# Problem with what I suspect is spyware



## carrie_uk (Jul 7, 2004)

When I open up some web pages usually after doing a search, other web pages come up instead of the one that I want, usually of an unsavoury nature. I have tried to run virgin spyware scan but it has an error and shuts down, have tried to run adaware but when it tries to update an error happens at 5% of updating. I have also tried to install something else my brother uses (can't remember what it was) and it wouldn't install. So I would like some help finding out what is going on.

Thank you

Logfile of HijackThis v1.99.1
Scan saved at 15:35:41, on 18/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Programs\Mozy\mozybackup.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\Programs\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Programs\Mozy\mozystat.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Programs\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\msdtc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Virgin Broadband\PCguard\RPS.exe
C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\sol.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programs\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programs\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "D:\Games\Steam.exe" -silent
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - Startup: Mozy Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dixons.co.uk/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games  Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://webgames.d.tmsrv.com/c=aa7f6...dinerdash2/dinerdash2/DinerDash2.1.0.0.48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150484130343
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.piczo.com/images/uploader/ssiPictureUploader.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://help.broadbandassist.com/prequal/MotivePreQual.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games  Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab55579.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C5A151E-BCDF-4ED0-AFF6-BD65405351C0}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{56953BEB-1893-44FC-B2FD-59022E50B96B}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{98EFD24B-AD1A-471F-B48A-243F86C594CE}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF349E0B-DBC0-4230-AEAD-C2140BFE97D7}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{F07AC138-AD77-46B1-BC7F-7AB57C4135C8}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{F1245DBD-B268-46BC-8CB5-A19E865FE95A}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS1\Services\Tcpip\..\{4C5A151E-BCDF-4ED0-AFF6-BD65405351C0}: NameServer = 85.255.115.67,85.255.112.122
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Event Log Watch (LogWatch) - Logitech, Inc. - (no file)
O23 - Service: MozyHome Backup Service (MozyBackup) - Unknown owner - C:\Programs\Mozy\mozybackup.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe


----------



## carrie_uk (Jul 7, 2004)

I think I know what it is - when I shut the pc down it comes up with Uipopuphidden.exe is not responding.

Does anyone have a suggestion of getting rid of this and hopefully the spyware scans will work after it has gone


----------



## cybertech (Apr 16, 2002)

*Please print these instructions for reference, as you will have to restart your computer during the fix.*

Please download FixWareout from *Here* or *Here*.

*Note: You will need to run this tool while having an Internet Connection. The tool will download other files while running.*

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts.
If your firewall gives an alert, (because this tool will download an additional files from the internet), please don't let your firewall block it, but allow it instead.
You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
Once the desktop loads a text file will open (report.txt).
Please post the C:\fixwareout\*report.txt* ), along with a new HijackThis log into this thread.


----------



## carrie_uk (Jul 7, 2004)

Thank you, both done and posted

Username "Carrie" - 19/11/2007 18:25:38 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdhxx.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{4C5A151E-BCDF-4ED0-AFF6-BD65405351C0} 
"nameserver"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{56953BEB-1893-44FC-B2FD-59022E50B96B} 
"nameserver"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{98EFD24B-AD1A-471F-B48A-243F86C594CE} 
"nameserver"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AF349E0B-DBC0-4230-AEAD-C2140BFE97D7} 
"nameserver"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F07AC138-AD77-46B1-BC7F-7AB57C4135C8} 
"nameserver"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F1245DBD-B268-46BC-8CB5-A19E865FE95A} 
"nameserver"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{4C5A151E-BCDF-4ED0-AFF6-BD65405351C0}
"DhcpNameServer"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{56953BEB-1893-44FC-B2FD-59022E50B96B}
"DhcpNameServer"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AF349E0B-DBC0-4230-AEAD-C2140BFE97D7}
"DhcpNameServer"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{D54D09E3-0A73-4756-8E42-1DFE2E8A846D}
"DhcpNameServer"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F07AC138-AD77-46B1-BC7F-7AB57C4135C8}
"DhcpNameServer"="85.255.115.67,85.255.112.122" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F1245DBD-B268-46BC-8CB5-A19E865FE95A}
"DhcpNameServer"="85.255.115.67,85.255.112.122" <Value cleared.

Successfully flushed the DNS Resolver Cache.

System was rebooted successfully.

