ -> ->
*ProviderOrder* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\\ProviderOrder ->
Windows NT Access Provider -> -> File not found
*MultiFile Done* -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider\\ProviderPath -> %SystemRoot%\SYSTEM32\ntmarta.dll [%SystemRoot%\system32\ntmarta.dll] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2113) | Size = 118784 bytes | Modified Date = 04/13/2008 6:12:02 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data\\Pattern -> CA D4 18 DB 51 C2 31 EB 4C 73 4F BC 92 18 35 D7 37 64 65 36 32 62 66 63 00 00 00 00 01 00 00 00 B4 01 00 00 B8 01 00 00 34 CA 06 00 45 9D BF 71 04 00 00 00 10 00 00 00 00 00 00 00 80 6B 0D 14 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG\\GrafBlumGroup -> 81 B0 25 B0 4D D9 8D 53 05 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD\\Lookup -> 59 D5 59 4F F4 F1 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\SidCache\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0\\ntlmminclientsec -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0\\ntlmminserversec -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1\\SkewMatrix -> 62 82 37 51 04 30 3D BD AF EF 67 E4 69 3A 29 60 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4\\SSOURL ->
http://www.passport.com ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\\Time -> E6 4F A4 7C 3A 49 C9 01 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Name -> Digest ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Comment -> Digest SSPI Authentication Package ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Capabilities -> 16464 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\RpcId -> 65535 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Version -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\TokenSize -> 65535 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Time -> 00 54 CF 23 C4 9D C8 01 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Type -> 49 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Name -> DPA ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Comment -> DPA Security Package ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Capabilities -> 55 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\RpcId -> 17 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Version -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\TokenSize -> 768 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Time -> 00 DB 62 27 C4 9D C8 01 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Type -> 49 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Name -> MSN ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Comment -> MSN Security Package ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Capabilities -> 55 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\RpcId -> 18 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Version -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\TokenSize -> 768 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Time -> 00 08 94 28 C4 9D C8 01 [binary data] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Type -> 49 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Type -> 32 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Start -> 2 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ImagePath -> %SystemRoot%\SYSTEM32\svchost.exe [%SystemRoot%\System32\svchost.exe -k netsvcs] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2111) | Size = 14336 bytes | Modified Date = 04/13/2008 6:12:36 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DisplayName -> Windows Firewall/Internet Connection Sharing (ICS) ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnService -> Netman;WinMgmt; ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnGroup -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ObjectName -> LocalSystem ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Description -> Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\\Epoch -> 131772 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\\ServiceDll -> %SystemRoot%\SYSTEM32\ipnathlp.dll [%SystemRoot%\System32\ipnathlp.dll] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-0852) | Size = 331264 bytes | Modified Date = 04/13/2008 6:11:55 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %SystemRoot%\SYSTEM32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2111) | Size = 141312 bytes | Modified Date = 04/13/2008 6:12:34 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %SystemRoot%\network diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-0852) | Size = 558080 bytes | Modified Date = 04/13/2008 12:53:32 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> %ProgramFiles%\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0] -> Microsoft Corporation [Ver = 7.0.0813 | Size = 6856704 bytes | Modified Date = 04/27/2005 12:04:08 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\EnableFirewall -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\DoNotAllowExceptions -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\DisableNotifications -> 0 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE -> %SystemDrive%\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE [C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE:*:Enabled:Yahoo! Messenger] -> File not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe -> %ProgramFiles%\Yahoo!\Messenger\YServer.exe [C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe:*:Enabled:Yahoo! FT Server] -> Yahoo! Inc. [Ver = 3, 0, 0, 1 | Size = 91376 bytes | Modified Date = 08/30/2007 5:43:18 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %SystemRoot%\SYSTEM32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2111) | Size = 141312 bytes | Modified Date = 04/13/2008 6:12:34 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe -> %ProgramFiles%\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater] -> [Ver = | Size = 16423 bytes | Modified Date = 02/11/2004 4:58:16 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Real\RealPlayer\realplay.exe -> %ProgramFiles%\Real\RealPlayer\realplay.exe [C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealOne Player] -> RealNetworks, Inc. [Ver = 11.0.0.442 | Size = 214560 bytes | Modified Date = 03/28/2008 6:37:55 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Messenger\msmsgs.exe -> %ProgramFiles%\Messenger\msmsgs.exe [C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> Microsoft Corporation [Ver = 4.7.3001 | Size = 1695232 bytes | Modified Date = 04/13/2008 6:12:28 PM | Attr = HS]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Mozilla Firefox\firefox.exe -> %ProgramFiles%\Mozilla Firefox\firefox.exe [C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox] -> Mozilla Corporation [Ver = 1.8.1.18: 2008102918 | Size = 7676528 bytes | Modified Date = 11/13/2008 7:58:29 AM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\Loader\aolload.exe -> %CommonProgramFiles%\aol\Loader\aolload.exe [C:\Program Files\Common Files\aol\Loader\aolload.exe:*:Enabled:AOL Application Loader] -> America Online, Inc. [Ver = 9.2.0.1 | Size = 11352 bytes | Modified Date = 07/11/2005 3:35:18 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\ACS\AOLDial.exe -> %CommonProgramFiles%\aol\ACS\AOLDial.exe [C:\Program Files\Common Files\aol\ACS\AOLDial.exe:*:Enabled:AOL] -> AOL LLC [Ver = 4.6.1.2 | Size = 71216 bytes | Modified Date = 10/23/2006 6:50:37 AM | Attr = R ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\ACS\AOLacsd.exe -> %CommonProgramFiles%\aol\ACS\AOLacsd.exe [C:\Program Files\Common Files\aol\ACS\AOLacsd.exe:*:Enabled:AOL] -> AOL LLC [Ver = 4.6.1.2 | Size = 46640 bytes | Modified Date = 10/23/2006 6:50:35 AM | Attr = R ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\America Online 9.0\waol.exe -> %ProgramFiles%\America Online 9.0\waol.exe [C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL] -> America Online, Inc. [Ver = 9.02.000 | Size = 37464 bytes | Modified Date = 07/11/2005 11:17:51 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\TopSpeed\2.0\aoltsmon.exe -> %CommonProgramFiles%\aol\TopSpeed\2.0\aoltsmon.exe [C:\Program Files\Common Files\aol\TopSpeed\2.0\aoltsmon.exe:*:Enabled:AOLTsMon] -> America Online, Inc [Ver = 2, 0, 0, 0 | Size = 100016 bytes | Modified Date = 10/15/2004 2:54:14 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\TopSpeed\2.0\aoltpspd.exe -> %CommonProgramFiles%\aol\TopSpeed\2.0\aoltpspd.exe [C:\Program Files\Common Files\aol\TopSpeed\2.0\aoltpspd.exe:*:Enabled:AOLTopSpeed] -> America Online Inc [Ver = 2, 0, 0, 0 | Size = 46768 bytes | Modified Date = 10/15/2004 2:54:12 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\1135805068\EE\AOLServiceHost.exe -> %CommonProgramFiles%\aol\1135805068\EE\AOLServiceHost.exe [C:\Program Files\Common Files\aol\1135805068\EE\AOLServiceHost.exe:*:Enabled:AOL] -> America Online, Inc. [Ver = 1.0.0.6 | Size = 110680 bytes | Modified Date = 11/03/2004 3:03:00 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\System Information\sinf.exe -> %CommonProgramFiles%\aol\System Information\sinf.exe [C:\Program Files\Common Files\aol\System Information\sinf.exe:*:Enabled:AOL] -> America Online Inc. [Ver = 1, 0, 0, 1 | Size = 140888 bytes | Modified Date = 04/05/2005 6
43 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\AOL Spyware Protection\AOLSP Scheduler.exe -> %CommonProgramFiles%\aol\AOL Spyware Protection\AOLSP Scheduler.exe [C:\Program Files\Common Files\aol\AOL Spyware Protection\AOLSP Scheduler.exe:*:Enabled:AOL] -> [Ver = 1, 0, 0, 74 | Size = 79448 bytes | Modified Date = 10/18/2004 5:42:18 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\AOL Spyware Protection\asp.exe -> %CommonProgramFiles%\aol\AOL Spyware Protection\asp.exe [C:\Program Files\Common Files\aol\AOL Spyware Protection\asp.exe:*:Enabled:AOL] -> AOL Spyware Protection [Ver = 1.00.0076 | Size = 3040856 bytes | Modified Date = 10/15/2004 12:16:06 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe -> %CommonProgramFiles%\AolCoach\en_en\player\AOLNySEV.exe [C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe:*:Enabled:AOL] -> File not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %SystemRoot%\network diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-0852) | Size = 558080 bytes | Modified Date = 04/13/2008 12:53:32 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> %ProgramFiles%\Yahoo!\Messenger\YahooMessenger.exe [C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger] -> Yahoo! Inc. [Ver = 8,1,0,421 | Size = 4670704 bytes | Modified Date = 08/30/2007 5:43:18 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\aol\1135805068\EE\aolsoftware.exe -> %CommonProgramFiles%\aol\1135805068\EE\aolsoftware.exe [C:\Program Files\Common Files\aol\1135805068\EE\aolsoftware.exe:*:Enabled:AOL Shared Components] -> America Online, Inc. [Ver = 1.5.6.1 | Size = 50736 bytes | Modified Date = 09/25/2006 6:52:48 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Internet Explorer\iexplore.exe -> %ProgramFiles%\Internet Explorer\iexplore.exe [C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer] -> Microsoft Corporation [Ver = 7.00.6000.16735 (vista_gdr.080820-1506) | Size = 635848 bytes | Modified Date = 08/22/2008 11:56:15 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\browser\ybrowser.exe -> %ProgramFiles%\Yahoo!\browser\ybrowser.exe [C:\Program Files\Yahoo!\browser\ybrowser.exe:*:Enabled:Yahoo! Browser] -> Yahoo!, Inc. [Ver = 2003, 10, 22, 2 | Size = 443824 bytes | Modified Date = 10/22/2003 2:48:02 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Pando Networks\Pando\pando.exe -> %ProgramFiles%\Pando Networks\Pando\pando.exe [C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:pando] -> File not found
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Bonjour\mDNSResponder.exe -> %ProgramFiles%\Bonjour\mDNSResponder.exe [C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour] -> Apple Inc. [Ver = 1,0,5,11 | Size = 238888 bytes | Modified Date = 08/29/2008 10:18:44 AM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\iTunes\iTunes.exe -> %ProgramFiles%\iTunes\iTunes.exe [C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes] -> Apple Inc. [Ver = 8.0.0.35 | Size = 14228264 bytes | Modified Date = 09/10/2008 5:39:54 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> %ProgramFiles%\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0] -> Microsoft Corporation [Ver = 7.0.0813 | Size = 6856704 bytes | Modified Date = 04/27/2005 12:04:08 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Skype\Phone\Skype.exe -> %ProgramFiles%\Skype\Phone\Skype.exe [C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype] -> Skype Technologies S.A. [Ver = 3.6.0.248 | Size = 21898024 bytes | Modified Date = 02/06/2008 6:37:52 PM | Attr = R ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security\\Security -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\\ServiceUpgrade -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\0 -> Root\LEGACY_SHAREDACCESS\0000 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\Count -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\NextInstance -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Type -> 32 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Start -> 4 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ErrorControl -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ImagePath -> %SystemRoot%\SYSTEM32\svchost.exe [%systemroot%\system32\svchost.exe -k netsvcs] -> Microsoft Corporation [Ver = 5.1.2600.5512 (xpsp.080413-2111) | Size = 14336 bytes | Modified Date = 04/13/2008 6:12:36 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\DisplayName -> Automatic Updates ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ObjectName -> LocalSystem ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Description -> Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site. ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\\ServiceDll -> %SystemRoot%\SYSTEM32\wuauserv.dll [C:\WINDOWS\system32\wuauserv.dll] -> Microsoft Corporation [Ver = 5.4.3790.5512 (xpsp.080413-0852) | Size = 6656 bytes | Modified Date = 04/13/2008 6:12:11 PM | Attr = ]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\\Security -> [Binary data over 100 bytes] ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\0 -> Root\LEGACY_WUAUSERV\0000 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\Count -> 1 ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\NextInstance -> 1 ->