~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "system"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....
~~~~~ Other
C:\WINDOWS\Temp\kdhxx.ren 72213 13/06/2007

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CHotkey"="mHotkey.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"PinnacleDriverCheck"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"USB2Check"="RUNDLL32.EXE \"C:\\WINDOWS\\system32\\PCLECoInst.dll\",CheckUSBController"
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"Broadbandadvisor.exe"="\"C:\\Program Files\\Virgin Broadband\\advisor\\Broadbandadvisor.exe\" /AUTORUN"
"PCguard"="\"C:\\Program Files\\Virgin Broadband\\PCguard\\Rps.exe\""
"-FreedomNeedsReboot"="\"C:\\Program Files\\Virgin Broadband\\PCguard\\ZkRunOnceR.exe\""
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"QuickTime Task"="\"C:\\Programs\\QuickTime\\QTTask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Programs\\iTunes\\iTunesHelper.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe /c"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"msnmsgr"="~\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"Steam"="\"D:\\Games\\Steam.exe\" -silent"
"Aim6"=""
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 18:47:35, on 19/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Programs\Mozy\mozybackup.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\Program Files\Virgin Broadband\PCguard\Rps.exe
C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
C:\Programs\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Programs\Mozy\mozystat.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\Programs\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programs\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programs\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "D:\Games\Steam.exe" -silent
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - Startup: Mozy Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dixons.co.uk/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games  Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://webgames.d.tmsrv.com/c=aa7f6...dinerdash2/dinerdash2/DinerDash2.1.0.0.48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150484130343
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.piczo.com/images/uploader/ssiPictureUploader.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://help.broadbandassist.com/prequal/MotivePreQual.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games  Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab55579.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Event Log Watch (LogWatch) - Logitech, Inc. - (no file)
O23 - Service: MozyHome Backup Service (MozyBackup) - Unknown owner - C:\Programs\Mozy\mozybackup.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe


----------



## cybertech (Apr 16, 2002)

*Run HJT again and put a check in the following:*

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

*Close all applications and browser windows before you click "fix checked".*

Please *download* the *OTMoveIt by OldTimer*.

 *Save* it to your *desktop*.
 Please double-click *OTMoveIt.exe* to run it.
*Copy the file paths below to the clipboard* by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose copy):



> *C:\WINDOWS\Temp\kdhxx.ren*



 Return to OTMoveIt, right click on the *"Paste List of Files/Folders to be moved"* window and choose *Paste*.
Click the red *Moveit!* button.
Close *OTMoveIt*
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose *Yes.*








Your *Java* is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of *Java* components and upgrade the application. *Beware it is NOT supported for use in 9x or ME and probably will not install in those systems*

*Ugrading Java*: 

Download the latest version of *Java Runtime Environment (JRE) 6 update 3*.
Scroll down to where it says "*The J2SE Runtime Environment (JRE) allows end-users to run Java applications*".
Click the "*Download*" button to the right.
Check the box that says: "*Accept License Agreement*".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to *Start* > *Control Panel*, double-click on *Add/Remove *programs and remove all older versions of Java.
Check any item with Java Runtime Environment *(JRE or J2SE)* in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.

Please download *ATF Cleaner* by Atribune. 
*This program is for XP and Windows 2000 only*
 
Double-click *ATF-Cleaner.exe* to run the program. 
Under *Main* choose: *Select All* 
Click the *Empty Selected* button. 

Click *Exit* on the Main menu to close the program.

*Download and scan with* *SUPERAntiSpyware* Free for Home Users
Double-click *SUPERAntiSpyware.exe* and use the default settings for installation. 
An icon will be created on your desktop. Double-click that icon to launch the program. 
If asked to update the program definitions, click "*Yes*". If not, update the definitions before scanning by selecting "*Check for Updates*". (_If you encounter any problems while downloading the updates, manually download and unzip them from here._) 
Under "*Configuration and Preferences*", click the *Preferences* button. 
Click the *Scanning Control* tab. 
Under *Scanner Options* make sure the following are checked _(leave all others unchecked)_:
_Close browsers before scanning._ 
_Scan for tracking cookies._ 
_Terminate memory threats before quarantining._

Click the "*Close*" button to leave the control center screen. 
Back on the main screen, under "*Scan for Harmful Software*" click *Scan your computer*. 
On the left, make sure you check *C:\Fixed Drive*. 
On the right, under "*Complete Scan*", choose *Perform Complete Scan*. 
Click "*Next*" to start the scan. Please be patient while it scans your computer. 
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "*OK*". 
Make sure everything has a checkmark next to it and click "*Next*". 
A notification will appear that "_Quarantine and Removal is Complete_". Click "*OK*" and then click the "*Finish*" button to return to the main menu. 
If asked if you want to reboot, click "*Yes*". 
To retrieve the removal information after reboot, launch SUPERAntispyware again.
_Click *Preferences*, then click the *Statistics/Logs* tab._ 
_Under Scanner Logs, double-click *SUPERAntiSpyware Scan Log*._ 
_If there are several logs, click the current dated log and press *View log*. A text file will open in your default text editor._ 
*Please copy and paste the Scan Log results in your next reply with a new hijackthis log.*

Click *Close* to exit the program.


----------



## carrie_uk (Jul 7, 2004)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/20/2007 at 02:29 AM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type : Complete Scan
Total Scan Time : 06:46:37

Memory items scanned : 555
Memory threats detected : 0
Registry items scanned : 12641
Registry threats detected : 0
File items scanned : 271501
File threats detected : 0

Logfile of HijackThis v1.99.1
Scan saved at 07:33:33, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Programs\Mozy\mozybackup.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\Program Files\Virgin Broadband\PCguard\Rps.exe
C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
C:\Programs\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Programs\Mozy\mozystat.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\Programs\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programs\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programs\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "D:\Games\Steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - Startup: Mozy Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dixons.co.uk/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games  Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://webgames.d.tmsrv.com/c=aa7f6...dinerdash2/dinerdash2/DinerDash2.1.0.0.48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150484130343
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.piczo.com/images/uploader/ssiPictureUploader.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://help.broadbandassist.com/prequal/MotivePreQual.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games  Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab55579.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Event Log Watch (LogWatch) - Logitech, Inc. - (no file)
O23 - Service: MozyHome Backup Service (MozyBackup) - Unknown owner - C:\Programs\Mozy\mozybackup.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe


----------



## cybertech (Apr 16, 2002)

*Run HJT again and put a check in the following:*

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab

*Close all applications and browser windows before you click "fix checked".*

Looks fine, any problems?


----------



## carrie_uk (Jul 7, 2004)

Everything appears ok thank you, will let you know if not in the next few days


----------