Reg Error: Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry\ not found. -> ->
Reg Error: Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr\ not found. -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings\ -> ->
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings\\ProxyEnable -> 0 ->
[Files/Folders - Created Within 30 days]
gmer.sys -> %SystemRoot%\System32\drivers\gmer.sys -> GMER [Ver = 1, 0, 14, 4401 | Size = 85969 bytes | Created Date = 11/20/2008 7:31:29 PM | Attr = ]
akmsifwx.dll -> %SystemRoot%\System32\akmsifwx.dll -> [Ver = | Size = 72704 bytes | Created Date = 11/20/2008 7:58:08 PM | Attr = ]
byXOhGvu.dll -> %SystemRoot%\System32\byXOhGvu.dll -> [Ver = | Size = 25600 bytes | Created Date = 11/16/2008 7:48:01 PM | Attr = ]
cont_adsoftinc-remove.exe -> %SystemRoot%\System32\cont_adsoftinc-remove.exe -> [Ver = | Size = 53938 bytes | Created Date = 11/19/2008 11:17:14 PM | Attr = ]
ddcCVonk.dll -> %SystemRoot%\System32\ddcCVonk.dll -> [Ver = | Size = 25600 bytes | Created Date = 11/19/2008 11:40:57 PM | Attr = ]
ekpdequs.ini -> %SystemRoot%\System32\ekpdequs.ini -> [Ver = | Size = 1574259 bytes | Created Date = 11/16/2008 7:56:18 PM | Attr = HS]
epgxpxxv.dll -> %SystemRoot%\System32\epgxpxxv.dll -> [Ver = | Size = 124928 bytes | Created Date = 11/17/2008 7:55:45 PM | Attr = ]
gpvntx.dll -> %SystemRoot%\System32\gpvntx.dll -> [Ver = | Size = 124928 bytes | Created Date = 11/18/2008 7:55:17 PM | Attr = ]
hdshutoi.dll -> %SystemRoot%\System32\hdshutoi.dll -> [Ver = | Size = 68096 bytes | Created Date = 11/17/2008 7:58:48 PM | Attr = ]
hgGyxWQK.dll -> %SystemRoot%\System32\hgGyxWQK.dll -> [Ver = | Size = 25600 bytes | Created Date = 11/19/2008 11:40:58 PM | Attr = ]
hnfittqtgdk.dll -> %SystemRoot%\System32\hnfittqtgdk.dll -> [Ver = 2, 5, 0, 0 | Size = 190976 bytes | Created Date = 10/30/2008 10:23:04 AM | Attr = ]
iesvcmon.exe -> %SystemRoot%\System32\iesvcmon.exe -> System Service [Ver = 1.02.0004 | Size = 465920 bytes | Created Date = 11/19/2008 11:16:31 PM | Attr = ]
iotuhsdh.ini -> %SystemRoot%\System32\iotuhsdh.ini -> [Ver = | Size = 1574259 bytes | Created Date = 11/17/2008 7:58:49 PM | Attr = HS]
jzcxhe.dll -> %SystemRoot%\System32\jzcxhe.dll -> [Ver = | Size = 129024 bytes | Created Date = 11/20/2008 8:04:15 PM | Attr = ]
kdstmnfc.dll -> %SystemRoot%\System32\kdstmnfc.dll -> [Ver = | Size = 124928 bytes | Created Date = 11/18/2008 7:55:15 PM | Attr = ]
ldhnpg.dll -> %SystemRoot%\System32\ldhnpg.dll -> [Ver = | Size = 129024 bytes | Created Date = 11/19/2008 8:01:12 PM | Attr = ]
lvyqzp.dll -> %SystemRoot%\System32\lvyqzp.dll -> [Ver = | Size = 124928 bytes | Created Date = 11/17/2008 7:55:46 PM | Attr = ]
msansspc.dll -> %SystemRoot%\System32\msansspc.dll -> [Ver = | Size = 26624 bytes | Created Date = 11/16/2008 7:47:59 PM | Attr = ]
nsq3EA.dll -> %SystemRoot%\System32\nsq3EA.dll -> [Ver = 4, 6, 3, 5 | Size = 554496 bytes | Created Date = 10/28/2008 8:21:50 AM | Attr = ]
ptsmhk.dll -> %SystemRoot%\System32\ptsmhk.dll -> [Ver = | Size = 124928 bytes | Created Date = 11/16/2008 7:54:10 PM | Attr = ]
qoMccCsS.dll -> %SystemRoot%\System32\qoMccCsS.dll -> [Ver = | Size = 25600 bytes | Created Date = 11/21/2008 12:36:38 AM | Attr = ]
rgvlalld.dll -> %SystemRoot%\System32\rgvlalld.dll -> [Ver = | Size = 124928 bytes | Created Date = 11/16/2008 7:54:09 PM | Attr = ]
texpzbixgvrydzo.exe -> %SystemRoot%\System32\texpzbixgvrydzo.exe -> [Ver = | Size = 77897 bytes | Created Date = 11/19/2008 11:16:56 PM | Attr = ]
thsncwlb.dll -> %SystemRoot%\System32\thsncwlb.dll -> [Ver = | Size = 129024 bytes | Created Date = 11/19/2008 8:01:08 PM | Attr = ]
vtbtmyki.ini -> %SystemRoot%\System32\vtbtmyki.ini -> [Ver = | Size = 1496340 bytes | Created Date = 11/19/2008 7:58:19 PM | Attr = HS]
vtUomnOF.dll -> %SystemRoot%\System32\vtUomnOF.dll -> [Ver = | Size = 25600 bytes | Created Date = 11/21/2008 12:36:37 AM | Attr = ]
wciursxt.dll -> %SystemRoot%\System32\wciursxt.dll -> [Ver = | Size = 129024 bytes | Created Date = 11/20/2008 8:04:08 PM | Attr = ]
XISBayay.ini -> %SystemRoot%\System32\XISBayay.ini -> [Ver = | Size = 917089 bytes | Created Date = 11/16/2008 7:53:12 PM | Attr = HS]
XISBayay.ini2 -> %SystemRoot%\System32\XISBayay.ini2 -> [Ver = | Size = 917089 bytes | Created Date = 11/16/2008 7:53:12 PM | Attr = HS]
xwfismka.ini -> %SystemRoot%\System32\xwfismka.ini -> [Ver = | Size = 1632503 bytes | Created Date = 11/20/2008 7:58:23 PM | Attr = HS]
yayaBSIX.dll -> %SystemRoot%\System32\yayaBSIX.dll -> [Ver = | Size = 313856 bytes | Created Date = 11/16/2008 7:53:04 PM | Attr = ]
yayxwVpp.dll -> %SystemRoot%\System32\yayxwVpp.dll -> [Ver = | Size = 25600 bytes | Created Date = 11/16/2008 7:48:02 PM | Attr = ]
atmoUn.exe -> %SystemRoot%\atmoUn.exe -> [Ver = | Size = 37027 bytes | Created Date = 11/20/2008 12:33:52 AM | Attr = ]
gmer.dll -> %SystemRoot%\gmer.dll -> [Ver = 1, 0, 14, 14536 | Size = 884736 bytes | Created Date = 11/20/2008 7:31:28 PM | Attr = ]
gmer.exe -> %SystemRoot%\gmer.exe -> [Ver = 1, 0, 14, 14536 | Size = 811008 bytes | Created Date = 11/20/2008 7:31:27 PM | Attr = ]
gmer.ini -> %SystemRoot%\gmer.ini -> [Ver = | Size = 250 bytes | Created Date = 11/20/2008 7:31:58 PM | Attr = ]
gmer_uninstall.cmd -> %SystemRoot%\gmer_uninstall.cmd -> [Ver = | Size = 80 bytes | Created Date = 11/20/2008 7:31:29 PM | Attr = ]
SmFzb24gU2FsYXM -> %SystemRoot%\SmFzb24gU2FsYXM -> [Folder | Created Date = 11/20/2008 8:15:39 PM | Attr = HS]
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
XoftSpySE 2.job -> %SystemRoot%\tasks\XoftSpySE 2.job -> [Ver = | Size = 460 bytes | Created Date = 11/17/2008 10:35:20 PM | Attr = ]
XoftSpySE.job -> %SystemRoot%\tasks\XoftSpySE.job -> [Ver = | Size = 374 bytes | Created Date = 11/17/2008 10:35:18 PM | Attr = ]
[Files Created - Additional Folder Scans - Non-Microsoft Only]
gadcom -> %AppData%\gadcom -> [Folder | Created Date = 11/21/2008 9:44:55 AM | Attr = ]
SpeedRunner -> %AppData%\SpeedRunner -> [Folder | Created Date = 11/17/2008 8:09:32 PM | Attr = ]
Twain -> %AppData%\Twain -> [Folder | Created Date = 11/17/2008 8:04:31 PM | Attr = ]
dds.scr -> %UserProfile%\Desktop\dds.scr -> [Ver = | Size = 356463 bytes | Created Date = 11/20/2008 7:28:03 PM | Attr = ]
gmer.text -> %UserProfile%\Desktop\gmer.text -> [Ver = | Size = 950724 bytes | Created Date = 11/20/2008 10:00:17 PM | Attr = ]