## cybertech (Apr 16, 2002)

Sounds good.

You can and *should* remove all of the tools I requested you to download and/or folders associated with them now. It is pointless to keep these tools around as they are updated so frequently that the tools can be outdated within a few days, sometimes within just hours.

*OTMoveIt by OldTimer* has a *CleanUp!* option you can use to remove most of the fixes and associated files and folders if you want to use that. If you get a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet you should allow it to do so.

It's a good idea to Flush your System Restore after removing malware: 
Turn off system restore and then turn it back on: http://support.microsoft.com/kb/310405

Clean up your PC 

Here are some additional links for you to check out to help you with your computer security.

How did I get infected in the first place.

Secunia software inspector & update checker

Good free tools and advice on how to tighten your security settings.

Security Help Tools


----------



## carrie_uk (Jul 7, 2004)

The Uipopuphidden.exe is not responding is still there when I shut the machine down, no idea what it is

Carrie


----------



## cybertech (Apr 16, 2002)

Download *WinPFind3U.exe* to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

Open the WinPFind3u folder and double-click on *WinPFind3U.exe* to start the program.

In the *Processes * group click *ALL* 
In the *Win32 Services * group click *ALL* 
In the *Driver Services * group click *ALL* 
In the *Registry * group click *All* 
In the *Files Created Within* group click *60 days* Make sure Non-Microsoft only is *UNCHECKED*
In the *Files Modified Within* group select *30 days* Make sure Non-Microsoft only is *UNCHECKED*
In the *File String Search* group select *ALL*
in the Additional scans sections please press select *ALL* 
Now click the *Run Scan* button on the toolbar.
The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file but click on the "Format" menu and make sure that "word wrap" is not checked. If it is then click on it to uncheck it.
Please post the resulting log here as an attachment.


Click on the orange *Post a Reply!* button 
scroll down to Manage Attachments 
Click in the box that says Upload File from your Computer
Click the Browse... button and find the file then click open
Click the Upload button
Wait until you see *Current Attachment *and your file name
Click on Close this window
Then submit the reply.


----------



## carrie_uk (Jul 7, 2004)

I press on manage attachments and nothing happens, I have turned off the pop up blocker so I can't post the attachemt


----------



## cybertech (Apr 16, 2002)

*Click here* to download *Dr.Web CureIt* and save it to your desktop.

Doubleclick the *drweb-cureit.exe* file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the *green arrow* at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:








If so, click it and then click the next icon right below and select *Move incurable* as you'll see in next image:








This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click *file* and choose *save report list*
Save the report to your desktop. The report will be called *DrWeb.csv*
Close Dr.Web Cureit.
*Reboot* your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply along with a new Hijack This log.


----------



## carrie_uk (Jul 7, 2004)

I have run it and I have a list of virus's found but I can't see any icon like you have said to click on. I have a button to select all and then I can cure, rename, delete or move. What do I press?


----------



## cybertech (Apr 16, 2002)

Does this help? http://news.softpedia.com/images/reviews/large/DrWEBCureIt433_006_Large.png


----------



## carrie_uk (Jul 7, 2004)

yes those settings are correct but I still don't know what to do now as this bit isn't there, there is no icon that looks like the one in the thread with the red tick in. Do I select anything else or just save report list and reboot.

I want to know if I need to press select all and cure or something like that


----------



## cybertech (Apr 16, 2002)

You want to quarantaine if it can't be cured.


----------



## carrie_uk (Jul 7, 2004)

Yes I understand that I need to do that but I don't have the button with the red tick to press, I have a button that says select all and then if I press that I have the option to cure, rename, move or delete. Do I need to select all and then cure because it doesn't say that in the instructions that you posted


----------



## cybertech (Apr 16, 2002)

Let's do something else.

Please perform a scan with *Kaspersky Webscan Online Virus Scanner*

1. Read the Requirements and Privacy statement, then select "*Accept*". 
2. A new window will appear promting you to install an ActiveX component from Kaspersky - "*Do you want to install this software*?". 
3. Click "*Yes*" or select "*Install*" to download the ActiveX controls that allows ActiveScan to run. 
4. When the download is complete it will say ready, click "*Next*". 
5. Click "*Scan Settings*" and check the option to use the *Extended Database* if available otherwise Standard). 
6. Click "*Scan Options*" and select both "*Scan Archives*" and "*Scan Mail Bases*". 
7. Click "*OK*". 
8. Under "*Select a target to scan*", click on "*My Computer*". 
9. When the scan is complete choose to save the results as "*Save as Text*" named kaspersky.txt to your desktop and post them in your next reply.

Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for _Free Online Virus Scanner_. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps *here* and reboot afterwards if your system does not reboot automatically or it will show '_Kaspersky Online Scanner license key was not found!_


----------



## carrie_uk (Jul 7, 2004)

OK got there, I pressed select all and cure, then it came up with the options to move incurable so here are the results

setup.exe;C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_uk\6.1.17.1;Probably BACKDOOR.Trojan;Incurable.Moved.;
backup-20071120-175503-362.dll;C:\Program Files\backups;Program.PopcapLoader;Incurable.Moved.;
SktInstall.exe;C:\Program Files\InstallShield Installation Information\{153BC7CA-9F2F-45AC-B4A1-AFAFBD5D904B};Probably BACKDOOR.Trojan;Incurable.Moved.;
fso_scripts.js;C:\Programs\Softimage\XSI_4.2_ModTool\Data\NetView_Database\L04_body\content\addons;Probably SCRIPT.Virus;Incurable.Moved.;
popcaploader.dll;C:\WINDOWS\Downloaded Program Files;Program.PopcapLoader;Incurable.Moved.;
restart.exe;C:\WINDOWS\system32;Tool.ShutDown.11;Incurable.Moved.;
kdhxx.ren;C:\_OTMoveIt\MovedFiles\WINDOWS\Temp;Trojan.DnsChange;Deleted.;

Logfile of HijackThis v1.99.1
Scan saved at 20:03:53, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Programs\Mozy\mozybackup.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\Program Files\Virgin Broadband\PCguard\Rps.exe
C:\Programs\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Programs\Mozy\mozystat.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Programs\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo

.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo

.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo

.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://uk.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo

.com
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} -

C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program

Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO -

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe

-CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE

"C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows

Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin

Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin

Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin

Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program

Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programs\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programs\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin

Broadband\PCguard\IdxClnR.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe

/c
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [swg] C:\Program

Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin

Broadband\PCguard\IdxClnR.exe"
O4 - Startup: Mozy Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: hp psc 2000 Series.lnk =

C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program

Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program

Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -

C:\Games\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com -

{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -

C:\Games\PartyGaming\PartyPoker\RunApp.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dixons.co.uk/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) -

http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient

Class) -