ingredients list for the week.doc -> %UserProfile%\Desktop\ingredients list for the week.doc -> [Ver = | Size = 31232 bytes | Created Date = 11/02/2008 11:50:39 PM | Attr = ]
OTScanIt -> %UserProfile%\Desktop\OTScanIt -> [Folder | Created Date = 11/21/2008 11:09:18 AM | Attr = ]
1 C:\Documents and Settings\Jason Salas\Desktop\*.tmp files -> C:\Documents and Settings\Jason Salas\Desktop\*.tmp ->
OTScanIt.exe -> %UserProfile%\Desktop\OTScanIt.exe -> [Ver = | Size = 576581 bytes | Created Date = 11/21/2008 11:08:27 AM | Attr = ]
XoftSpySE.lnk -> %UserProfile%\Desktop\XoftSpySE.lnk -> [Ver = | Size = 682 bytes | Created Date = 11/17/2008 10:35:12 PM | Attr = ]
XoftSpySE_Setup.exe -> %UserProfile%\Desktop\XoftSpySE_Setup.exe -> ParetoLogic Inc. [Ver = 4.31.0.10 | Size = 3472016 bytes | Created Date = 11/17/2008 10:34:01 PM | Attr = ]
GetPack -> %ProgramFiles%\GetPack -> [Folder | Created Date = 11/18/2008 11:16:15 PM | Attr = ]
iCheck -> %ProgramFiles%\iCheck -> [Folder | Created Date = 11/18/2008 11:16:15 PM | Attr = ]
InetGet2 -> %ProgramFiles%\InetGet2 -> [Folder | Created Date = 11/20/2008 8:15:15 PM | Attr = ]
Mjcore -> %ProgramFiles%\Mjcore -> [Folder | Created Date = 11/20/2008 6:14:11 PM | Attr = ]
Network Monitor -> %ProgramFiles%\Network Monitor -> [Folder | Created Date = 11/20/2008 8:15:39 PM | Attr = ]
Webtools -> %ProgramFiles%\Webtools -> [Folder | Created Date = 11/20/2008 6:19:09 PM | Attr = ]
XoftSpySE -> %ProgramFiles%\XoftSpySE -> [Folder | Created Date = 11/17/2008 10:35:12 PM | Attr = ]
[Files/Folders - Modified Within 30 days]
4 C:\*.tmp files -> C:\*.tmp ->
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 804331520 bytes | Modified Date = 11/21/2008 10:12:59 AM | Attr = HS]
gmer.sys -> %SystemRoot%\System32\drivers\gmer.sys -> GMER [Ver = 1, 0, 14, 4401 | Size = 85969 bytes | Modified Date = 11/20/2008 7:31:29 PM | Attr = ]
akmsifwx.dll -> %SystemRoot%\System32\akmsifwx.dll -> [Ver = | Size = 72704 bytes | Modified Date = 11/20/2008 7:58:09 PM | Attr = ]
byXOhGvu.dll -> %SystemRoot%\System32\byXOhGvu.dll -> [Ver = | Size = 25600 bytes | Modified Date = 11/16/2008 7:48:01 PM | Attr = ]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
cont_adsoftinc-remove.exe -> %SystemRoot%\System32\cont_adsoftinc-remove.exe -> [Ver = | Size = 53938 bytes | Modified Date = 11/19/2008 11:19:14 PM | Attr = ]
ddcCVonk.dll -> %SystemRoot%\System32\ddcCVonk.dll -> [Ver = | Size = 25600 bytes | Modified Date = 11/19/2008 11:40:57 PM | Attr = ]
ekpdequs.ini -> %SystemRoot%\System32\ekpdequs.ini -> [Ver = | Size = 1574259 bytes | Modified Date = 11/17/2008 7:56:59 PM | Attr = HS]
epgxpxxv.dll -> %SystemRoot%\System32\epgxpxxv.dll -> [Ver = | Size = 124928 bytes | Modified Date = 11/17/2008 7:55:46 PM | Attr = ]
FNTCACHE.DAT -> %SystemRoot%\System32\FNTCACHE.DAT -> [Ver = | Size = 332280 bytes | Modified Date = 11/07/2008 1:15:37 AM | Attr = ]
gpvntx.dll -> %SystemRoot%\System32\gpvntx.dll -> [Ver = | Size = 124928 bytes | Modified Date = 11/18/2008 7:55:17 PM | Attr = ]
hdshutoi.dll -> %SystemRoot%\System32\hdshutoi.dll -> [Ver = | Size = 68096 bytes | Modified Date = 11/17/2008 7:58:49 PM | Attr = ]
hgGyxWQK.dll -> %SystemRoot%\System32\hgGyxWQK.dll -> [Ver = | Size = 25600 bytes | Modified Date = 11/19/2008 11:40:57 PM | Attr = ]
hnfittqtgdk.dll -> %SystemRoot%\System32\hnfittqtgdk.dll -> [Ver = 2, 5, 0, 0 | Size = 190976 bytes | Modified Date = 10/30/2008 10:23:04 AM | Attr = ]
iesvcmon.exe -> %SystemRoot%\System32\iesvcmon.exe -> System Service [Ver = 1.02.0004 | Size = 465920 bytes | Modified Date = 11/19/2008 11:16:31 PM | Attr = ]
iotuhsdh.ini -> %SystemRoot%\System32\iotuhsdh.ini -> [Ver = | Size = 1574259 bytes | Modified Date = 11/17/2008 7:59:02 PM | Attr = HS]
jzcxhe.dll -> %SystemRoot%\System32\jzcxhe.dll -> [Ver = | Size = 129024 bytes | Modified Date = 11/20/2008 8:04:14 PM | Attr = ]
kdstmnfc.dll -> %SystemRoot%\System32\kdstmnfc.dll -> [Ver = | Size = 124928 bytes | Modified Date = 11/18/2008 7:55:17 PM | Attr = ]
ldhnpg.dll -> %SystemRoot%\System32\ldhnpg.dll -> [Ver = | Size = 129024 bytes | Modified Date = 11/19/2008 8:01:11 PM | Attr = ]
lvyqzp.dll -> %SystemRoot%\System32\lvyqzp.dll -> [Ver = | Size = 124928 bytes | Modified Date = 11/17/2008 7:55:46 PM | Attr = ]
msansspc.dll -> %SystemRoot%\System32\msansspc.dll -> [Ver = | Size = 26624 bytes | Modified Date = 11/16/2008 7:47:59 PM | Attr = ]
nsq3EA.dll -> %SystemRoot%\System32\nsq3EA.dll -> [Ver = 4, 6, 3, 5 | Size = 554496 bytes | Modified Date = 10/28/2008 8:21:50 AM | Attr = ]
ptsmhk.dll -> %SystemRoot%\System32\ptsmhk.dll -> [Ver = | Size = 124928 bytes | Modified Date = 11/16/2008 7:54:10 PM | Attr = ]
qoMccCsS.dll -> %SystemRoot%\System32\qoMccCsS.dll -> [Ver = | Size = 25600 bytes | Modified Date = 11/21/2008 12:36:37 AM | Attr = ]
rgvlalld.dll -> %SystemRoot%\System32\rgvlalld.dll -> [Ver = | Size = 124928 bytes | Modified Date = 11/16/2008 7:54:10 PM | Attr = ]
texpzbixgvrydzo.exe -> %SystemRoot%\System32\texpzbixgvrydzo.exe -> [Ver = | Size = 77897 bytes | Modified Date = 11/19/2008 11:18:50 PM | Attr = ]
thsncwlb.dll -> %SystemRoot%\System32\thsncwlb.dll -> [Ver = | Size = 129024 bytes | Modified Date = 11/19/2008 8:01:11 PM | Attr = ]
vtbtmyki.ini -> %SystemRoot%\System32\vtbtmyki.ini -> [Ver = | Size = 1496340 bytes | Modified Date = 11/20/2008 7:04:40 PM | Attr = HS]
vtUomnOF.dll -> %SystemRoot%\System32\vtUomnOF.dll -> [Ver = | Size = 25600 bytes | Modified Date = 11/21/2008 12:36:37 AM | Attr = ]
wciursxt.dll -> %SystemRoot%\System32\wciursxt.dll -> [Ver = | Size = 129024 bytes | Modified Date = 11/20/2008 8:04:14 PM | Attr = ]
WPA.DBL -> %SystemRoot%\System32\WPA.DBL -> [Ver = | Size = 1170 bytes | Modified Date = 11/21/2008 10:16:31 AM | Attr = ]
XISBayay.ini -> %SystemRoot%\System32\XISBayay.ini -> [Ver = | Size = 917089 bytes | Modified Date = 11/21/2008 11:14:18 AM | Attr = HS]
XISBayay.ini2 -> %SystemRoot%\System32\XISBayay.ini2 -> [Ver = | Size = 917089 bytes | Modified Date = 11/21/2008 11:12:07 AM | Attr = HS]
xwfismka.ini -> %SystemRoot%\System32\xwfismka.ini -> [Ver = | Size = 1632503 bytes | Modified Date = 11/20/2008 7:58:47 PM | Attr = HS]
yayaBSIX.dll -> %SystemRoot%\System32\yayaBSIX.dll -> [Ver = | Size = 313856 bytes | Modified Date = 11/16/2008 7:53:11 PM | Attr = ]
yayxwVpp.dll -> %SystemRoot%\System32\yayxwVpp.dll -> [Ver = | Size = 25600 bytes | Modified Date = 11/16/2008 7:48:01 PM | Attr = ]
3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
atmoUn.exe -> %SystemRoot%\atmoUn.exe -> [Ver = | Size = 37027 bytes | Modified Date = 11/20/2008 12:33:52 AM | Attr = ]
BOOTSTAT.DAT -> %SystemRoot%\BOOTSTAT.DAT -> [Ver = | Size = 2048 bytes | Modified Date = 11/21/2008 10:13:05 AM | Attr = S]
gmer.dll -> %SystemRoot%\gmer.dll -> [Ver = 1, 0, 14, 14536 | Size = 884736 bytes | Modified Date = 11/20/2008 7:31:29 PM | Attr = ]
gmer.ini -> %SystemRoot%\gmer.ini -> [Ver = | Size = 250 bytes | Modified Date = 11/20/2008 7:34:14 PM | Attr = ]
gmer_uninstall.cmd -> %SystemRoot%\gmer_uninstall.cmd -> [Ver = | Size = 80 bytes | Modified Date = 11/20/2008 7:31:29 PM | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1393 bytes | Modified Date = 11/13/2008 9:11:11 PM | Attr = ]
WIN.INI -> %SystemRoot%\WIN.INI -> [Ver = | Size = 699 bytes | Modified Date = 11/13/2008 9:19:17 PM | Attr = ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> [Ver = | Size = 284 bytes | Modified Date = 11/21/2008 10:58:33 AM | Attr = ]
At1.job -> %SystemRoot%\tasks\At1.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 12:50:00 AM | Attr = ]
At10.job -> %SystemRoot%\tasks\At10.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 9:00:00 AM | Attr = ]
At11.job -> %SystemRoot%\tasks\At11.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 10:00:13 AM | Attr = ]
At12.job -> %SystemRoot%\tasks\At12.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 11:00:00 AM | Attr = ]
At13.job -> %SystemRoot%\tasks\At13.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 12:00:00 PM | Attr = ]
At14.job -> %SystemRoot%\tasks\At14.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 1:00:00 PM | Attr = ]
At15.job -> %SystemRoot%\tasks\At15.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 2:00:00 PM | Attr = ]
At16.job -> %SystemRoot%\tasks\At16.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 3:00:00 PM | Attr = ]
At17.job -> %SystemRoot%\tasks\At17.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 4:00:00 PM | Attr = ]
At18.job -> %SystemRoot%\tasks\At18.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 5:00:00 PM | Attr = ]
At19.job -> %SystemRoot%\tasks\At19.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 6:00:00 PM | Attr = ]
At2.job -> %SystemRoot%\tasks\At2.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 1:00:00 AM | Attr = ]
At20.job -> %SystemRoot%\tasks\At20.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 7:00:02 PM | Attr = ]
At21.job -> %SystemRoot%\tasks\At21.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 8:00:02 PM | Attr = ]
At22.job -> %SystemRoot%\tasks\At22.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 9:00:00 PM | Attr = ]
At23.job -> %SystemRoot%\tasks\At23.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 10:00:00 PM | Attr = ]
At24.job -> %SystemRoot%\tasks\At24.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 11:00:00 PM | Attr = ]
At25.job -> %SystemRoot%\tasks\At25.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 12:16:00 AM | Attr = ]
At26.job -> %SystemRoot%\tasks\At26.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 1:00:00 AM | Attr = ]
At27.job -> %SystemRoot%\tasks\At27.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 2:00:00 AM | Attr = ]
At28.job -> %SystemRoot%\tasks\At28.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 3:00:00 AM | Attr = ]
At29.job -> %SystemRoot%\tasks\At29.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 4:00:00 AM | Attr = ]
At3.job -> %SystemRoot%\tasks\At3.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 2:00:00 AM | Attr = ]
At30.job -> %SystemRoot%\tasks\At30.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 5:00:00 AM | Attr = ]
At31.job -> %SystemRoot%\tasks\At31.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 6:00:00 AM | Attr = ]
At32.job -> %SystemRoot%\tasks\At32.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 7:00:00 AM | Attr = ]
At33.job -> %SystemRoot%\tasks\At33.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 8:00:00 AM | Attr = ]
At34.job -> %SystemRoot%\tasks\At34.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 9:00:00 AM | Attr = ]
At35.job -> %SystemRoot%\tasks\At35.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 10:00:14 AM | Attr = ]
At36.job -> %SystemRoot%\tasks\At36.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 11:00:01 AM | Attr = ]
At37.job -> %SystemRoot%\tasks\At37.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 12:00:00 PM | Attr = ]
At38.job -> %SystemRoot%\tasks\At38.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 1:00:00 PM | Attr = ]
At39.job -> %SystemRoot%\tasks\At39.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 2:00:00 PM | Attr = ]
At4.job -> %SystemRoot%\tasks\At4.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 3:00:00 AM | Attr = ]
At40.job -> %SystemRoot%\tasks\At40.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 3:00:00 PM | Attr = ]
At41.job -> %SystemRoot%\tasks\At41.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 4:00:00 PM | Attr = ]
At42.job -> %SystemRoot%\tasks\At42.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 5:00:00 PM | Attr = ]
At43.job -> %SystemRoot%\tasks\At43.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 6:00:00 PM | Attr = ]
At44.job -> %SystemRoot%\tasks\At44.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 7:00:03 PM | Attr = ]
At45.job -> %SystemRoot%\tasks\At45.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 8:00:02 PM | Attr = ]
At46.job -> %SystemRoot%\tasks\At46.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 9:00:00 PM | Attr = ]
At47.job -> %SystemRoot%\tasks\At47.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 10:00:00 PM | Attr = ]
At48.job -> %SystemRoot%\tasks\At48.job -> [Ver = | Size = 350 bytes | Modified Date = 11/20/2008 11:00:00 PM | Attr = ]
At5.job -> %SystemRoot%\tasks\At5.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 4:00:00 AM | Attr = ]
At6.job -> %SystemRoot%\tasks\At6.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 5:00:00 AM | Attr = ]
At7.job -> %SystemRoot%\tasks\At7.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 6:00:00 AM | Attr = ]
At8.job -> %SystemRoot%\tasks\At8.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 7:00:00 AM | Attr = ]
At9.job -> %SystemRoot%\tasks\At9.job -> [Ver = | Size = 350 bytes | Modified Date = 11/21/2008 8:00:00 AM | Attr = ]
Pareto UNS.job -> %SystemRoot%\tasks\Pareto UNS.job -> [Ver = | Size = 418 bytes | Modified Date = 11/18/2008 6:00:00 PM | Attr = ]
ParetoLogic Anti-Spyware.job -> %SystemRoot%\tasks\ParetoLogic Anti-Spyware.job -> [Ver = | Size = 436 bytes | Modified Date = 11/21/2008 3:00:00 AM | Attr = ]
ParetoLogic Update.job -> %SystemRoot%\tasks\ParetoLogic Update.job -> [Ver = | Size = 424 bytes | Modified Date = 11/20/2008 12:33:00 AM | Attr = ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 11/21/2008 10:13:39 AM | Attr = H ]
XoftSpySE 2.job -> %SystemRoot%\tasks\XoftSpySE 2.job -> [Ver = | Size = 460 bytes | Modified Date = 11/21/2008 10:13:48 AM | Attr = ]
XoftSpySE.job -> %SystemRoot%\tasks\XoftSpySE.job -> [Ver = | Size = 374 bytes | Modified Date = 11/18/2008 6:04:06 AM | Attr = ]
C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache -> [Folder | Modified Date = 06/05/2003 12:29:46 PM | Attr = ]
about.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache\about.dat -> [Ver = | Size = 1528 bytes | Modified Date = 07/17/2002 10:00:00 AM | Attr = ]