http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -

http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -

C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games  Buddy Invite)

- http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -

http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) -

http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} -

http://upload.facebook.com/controls/FacebookPhotoUploader2.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader

Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3}

(CPlayFirstDinerDash2Control Object) -

http://webgames.d.tmsrv.com/c=aa7f6d8e3b0c30ec38fed89216cab3aa/aff=t_25oa_ukc

a_wg/p/release/playfirst/wg_dinerdash2/dinerdash2/DinerDash2.1.0.0.48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_s

ite.cab?1150484130343
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object)

- http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) -

http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) -

http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient

Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) -

http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s

ssiPictureUploader Control) -

http://img.piczo.com/images/uploader/ssiPictureUploader.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -

http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) -

http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -

http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -

http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) -

http://help.broadbandassist.com/prequal/MotivePreQual.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) -

http://static.photobox.co.uk/sg/common/uploader_uni.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games  Game

Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -

http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) -

http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab55579.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =

208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =

208.67.220.220,208.67.222.222 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} -

C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program

Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} -

C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common

Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common

Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision -

C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common

Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel

32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA,

Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Event Log Watch (LogWatch) - Logitech, Inc. - (no file)
O23 - Service: MozyHome Backup Service (MozyBackup) - Unknown owner -

C:\Programs\Mozy\mozybackup.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner -

C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe"

-sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program

Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program

Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) -

Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program

Files\Virgin Broadband\PCguard\Fws.exe


----------



## cybertech (Apr 16, 2002)

OK, good.

Please download *ATF Cleaner* by Atribune. 
*This program is for XP and Windows 2000 only*
 
Double-click *ATF-Cleaner.exe* to run the program. 
Under *Main* choose: *Select All* 
Click the *Empty Selected* button. 

Click *Exit* on the Main menu to close the program.

*Download and scan with* *SUPERAntiSpyware* Free for Home Users
Double-click *SUPERAntiSpyware.exe* and use the default settings for installation. 
An icon will be created on your desktop. Double-click that icon to launch the program. 
If asked to update the program definitions, click "*Yes*". If not, update the definitions before scanning by selecting "*Check for Updates*". (_If you encounter any problems while downloading the updates, manually download and unzip them from here._) 
Under "*Configuration and Preferences*", click the *Preferences* button. 
Click the *Scanning Control* tab. 
Under *Scanner Options* make sure the following are checked _(leave all others unchecked)_:
_Close browsers before scanning._ 
_Scan for tracking cookies._ 
_Terminate memory threats before quarantining._

Click the "*Close*" button to leave the control center screen. 
Back on the main screen, under "*Scan for Harmful Software*" click *Scan your computer*. 
On the left, make sure you check *C:\Fixed Drive*. 
On the right, under "*Complete Scan*", choose *Perform Complete Scan*. 
Click "*Next*" to start the scan. Please be patient while it scans your computer. 
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "*OK*". 
Make sure everything has a checkmark next to it and click "*Next*". 
A notification will appear that "_Quarantine and Removal is Complete_". Click "*OK*" and then click the "*Finish*" button to return to the main menu. 
If asked if you want to reboot, click "*Yes*". 
To retrieve the removal information after reboot, launch SUPERAntispyware again.
_Click *Preferences*, then click the *Statistics/Logs* tab._ 
_Under Scanner Logs, double-click *SUPERAntiSpyware Scan Log*._ 
_If there are several logs, click the current dated log and press *View log*. A text file will open in your default text editor._ 
*Please copy and paste the Scan Log results in your next reply with a new hijackthis log.*

Click *Close* to exit the program.


----------



## carrie_uk (Jul 7, 2004)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/28/2007 at 12:50 PM

Application Version : 3.9.1008

Core Rules Database Version : 3351
Trace Rules Database Version: 1350

Scan type : Complete Scan
Total Scan Time : 04:57:25

Memory items scanned : 598
Memory threats detected : 0
Registry items scanned : 12731
Registry threats detected : 0
File items scanned : 169239
File threats detected : 0

Logfile of HijackThis v1.99.1
Scan saved at 12:56:57, on 28/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Programs\Mozy\mozybackup.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
C:\Program Files\Virgin Broadband\PCguard\Rps.exe
C:\Programs\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
C:\Programs\Mozy\mozystat.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Programs\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programs\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programs\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Virgin Broadband\PCguard\IdxClnR.exe"
O4 - Startup: Mozy Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: MozyHome Status.lnk = C:\Programs\Mozy\mozystat.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programs\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Games\PartyGaming\PartyPoker\RunApp.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dixons.co.uk/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games  Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/FacebookPhotoUploader2.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://webgames.d.tmsrv.com/c=aa7f6...dinerdash2/dinerdash2/DinerDash2.1.0.0.48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150484130343
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.piczo.com/images/uploader/ssiPictureUploader.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://help.broadbandassist.com/prequal/MotivePreQual.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader_uni.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games  Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab55579.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Event Log Watch (LogWatch) - Logitech, Inc. - (no file)
O23 - Service: MozyHome Backup Service (MozyBackup) - Unknown owner - C:\Programs\Mozy\mozybackup.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe


----------



## cybertech (Apr 16, 2002)

Are you still getting the error?


----------



## carrie_uk (Jul 7, 2004)

Yes the error is still there when I shut down


----------



## cybertech (Apr 16, 2002)

Download *WinPFind3U.exe* to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

Open the WinPFind3u folder and double-click on *WinPFind3U.exe* to start the program.

In the *Processes * group click *ALL* 
In the *Win32 Services * group click *ALL* 
In the *Driver Services * group click *ALL* 
In the *Registry * group click *ALL* 
In the *Files Created Within* group click *60 days* Make sure Non-Microsoft only is *UNCHECKED*
In the *Files Modified Within* group select *30 days* Make sure Non-Microsoft only is *UNCHECKED*
In the *File String Search* group select *ALL*
in the Additional scans sections please press select *ALL* 
Now click the *Run Scan* button on the toolbar.
The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file but click on the "Format" menu and make sure that "word wrap" is not checked. If it is then click on it to uncheck it.