college.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache\college.dat -> [Ver = | Size = 327746 bytes | Modified Date = 07/17/2002 10:00:00 AM | Attr = ]
ylpgscat.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Money\11.0\Webcache\ylpgscat.dat -> [Ver = | Size = 12283223 bytes | Modified Date = 07/17/2002 10:00:00 AM | Attr = ]
C:\Documents and Settings\All Users\Application Data\Microsoft\MSDAIPP\Offline\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\MSDAIPP\Offline -> [Folder | Modified Date = 09/30/2003 4:53:20 PM | Attr = ]
HashFile.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\MSDAIPP\Offline\HashFile.dat -> [Ver = | Size = 102412 bytes | Modified Date = 09/30/2003 4:53:20 PM | Attr = ]
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader -> [Folder | Modified Date = 06/05/2003 12:37:31 PM | Attr = ]
qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [Ver = | Size = 4232 bytes | Modified Date = 11/11/2008 11:49:54 PM | Attr = ]
qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [Ver = | Size = 4646 bytes | Modified Date = 11/11/2008 11:49:54 PM | Attr = ]
C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data -> [Folder | Modified Date = 10/21/2008 9:54:02 AM | Attr = ]
data.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\data.dat -> [Ver = | Size = 1388 bytes | Modified Date = 08/09/2005 9
14 PM | Attr = ]
opa11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Office\Data\opa11.dat -> [Ver = | Size = 11068 bytes | Modified Date = 10/21/2008 9:54:36 AM | Attr = ]
C:\Documents and Settings\All Users\Application Data\Microsoft\Works\ -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works -> [Folder | Modified Date = 03/17/2008 3:12:08 PM | Attr = ]
wkcalcat.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wkcalcat.dat -> [Ver = | Size = 16384 bytes | Modified Date = 10/20/2003 4:48:28 PM | Attr = ]
wklntnts.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wklntnts.dat -> [Ver = | Size = 1424304 bytes | Modified Date = 11/21/2008 12:09:25 AM | Attr = ]
wklntsk.dat -> C:\Documents and Settings\All Users\Application
Data\Microsoft\Works\wklntsk.dat -> [Ver = | Size = 1424304 bytes | Modified Date = 11/21/2008 12:09:25 AM | Attr = ]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0 -> [Folder | Modified Date = 11/20/2008 10:08:42 PM | Attr = ]
notifykeysB.com -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\notifykeysB.com -> [Ver = | Size = 148 bytes | Modified Date = 11/11/2008 1:16:40 PM | Attr = ]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp -> [Folder | Modified Date = 11/21/2008 11:14:22 AM | Attr = ]
79.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\79.exe -> [Ver = | Size = 605643 bytes | Modified Date = 11/19/2008 11:16:36 PM | Attr = ]
cmdinst.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\cmdinst.exe -> [Ver = 1.0.1 | Size = 852566 bytes | Modified Date = 11/20/2008 8:15:32 PM | Attr = ]
CTPBSEQ.EXE -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\CTPBSEQ.EXE -> Creative Technology Ltd. [Ver = 1, 0, 0, 5 | Size = 65536 bytes | Modified Date = 03/11/2007 7:05:00 PM | Attr = R ]
mondrver_1110_nathan_old.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\mondrver_1110_nathan_old.exe -> [Ver = 1.00 | Size = 495616 bytes | Modified Date = 11/19/2008 11:16:28 PM | Attr = ]
orz.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\orz.exe -> [Ver = 1.0.0.18 | Size = 62464 bytes | Modified Date = 11/18/2008 11:20:54 PM | Attr = ]
wJQs.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\wJQs.exe -> [Ver = | Size = 26624 bytes | Modified Date = 11/19/2008 11:40:50 PM | Attr = ]
44 C:\Documents and Settings\Jason Salas\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\*.tmp ->
C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0 -> [Folder | Modified Date = 11/20/2008 10:08:42 PM | Attr = ]
FI.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\FI.exe -> [Ver = | Size = 110592 bytes | Modified Date = 11/12/2002 5:38:32 AM | Attr = ]
MSClsid.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\MSClsid.exe -> [Ver = | Size = 1720 bytes | Modified Date = 11/14/2008 1:23:17 PM | Attr = ]
Policies.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\Policies.exe -> [Ver = | Size = 1720 bytes | Modified Date = 11/14/2008 11:21:49 AM | Attr = ]
WREGS.exe -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\WREGS.exe -> SteelWerX [Ver = 3.0.0.0 | Size = 518144 bytes | Modified Date = 08/31/2000 8:00:00 AM | Attr = ]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp -> [Folder | Modified Date = 11/21/2008 11:14:22 AM | Attr = ]
IadHide5.dll -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\IadHide5.dll -> BackWeb [Ver = Version 6.3.2 (Build 62R) | Size = 24613 bytes | Modified Date = 02/11/2004 4:58:16 PM | Attr = ]
44 C:\Documents and Settings\Jason Salas\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\*.tmp ->
C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0 -> [Folder | Modified Date = 11/20/2008 10:08:42 PM | Attr = ]
SvcWhtDDS.dll -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\SvcWhtDDS.dll -> [Ver = | Size = 54628 bytes | Modified Date = 11/11/2008 6:21:44 PM | Attr = ]
SvcWhtDDSVista.dll -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\RarSFX0\SvcWhtDDSVista.dll -> [Ver = | Size = 16308 bytes | Modified Date = 11/11/2008 4:15:56 PM | Attr = ]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp -> [Folder | Modified Date = 11/21/2008 11:14:22 AM | Attr = ]
8hNyuW5P.dat -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\8hNyuW5P.dat -> [Ver = | Size = 4227 bytes | Modified Date = 11/21/2008 9:08:45 AM | Attr = ]
44 C:\Documents and Settings\Jason Salas\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\*.tmp ->
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Cookies\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Cookies -> [Folder | Modified Date = 08/21/2008 5
51 AM | Attr = HS]
index.dat -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Cookies\index.dat -> [Ver = | Size = 16384 bytes | Modified Date = 08/21/2008 5
48 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\History\History.IE5\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\History\History.IE5\ -> [Folder | Modified Date = 11/21/2008 10:43:36 AM | Attr = HS]
index.dat -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\History\History.IE5\index.dat -> [Ver = | Size = 16384 bytes | Modified Date = 08/21/2008 5
48 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\ -> [Folder | Modified Date = 08/21/2008 5
48 AM | Attr = HS]
index.dat -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat -> [Ver = | Size = 32768 bytes | Modified Date = 08/21/2008 5
48 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\ -> [Folder | Modified Date = 08/21/2008 5
48 AM | Attr = HS]
desktop.ini -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini -> [Ver = | Size = 0 bytes | Modified Date = 08/21/2008 5