Please post the resulting log here as an attachment.


Click on the orange *Post a Reply!* button 
scroll down to Manage Attachments 
Click in the box that says Upload File from your Computer
Click the Browse... button and find the file then click open
Click the Upload button
Wait until you see *Current Attachment *and your file name
Click on Close this window
Then submit the reply.


----------



## carrie_uk (Jul 7, 2004)

I have already done this and I said nothing happened when I clicked on manage attachments, I've turned off the pop up blocker but I still can't attach anything.


----------



## cybertech (Apr 16, 2002)

I forgot about that...

Can you copy the log and paste it into a reply or two?


----------



## carrie_uk (Jul 7, 2004)

WinPFind3 logfile created on: 24/11/2007 21:21:09
WinPFind3U by OldTimer - Version 1.0.44	Folder = C:\Documents and Settings\Carrie\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

1023.48 Mb Total Physical Memory | 591.02 Mb Available Physical Memory | 57.75% Memory free
3.16 Gb Paging File | 2.67 Gb Available in Paging File | 84.51% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;D:\pagefile.sys 1536 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 78.13 Gb Total Space | 19.74 Gb Free Space | 25.27% Space Free
Drive D: | 68.48 Gb Total Space | 25.32 Gb Free Space | 36.97% Space Free
Drive E: | 2.44 Gb Total Space | 0.75 Gb Free Space | 30.77% Space Free
Drive F: | 152.66 Gb Total Space | 80.69 Gb Free Space | 52.86% Space Free

Computer Name: MARDENS
Current User Name: Carrie
Logged in as Administrator.
Current Boot Mode: Normal

[Processes - All]
smss.exe -> %System32%\smss.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 50688 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
csrss.exe -> %System32%\csrss.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 6144 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
winlogon.exe -> %System32%\winlogon.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 502272 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
services.exe -> %System32%\services.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 108032 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
lsass.exe -> %System32%\lsass.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\rpcss.dll [DcomLaunch] -> Microsoft Corporation [Ver = 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528) | Size = 397824 bytes | Modified Date = 26/07/2005 04:39:50 | Attr = ]
-> %System32%\termsrv.dll [TermService] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 295424 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\termsrv.dll [TermService] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 295424 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\termsrv.dll [TermService] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 295424 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> [Wmi] -> File not found
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\rpcss.dll [RpcSs] -> Microsoft Corporation [Ver = 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528) | Size = 397824 bytes | Modified Date = 26/07/2005 04:39:50 | Attr = ]
-> [Wmi] -> File not found
msmpeng.exe -> %ProgramFiles%\Windows Defender\MsMpEng.exe -> Microsoft Corporation [Ver = 1.1.1593.0 | Size = 13592 bytes | Modified Date = 03/11/2006 18:19:58 | Attr = ]
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\appmgmts.dll [AppMgmt] -> File not found
-> %System32%\audiosrv.dll [AudioSrv] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 42496 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\qmgr.dll [BITS] -> Microsoft Corporation [Ver = 6.6.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 382464 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\browser.dll [Browser] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 77312 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\cryptsvc.dll [CryptSvc] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 60416 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\dhcpcsvc.dll [Dhcp] -> Microsoft Corporation [Ver = 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003) | Size = 111616 bytes | Modified Date = 19/05/2006 12:59:42 | Attr = ]
-> %System32%\dmserver.dll [dmserver] -> Microsoft Corp. [Ver = 2600.2180.503.0 | Size = 23552 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\ersvc.dll [ERSvc] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 23040 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\es.dll [EventSystem] -> Microsoft Corporation [Ver = 2001.12.4414.308 | Size = 243200 bytes | Modified Date = 26/07/2005 04:39:46 | Attr = ]
-> %System32%\shsvcs.dll [FastUserSwitchingCompatibility] -> Microsoft Corporation [Ver = 6.00.2900.3051 (xpsp_sp2_gdr.061219-0316) | Size = 134656 bytes | Modified Date = 19/12/2006 21:52:18 | Attr = ]
-> %WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll [helpsvc] -> File not found
-> %System32%\hidserv.dll [HidServ] -> File not found
-> %System32%\srvsvc.dll [lanmanserver] -> Microsoft Corporation [Ver = 5.1.2600.2577 (xpsp_sp2_gdr.041130-1729) | Size = 96768 bytes | Modified Date = 07/12/2004 19:32:34 | Attr = ]
-> %System32%\wkssvc.dll [lanmanworkstation] -> Microsoft Corporation [Ver = 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106) | Size = 132096 bytes | Modified Date = 17/08/2006 12:28:28 | Attr = ]
-> %System32%\msgsvc.dll [Messenger] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 33792 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\netman.dll [Netman] -> Microsoft Corporation [Ver = 5.1.2600.2743 (xpsp_sp2_gdr.050819-1525) | Size = 197632 bytes | Modified Date = 22/08/2005 18:29:46 | Attr = ]
-> %System32%\mswsock.dll [Nla] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 245248 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\ntmssvc.dll [NtmsSvc] -> Microsoft Corporation [Ver = 5.1.2400.2180 | Size = 435200 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\rasauto.dll [RasAuto] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 89088 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\rasmans.dll [RasMan] -> Microsoft Corporation [Ver = 5.1.2600.2936 (xpsp_sp2_gdr.060621-2347) | Size = 181248 bytes | Modified Date = 22/06/2006 10:47:18 | Attr = ]
-> %System32%\mprdim.dll [RemoteAccess] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 49152 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
-> %System32%\schedsvc.dll [Schedule] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 190976 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\seclogon.dll [seclogon] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 18944 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\sens.dll [SENS] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 38912 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
-> %System32%\ipnathlp.dll [SharedAccess] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 331264 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\shsvcs.dll [ShellHWDetection] -> Microsoft Corporation [Ver = 6.00.2900.3051 (xpsp_sp2_gdr.061219-0316) | Size = 134656 bytes | Modified Date = 19/12/2006 21:52:18 | Attr = ]
-> %System32%\srsvc.dll [srservice] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 170496 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\tapisrv.dll [TapiSrv] -> Microsoft Corporation [Ver = 5.1.2600.2716 (xpsp_sp2_gdr.050707-1657) | Size = 249344 bytes | Modified Date = 08/07/2005 16:27:56 | Attr = ]
-> %System32%\shsvcs.dll [Themes] -> Microsoft Corporation [Ver = 6.00.2900.3051 (xpsp_sp2_gdr.061219-0316) | Size = 134656 bytes | Modified Date = 19/12/2006 21:52:18 | Attr = ]
-> %System32%\trkwks.dll [TrkWks] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 90624 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\w32time.dll [W32Time] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 174592 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\wbem\WMIsvc.dll [winmgmt] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 144896 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\MsPMSNSv.dll [WmdmPmSN] -> Microsoft Corporation [Ver = 11.0.5721.5145 | Size = 27136 bytes | Modified Date = 18/10/2006 21:47:16 | Attr = ]
-> %System32%\wscsvc.dll [wscsvc] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 81408 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\wuauserv.dll [wuauserv] -> Microsoft Corporation [Ver = 5.4.3790.2180 (xpsp_sp2_rtm.040803-2158) | Size = 6656 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\wzcsvc.dll [WZCSVC] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 359936 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\xmlprov.dll [xmlprov] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 129536 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> [Wmi] -> File not found
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K WUDFSERVICEGROUP] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\WUDFSvc.dll [WudfSvc] -> Microsoft Corporation [Ver = 6.0.5716.32 (winmain(wmbla).060928-1756) | Size = 55808 bytes | Modified Date = 28/09/2006 18:56:14 | Attr = ]
-> [Wmi] -> File not found
fws.exe -> %ProgramFiles%\Virgin Broadband\PCguard\Fws.exe -> Virgin Media [Ver = 6.0.1.22212 | Size = 293104 bytes | Modified Date = 05/09/2007 13:09:38 | Attr = ]
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\dnsrslvr.dll [Dnscache] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 45568 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> [Wmi] -> File not found
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\alrsvc.dll [Alerter] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 17408 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\lmhsvc.dll [LmHosts] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13824 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
-> %System32%\ssdpsrv.dll [SSDPSRV] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 71680 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> %System32%\upnphost.dll [upnphost] -> Microsoft Corporation [Ver = 5.1.2600.3077 (xpsp_sp2_gdr.070204-2255) | Size = 185344 bytes | Modified Date = 05/02/2007 20:17:02 | Attr = ]
-> %System32%\webclnt.dll [WebClient] -> Microsoft Corporation [Ver = 5.1.2600.2821 (xpsp_sp2_gdr.060103-1536) | Size = 68096 bytes | Modified Date = 04/01/2006 03:35:06 | Attr = ]
-> [Wmi] -> File not found
spoolsv.exe -> %System32%\spoolsv.exe -> Microsoft Corporation [Ver = 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) | Size = 57856 bytes | Modified Date = 10/06/2005 23:53:32 | Attr = ]
explorer.exe -> %SystemRoot%\explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
mhotkey.exe -> %SystemRoot%\mHotkey.exe -> Chicony [Ver = 2, 2, 2, 0 | Size = 477184 bytes | Modified Date = 23/07/2002 11:09:48 | Attr = ]
rundll32.exe -> %System32%\rundll32.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 33280 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
realsched.exe -> %CommonProgramFiles%\Real\Update_OB\realsched.exe -> RealNetworks, Inc. [Ver = 0.1.0.3510 | Size = 180269 bytes | Modified Date = 16/06/2006 19:42:44 | Attr = ]
lvcomsx.exe -> %System32%\LVCOMSX.EXE -> Logitech Inc. [Ver = 8.4.7.1036 | Size = 221184 bytes | Modified Date = 19/07/2005 16:32:18 | Attr = ]
rundll32.exe -> %System32%\rundll32.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 33280 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
msascui.exe -> %ProgramFiles%\Windows Defender\MSASCui.exe -> Microsoft Corporation [Ver = 1.1.1593.0 | Size = 866584 bytes | Modified Date = 03/11/2006 18:20:12 | Attr = ]
broadbandadvisor.exe -> %ProgramFiles%\Virgin Broadband\advisor\Broadbandadvisor.exe -> Virgin Broadband [Ver = 1.5.14.21400 | Size = 2061552 bytes | Modified Date = 07/08/2007 17:49:30 | Attr = ]
rps.exe -> %ProgramFiles%\Virgin Broadband\PCguard\RPS.exe -> Virgin Media [Ver = 6.0.1.22212 | Size = 310000 bytes | Modified Date = 05/09/2007 13:10:02 | Attr = ]
ituneshelper.exe -> %SystemDrive%\Programs\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.5.0.20 | Size = 267048 bytes | Modified Date = 15/11/2007 13:11:04 | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_03\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 132496 bytes | Modified Date = 25/09/2007 01:11:36 | Attr = ]
logitechdesktopmessenger.exe -> %ProgramFiles%\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe -> Logitech Inc. [Ver = 2.52.21.16 | Size = 67128 bytes | Modified Date = 23/02/2007 23:43:24 | Attr = ]
ctfmon.exe -> %System32%\ctfmon.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 15360 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
msnmsgr.exe -> %ProgramFiles%\MSN Messenger\msnmsgr.exe -> Microsoft Corporation [Ver = 8.1.0178.00 | Size = 5674352 bytes | Modified Date = 19/01/2007 12:54:56 | Attr = ]
googletoolbarnotifier.exe -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 26/04/2007 17:00:56 | Attr = ]
imapp.exe -> %ProgramFiles%\IncrediMail\bin\IMApp.exe -> IncrediMail, Ltd. [Ver = 5, 5, 0, 2931 | Size = 143408 bytes | Modified Date = 06/05/2007 15:20:30 | Attr = ]
hpobnz08.exe -> %SystemDrive%\Programs\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe -> Hewlett-Packard Co. [Ver = 2.00 | Size = 323646 bytes | Modified Date = 27/06/2002 00:20:58 | Attr = ]
applemobiledeviceservice.exe -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> Apple, Inc. [Ver = 1, 14, 0, 0 | Size = 110592 bytes | Modified Date = 04/09/2007 18:04:36 | Attr = ]
cdac11ba.exe -> %System32%\drivers\CDAC11BA.EXE -> Macrovision [Ver = 4.20.0 | Size = 54784 bytes | Modified Date = 27/10/2006 12:14:42 | Attr = ]
itmrtsvc.exe -> %ProgramFiles%\CA\PPRT\bin\ITMRTSVC.exe -> CA, Inc. [Ver = 1.1.0.24 | Size = 280080 bytes | Modified Date = 19/12/2006 12:45:16 | Attr = ]
setpoint.exe -> %ProgramFiles%\Logitech\SetPoint\SetPoint.exe -> Logitech Inc. [Ver = 2.20.733 | Size = 598016 bytes | Modified Date = 15/09/2004 10:11:44 | Attr = ]
mozybackup.exe -> %SystemDrive%\Programs\Mozy\mozybackup.exe -> [Ver = | Size = 87608 bytes | Modified Date = 16/04/2007 15:40:18 | Attr = ]
sqlservr.exe -> %ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -> Microsoft Corporation [Ver = 2005.090.1399.00 | Size = 28768528 bytes | Modified Date = 14/10/2005 10:51:46 | Attr = ]
nvsvc32.exe -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 159810 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
pdagent.exe -> %ProgramFiles%\Raxco\PerfectDisk\PDAgent.exe -> Raxco Software, Inc. [Ver = 8, 0, 0, 57 | Size = 407056 bytes | Modified Date = 02/03/2007 11:24:42 | Attr = ]
hposol08.exe -> %SystemDrive%\Programs\Hewlett-Packard\Digital Imaging\bin\hposol08.exe -> Hewlett-Packard Co. [Ver = 2.00 | Size = 147456 bytes | Modified Date = 27/06/2002 00:21:30 | Attr = ]
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\wiaservc.dll [stisvc] -> Microsoft Corporation [Ver = 5.1.2600.3051 (xpsp_sp2_gdr.061219-0316) | Size = 333824 bytes | Modified Date = 19/12/2006 18:16:48 | Attr = ]
-> [Wmi] -> File not found
mozystat.exe -> %SystemDrive%\Programs\Mozy\mozystat.exe -> [Ver = | Size = 1783096 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
khalmnpr.exe -> %CommonProgramFiles%\Logitech\KHAL\KHALMNPR.EXE -> Logitech Inc. [Ver = 2.20.698 | Size = 37888 bytes | Modified Date = 01/09/2004 16:53:54 | Attr = ]
hpoevm08.exe -> %SystemDrive%\Programs\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe -> Hewlett-Packard Co. [Ver = 1.00 | Size = 286720 bytes | Modified Date = 27/06/2002 00:34:44 | Attr = ]
broadbandadvisorcomhandler.exe -> %ProgramFiles%\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe -> Radialpoint Inc. [Ver = 1.5.14.21400 | Size = 292080 bytes | Modified Date = 07/08/2007 17:49:30 | Attr = ]
hpzipm12.exe -> %System32%\HPZipm12.exe -> HP [Ver = 4, 5, 0, 802 | Size = 81920 bytes | Modified Date = 15/03/2002 20:37:46 | Attr = R ]
rpsupdaterr.exe -> %ProgramFiles%\Virgin Broadband\PCguard\rpsupdaterR.exe -> Radialpoint Inc. [Ver = 6.0.1.24124 | Size = 99056 bytes | Modified Date = 09/11/2007 07:28:18 | Attr = ]
alg.exe -> %System32%\alg.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 44544 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
hposts08.exe -> %SystemDrive%\Programs\Hewlett-Packard\Digital Imaging\bin\hposts08.exe -> Hewlett-Packard Co. [Ver = 1.00 | Size = 303104 bytes | Modified Date = 27/06/2002 00:53:26 | Attr = ]
svchost.exe -> %System32%\svchost.exe [C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
-> %System32%\w3ssl.dll [HTTPFilter] -> Microsoft Corporation [Ver = 6.0.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 15872 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
-> [Wmi] -> File not found
ipodservice.exe -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.5.0.20 | Size = 504104 bytes | Modified Date = 15/11/2007 13:10:54 | Attr = ]
dllhost.exe -> %System32%\dllhost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5120 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
msdtc.exe -> %System32%\msdtc.exe -> Microsoft Corporation [Ver = 2001.12.4414.258 | Size = 6144 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
dvpapi.exe -> %CommonProgramFiles%\Authentium\AntiVirus\dvpapi.exe -> Authentium, Inc. [Ver = 4,94,107,129 | Size = 177672 bytes | Modified Date = 04/04/2007 16:41:28 | Attr = R ]
incmail.exe -> %ProgramFiles%\IncrediMail\bin\IncMail.exe -> IncrediMail, Ltd. [Ver = 5, 5, 0, 2931 | Size = 208946 bytes | Modified Date = 06/05/2007 15:20:40 | Attr = ]
winpfind3u.exe -> %UserDesktop%\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.44.0 | Size = 371200 bytes | Modified Date = 21/11/2007 09:19:46 | Attr = ]
dllhost.exe -> %System32%\dllhost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5120 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

[Win32 Services - All]