48 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\2IQENZWG\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\2IQENZWG -> [Folder | Modified Date = 11/21/2008 10:43:35 AM | Attr = HS]
desktop.ini -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\2IQENZWG\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 08/21/2008 5
54 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8X8KR62E\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8X8KR62E -> [Folder | Modified Date = 11/21/2008 10:43:35 AM | Attr = HS]
desktop.ini -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8X8KR62E\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 08/21/2008 5
54 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CP0LZTQT\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CP0LZTQT -> [Folder | Modified Date = 11/21/2008 10:43:35 AM | Attr = HS]
desktop.ini -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CP0LZTQT\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 08/21/2008 5
54 AM | Attr = HS]
C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\RX6G6G29\ -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\RX6G6G29 -> [Folder | Modified Date = 11/21/2008 10:43:35 AM | Attr = HS]
desktop.ini -> C:\Documents and Settings\Jason Salas\Local Settings\Temp\Temporary Internet Files\Content.IE5\RX6G6G29\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 08/21/2008 5
54 AM | Attr = HS]
C:\WINDOWS\Temp\ -> C:\WINDOWS\Temp -> [Folder | Modified Date = 11/21/2008 10:15:14 AM | Attr = ]
8hNyuW5P.dat -> C:\WINDOWS\Temp\8hNyuW5P.dat -> [Ver = | Size = 15543 bytes | Modified Date = 08/22/2008 11:00:04 PM | Attr = ]
N5t20dSv.dat -> C:\WINDOWS\Temp\N5t20dSv.dat -> [Ver = | Size = 8669 bytes | Modified Date = 08/19/2008 3:07:43 PM | Attr = ]
Perflib_Perfdata_588.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_588.dat -> [Ver = | Size = 16384 bytes | Modified Date = 08/19/2008 7:21:41 PM | Attr = ]
pP2HD0u0.dat -> C:\WINDOWS\Temp\pP2HD0u0.dat -> [Ver = | Size = 10599 bytes | Modified Date = 08/21/2008 7:01:18 PM | Attr = ]
sS5KG3x3.dat -> C:\WINDOWS\Temp\sS5KG3x3.dat -> [Ver = | Size = 10155 bytes | Modified Date = 08/22/2008 11:00:01 PM | Attr = ]
110 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp ->
C:\WINDOWS\Temp\Cookies\ -> C:\WINDOWS\Temp\Cookies -> [Folder | Modified Date = 11/20/2008 6:15:53 PM | Attr = HS]
index.dat -> C:\WINDOWS\Temp\Cookies\index.dat -> [Ver = | Size = 32768 bytes | Modified Date = 11/21/2008 7:48:37 AM | Attr = HS]
C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ -> [Folder | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
index.dat -> C:\WINDOWS\Temp\History\History.IE5\index.dat -> [Ver = | Size = 16384 bytes | Modified Date = 11/21/2008 7:48:37 AM | Attr = HS]
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> [Folder | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
index.dat -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat -> [Ver = | Size = 49152 bytes | Modified Date = 11/21/2008 7:48:37 AM | Attr = HS]
C:\WINDOWS\Temp\History\History.IE5\ -> C:\WINDOWS\Temp\History\History.IE5\ -> [Folder | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
desktop.ini -> C:\WINDOWS\Temp\History\History.IE5\desktop.ini -> [Ver = | Size = 145 bytes | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\ -> [Folder | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\CG8I0X7H\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\CG8I0X7H -> [Folder | Modified Date = 11/21/2008 7:48:41 AM | Attr = HS]
desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\CG8I0X7H\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G50LZR5N\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G50LZR5N -> [Folder | Modified Date = 08/15/2008 3:28:28 PM | Attr = HS]
desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\G50LZR5N\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\GIZOJ1P5\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\GIZOJ1P5 -> [Folder | Modified Date = 08/15/2008 3:28:29 PM | Attr = HS]
desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\GIZOJ1P5\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\XQSH2LUA\ -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\XQSH2LUA -> [Folder | Modified Date = 08/15/2008 3:28:28 PM | Attr = HS]
desktop.ini -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\XQSH2LUA\desktop.ini -> [Ver = | Size = 67 bytes | Modified Date = 10/02/2007 11:17:56 PM | Attr = HS]
[Files Modified - Additional Folder Scans - Non-Microsoft Only]
GDIPFONTCACHEV1.DAT -> %UserProfile%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT -> [Ver = | Size = 100288 bytes | Modified Date = 11/07/2008 8:07:48 AM | Attr = ]
70 C:\Documents and Settings\Jason Salas\My Documents\*.tmp files -> C:\Documents and Settings\Jason Salas\My Documents\*.tmp ->
dds.scr -> %UserProfile%\Desktop\dds.scr -> [Ver = | Size = 356463 bytes | Modified Date = 11/20/2008 7:26:55 PM | Attr = ]
gmer.text -> %UserProfile%\Desktop\gmer.text -> [Ver = | Size = 950724 bytes | Modified Date = 11/20/2008 10:00:17 PM | Attr = ]
ingredients list for the week.doc -> %UserProfile%\Desktop\ingredients list for the week.doc -> [Ver = | Size = 31232 bytes | Modified Date = 11/02/2008 11:50:39 PM | Attr = ]
1 C:\Documents and Settings\Jason Salas\Desktop\*.tmp files -> C:\Documents and Settings\Jason Salas\Desktop\*.tmp ->
OTScanIt.exe -> %UserProfile%\Desktop\OTScanIt.exe -> [Ver = | Size = 576581 bytes | Modified Date = 11/21/2008 11:08:05 AM | Attr = ]
XoftSpySE.lnk -> %UserProfile%\Desktop\XoftSpySE.lnk -> [Ver = | Size = 682 bytes | Modified Date = 11/17/2008 10:35:12 PM | Attr = ]
XoftSpySE_Setup.exe -> %UserProfile%\Desktop\XoftSpySE_Setup.exe -> ParetoLogic Inc. [Ver = 4.31.0.10 | Size = 3472016 bytes | Modified Date = 11/17/2008 10:34:41 PM | Attr = ]
[CatchMe Rootkit Scan by GMER]
< Windows folder & sub-folders >
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
< Document and Settings folder & sub folders >
scanning hidden files ...
C:\Documents and Settings\All Users\Documents\My Music\Sample Music\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\All Users\Documents\My Music\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\Desktop\My Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\Desktop\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\Favorites\dcmountainbikeclub Desperation Church Mountain Bike Club.url:favicon 1406 bytes
C:\Documents and Settings\Jason Salas\Favorites\Heartland Racing - Home.url:favicon 1150 bytes