(Adobe LM Service) Adobe LM Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Adobe Systems Shared\Service\Adobelmsvc.exe -> [Ver = 2.41.000 | Size = 68096 bytes | Modified Date = 29/06/2006 05:38:24 | Attr = ]
(Alerter) Alerter [Win32_Shared | Disabled | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(ALG) Application Layer Gateway Service [Win32_Own | On_Demand | Running] -> %System32%\alg.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 44544 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> Apple, Inc. [Ver = 1, 14, 0, 0 | Size = 110592 bytes | Modified Date = 04/09/2007 18:04:36 | Attr = ]
(AppMgmt) Application Management [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -> Microsoft Corporation [Ver = 2.0.50727.832 (QFE.050727-8300) | Size = 33632 bytes | Modified Date = 13/04/2007 02:20:52 | Attr = ]
(AudioSrv) Windows Audio [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(BITS) Background Intelligent Transfer Service [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Browser) Computer Browser [Win32_Shared | Auto | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(C-DillaCdaC11BA) C-DillaCdaC11BA [Win32_Own | Auto | Running] -> %System32%\drivers\CDAC11BA.EXE -> Macrovision [Ver = 4.20.0 | Size = 54784 bytes | Modified Date = 27/10/2006 12:14:42 | Attr = ]
(CiSvc) Indexing Service [Win32_Shared | On_Demand | Stopped] -> %System32%\cisvc.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5632 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(ClipSrv) ClipBook [Win32_Own | Disabled | Stopped] -> %System32%\clipsrv.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 33280 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(clr_optimization_v2.0.50727_32) .NET Runtime Optimization Service v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> Microsoft Corporation [Ver = 2.0.50727.832 (QFE.050727-8300) | Size = 68952 bytes | Modified Date = 13/04/2007 02:21:18 | Attr = ]
(COMSysApp) COM+ System Application [Win32_Own | On_Demand | Running] -> %System32%\dllhost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5120 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(CryptSvc) Cryptographic Services [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(DcomLaunch) DCOM Server Process Launcher [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Dhcp) DHCP Client [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(dmserver) Logical Disk Manager [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Dnscache) DNS Client [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(dvpapi) dvpapi [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Authentium\AntiVirus\dvpapi.exe -> Authentium, Inc. [Ver = 4,94,107,129 | Size = 177672 bytes | Modified Date = 04/04/2007 16:41:28 | Attr = R ]
(ERSvc) Error Reporting Service [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Eventlog) Event Log [Win32_Shared | Auto | Running] -> %System32%\services.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 108032 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
(EventSystem) COM+ Event System [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(ewido anti-spyware 4.0 guard) ewido anti-spyware 4.0 guard [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\ewido anti-spyware 4.0\guard.exe -> Anti-Malware Development a.s. [Ver = 4, 0, 0, 172 | Size = 172032 bytes | Modified Date = 16/06/2006 14:38:44 | Attr = ]
(FastUserSwitchingCompatibility) Fast User Switching Compatibility [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Fax) Fax [Win32_Own | Auto | Stopped] -> %System32%\fxssvc.exe -> Microsoft Corporation [Ver = 5.2.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 267776 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(gusvc) Google Updater Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe -> Google [Ver = 2.0.734.29932.beta | Size = 138168 bytes | Modified Date = 27/01/2007 22:42:42 | Attr = ]
(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(HidServ) Human Interface Device Access [Win32_Shared | Disabled | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(HTTPFilter) HTTP SSL [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\1150\Intel 32\IDriverT.exe -> Macrovision Corporation [Ver = 11.50.42618 | Size = 69632 bytes | Modified Date = 14/11/2005 00:06:04 | Attr = ]
(ImapiService) IMAPI CD-Burning COM Service [Win32_Own | On_Demand | Stopped] -> %System32%\imapi.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 150016 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.5.0.20 | Size = 504104 bytes | Modified Date = 15/11/2007 13:10:54 | Attr = ]
(ITMRTSVC) CA Pest Patrol Realtime Protection Service [Win32_Own | Auto | Running] -> %ProgramFiles%\CA\PPRT\bin\ITMRTSVC.exe -> CA, Inc. [Ver = 1.1.0.24 | Size = 280080 bytes | Modified Date = 19/12/2006 12:45:16 | Attr = ]
(lanmanserver) Server [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(lanmanworkstation) Workstation [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(LmHosts) TCP/IP NetBIOS Helper [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(LogWatch) Event Log Watch [Win32_Own | Auto | Stopped] -> -> File not found
(Messenger) Messenger [Win32_Shared | Disabled | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(mnmsrvc) NetMeeting Remote Desktop Sharing [Win32_Own | On_Demand | Stopped] -> %System32%\mnmsrvc.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 | Size = 32768 bytes | Modified Date = 04/08/2004 07:56:52 | Attr = ]
(MozyBackup) MozyHome Backup Service [Win32_Own | Auto | Running] -> %SystemDrive%\Programs\Mozy\mozybackup.exe -> [Ver = | Size = 87608 bytes | Modified Date = 16/04/2007 15:40:18 | Attr = ]
(MSDTC) Distributed Transaction Coordinator [Win32_Own | On_Demand | Running] -> %System32%\msdtc.exe -> Microsoft Corporation [Ver = 2001.12.4414.258 | Size = 6144 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
(MSIServer) Windows Installer [Win32_Shared | On_Demand | Stopped] -> %System32%\msiexec.exe -> Microsoft Corporation [Ver = 3.1.4000.1823 | Size = 78848 bytes | Modified Date = 04/05/2005 13:45:36 | Attr = ]
(MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) [Win32_Own | Auto | Running] -> %ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -> Microsoft Corporation [Ver = 2005.090.1399.00 | Size = 28768528 bytes | Modified Date = 14/10/2005 10:51:46 | Attr = ]
(MSSQLServerADHelper) SQL Server Active Directory Helper [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\Microsoft SQL Server\90\Shared\sqladhlp90.exe -> Microsoft Corporation [Ver = 2005.090.1399.00 | Size = 45272 bytes | Modified Date = 14/10/2005 10:50:20 | Attr = ]
(NetDDE) Network DDE [Win32_Shared | Disabled | Stopped] -> %System32%\netdde.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 111104 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
(NetDDEdsdm) Network DDE DSDM [Win32_Shared | Disabled | Stopped] -> %System32%\netdde.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 111104 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
(Netlogon) Net Logon [Win32_Shared | On_Demand | Stopped] -> %System32%\lsass.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(Netman) Network Connections [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Nla) Network Location Awareness (NLA) [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(NtLmSsp) NT LM Security Support Provider [Win32_Shared | On_Demand | Stopped] -> %System32%\lsass.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(NtmsSvc) Removable Storage [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 159810 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE -> Microsoft Corporation [Ver = 11.0.5525 | Size = 89136 bytes | Modified Date = 28/07/2003 11:28:22 | Attr = ]
(PDAgent) PDAgent [Win32_Own | Auto | Running] -> %ProgramFiles%\Raxco\PerfectDisk\PDAgent.exe -> Raxco Software, Inc. [Ver = 8, 0, 0, 57 | Size = 407056 bytes | Modified Date = 02/03/2007 11:24:42 | Attr = ]
(PDEngine) PDEngine [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Raxco\PerfectDisk\PDEngine.exe -> Raxco Software, Inc. [Ver = 8, 0, 0, 57 | Size = 734736 bytes | Modified Date = 02/03/2007 11:24:52 | Attr = ]
(PlugPlay) Plug and Play [Win32_Shared | Auto | Running] -> %System32%\services.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 108032 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
(Pml Driver HPZ12) Pml Driver HPZ12 [Win32_Own | On_Demand | Running] -> %System32%\HPZipm12.exe -> HP [Ver = 4, 5, 0, 802 | Size = 81920 bytes | Modified Date = 15/03/2002 20:37:46 | Attr = R ]