C:\Documents and Settings\Jason Salas\My Documents\DESPERATE\LCC Site Work\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\DESPERATE\LCC Site Work\Zip Photos\DC_web_pix_vol2\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\DESPERATE\LCC Site Work\Zip Photos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\DESPERATE\PROM\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\Copy of My Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\Jason's UMKC work\Might be able to use for portfolio\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\thrift store listing_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Music\mb\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Music\Musicmatch downloads\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\100_FUJI\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Arie's Web Page\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Mia's ice cream\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\FAll 2008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\FISH\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\calendar\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Calendar 2007\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\calendar pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2004-11-23\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2004-12-07\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2004-12-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2004-12-20\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2004-12-21\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-01-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-01-20\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-02-15\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-03-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-03-18\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-04-21\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-13\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-16\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-21\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-25\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-06-26\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-07-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-07-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-08-02\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-09-02\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-09-14\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-09-17\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-09-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-10-02\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-11-02\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-11-09\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-12-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-12-12\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-01-12\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-01-18\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-01-28\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-02-12\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-02-16\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-02-21\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-01\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-02\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-06\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-20\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-05-20\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2005-10-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-05-12\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-03-23\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-04-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-04-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-04-11\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-04-19\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-05-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-05-11\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-06-03\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-06-07\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-06-16\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-06-23\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-06-26\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-07-13\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-07-18\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-07-21\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2006-07-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-01-17\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-01-27\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-01-31\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-02-03\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-02-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-02-11\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-02-19\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-02-25\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-02-27\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-03-03\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-03-09\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-03-13\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-03-18\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-03-25\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-04-10\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-04-11\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-04-20\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-05-05\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-05-15\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-05-16\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-05-21\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-06-02\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-06-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-06-24\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-07-05\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-07-26\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-07-30\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-07-31\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-08-06\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-08-18\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-09-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\2007-11-13\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\grandma's pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Kodak Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Luisas photos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\new baby xander\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Spring 2008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Spring 2008\2008-04-06\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Spring 2008\May 2008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Spring 2008\June 2008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Summer 2008\July August 2008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Summer 2008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Jason Salas\My Documents\My Pictures\Thumbs.db:encryptable 0 bytes
scan completed successfully
hidden files: 156
< End of report >
[/code]