(PolicyAgent) IPSEC Services [Win32_Shared | Auto | Running] -> %System32%\lsass.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(ProtectedStorage) Protected Storage [Win32_Shared | Auto | Running] -> %System32%\lsass.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(Radialpoint Security Services) Virgin Broadband PCguard [Win32_Own | On_Demand | Running] -> %System32%\dllhost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5120 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(RasAuto) Remote Access Auto Connection Manager [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(RasMan) Remote Access Connection Manager [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(RDSessMgr) Remote Desktop Help Session Manager [Win32_Own | On_Demand | Stopped] -> %System32%\sessmgr.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 140800 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
(RemoteAccess) Routing and Remote Access [Win32_Shared | Disabled | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(RpcLocator) Remote Procedure Call (RPC) Locator [Win32_Own | On_Demand | Stopped] -> %System32%\locator.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 75264 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(RpcSs) Remote Procedure Call (RPC) [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(RPSUpdaterR) Virgin Broadband PCguard Update Service [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Virgin Broadband\PCguard\rpsupdaterR.exe -> Radialpoint Inc. [Ver = 6.0.1.24124 | Size = 99056 bytes | Modified Date = 09/11/2007 07:28:18 | Attr = ]
(RP_FWS) PCguard Firewall [Win32_Own | Auto | Running] -> %ProgramFiles%\Virgin Broadband\PCguard\Fws.exe -> Virgin Media [Ver = 6.0.1.22212 | Size = 293104 bytes | Modified Date = 05/09/2007 13:09:38 | Attr = ]
(RSVP) QoS RSVP [Win32_Own | On_Demand | Stopped] -> %System32%\rsvp.exe -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 132608 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(SamSs) Security Accounts Manager [Win32_Shared | Auto | Running] -> %System32%\lsass.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 13312 bytes | Modified Date = 04/08/2004 07:56:50 | Attr = ]
(SCardSvr) Smart Card [Win32_Shared | On_Demand | Stopped] -> %System32%\scardsvr.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 95744 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
(Schedule) Task Scheduler [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(seclogon) Secondary Logon [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(SENS) System Event Notification [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(SharedAccess) Windows Firewall/Internet Connection Sharing (ICS) [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(ShellHWDetection) Shell Hardware Detection [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Spooler) Print Spooler [Win32_Own | Auto | Running] -> %System32%\spoolsv.exe -> Microsoft Corporation [Ver = 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) | Size = 57856 bytes | Modified Date = 10/06/2005 23:53:32 | Attr = ]
(SQLBrowser) SQL Server Browser [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\Microsoft SQL Server\90\Shared\sqlbrowser.exe -> Microsoft Corporation [Ver = 2005.090.1399.00 | Size = 239320 bytes | Modified Date = 14/10/2005 10:51:12 | Attr = ]
(SQLWriter) SQL Server VSS Writer [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Microsoft SQL Server\90\Shared\sqlwriter.exe -> Microsoft Corporation [Ver = 2005.090.1399.00 | Size = 87768 bytes | Modified Date = 14/10/2005 02:53:50 | Attr = ]
(srservice) System Restore Service [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(SSDPSRV) SSDP Discovery Service [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(stisvc) Windows Image Acquisition (WIA) [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(SwPrv) MS Software Shadow Copy Provider [Win32_Own | On_Demand | Stopped] -> %System32%\dllhost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5120 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
(SysmonLog) Performance Logs and Alerts [Win32_Own | On_Demand | Stopped] -> %System32%\smlogsvc.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 89600 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
(TapiSrv) Telephony [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(TermService) Terminal Services [Win32_Shared | On_Demand | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(Themes) Themes [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(TrkWks) Distributed Link Tracking Client [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(upnphost) Universal Plug and Play Device Host [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(UPS) Uninterruptible Power Supply [Win32_Own | On_Demand | Stopped] -> %System32%\ups.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 18432 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(usnjsvc) Messenger Sharing Folders USN Journal Reader service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\MSN Messenger\usnsvc.exe -> Microsoft Corporation [Ver = 8.1.0178.00 | Size = 97136 bytes | Modified Date = 19/01/2007 12:54:14 | Attr = ]
(usprserv) User Privilege Service [Win32_Own | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(VSS) Volume Shadow Copy [Win32_Own | On_Demand | Stopped] -> %System32%\vssvc.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 289792 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(W32Time) Windows Time [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WebClient) WebClient [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WinDefend) Windows Defender [Win32_Own | Auto | Running] -> %ProgramFiles%\Windows Defender\MsMpEng.exe -> Microsoft Corporation [Ver = 1.1.1593.0 | Size = 13592 bytes | Modified Date = 03/11/2006 18:19:58 | Attr = ]
(winmgmt) Windows Management Instrumentation [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WmdmPmSN) Portable Media Serial Number Service [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WmiApSrv) WMI Performance Adapter [Win32_Own | On_Demand | Stopped] -> %System32%\wbem\wmiapsrv.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 126464 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WMPNetworkSvc) Windows Media Player Network Sharing Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Windows Media Player\wmpnetwk.exe -> Microsoft Corporation [Ver = 11.0.5721.5145 (WMP_11.061018-2006) | Size = 913408 bytes | Modified Date = 18/10/2006 20:05:24 | Attr = ]
(wscsvc) Security Center [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(wuauserv) Automatic Updates [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WudfSvc) Windows Driver Foundation - User-mode Driver Framework [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(WZCSVC) Wireless Zero Configuration [Win32_Shared | Auto | Running] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
(xmlprov) Network Provisioning Service [Win32_Shared | On_Demand | Stopped] -> %System32%\svchost.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

[Driver Services - All]
(61883) 61883 Unit Device [Kernel | On_Demand | Stopped] -> %System32%\drivers\61883.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:10:10 | Attr = ]
(Abiosdsk) Abiosdsk [Kernel | Disabled | Stopped] -> -> File not found
(abp480n5) abp480n5 [Kernel | Disabled | Stopped] -> -> File not found
(ACPI) Microsoft ACPI Driver [Kernel | Boot | Running] -> %System32%\drivers\acpi.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 187776 bytes | Modified Date = 04/08/2004 06:07:38 | Attr = ]
(ACPIEC) ACPIEC [Kernel | Disabled | Stopped] -> %System32%\drivers\acpiec.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 11648 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(adpu160m) adpu160m [Kernel | Disabled | Stopped] -> -> File not found
(aec) Microsoft Kernel Acoustic Echo Canceller [Kernel | On_Demand | Stopped] -> %System32%\drivers\aec.sys -> Microsoft Corporation [Ver = 5.1.2601.2180 | Size = 142464 bytes | Modified Date = 15/02/2006 00:22:26 | Attr = ]
(AFD) AFD Networking Support Environment [Kernel | System | Running] -> %System32%\drivers\afd.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 138496 bytes | Modified Date = 04/08/2004 06:14:14 | Attr = ]
(AFS2K) AFS2K [Kernel | System | Running] -> %System32%\drivers\AFS2K.SYS -> Oak Technology Inc. [Ver = 3.1.21.1103 | Size = 35840 bytes | Modified Date = 08/10/2004 01:16:04 | Attr = ]
(agp440) Intel AGP Bus Filter [Kernel | Boot | Running] -> %System32%\drivers\agp440.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 42368 bytes | Modified Date = 04/08/2004 06:07:42 | Attr = ]
(Aha154x) Aha154x [Kernel | Disabled | Stopped] -> -> File not found
(aic78u2) aic78u2 [Kernel | Disabled | Stopped] -> -> File not found
(aic78xx) aic78xx [Kernel | Disabled | Stopped] -> -> File not found
(AliIde) AliIde [Kernel | Disabled | Stopped] -> -> File not found
(amsint) amsint [Kernel | Disabled | Stopped] -> -> File not found
(Arp1394) 1394 ARP Client Protocol [Kernel | On_Demand | Running] -> %System32%\drivers\arp1394.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 60800 bytes | Modified Date = 04/08/2004 05:58:30 | Attr = ]
(ASAPIW2K) ASAPIW2K [Kernel | On_Demand | Running] -> %System32%\drivers\asapiW2k.sys -> Pinnacle Systems GmbH [Ver = 6, 0, 2, 27 | Size = 11264 bytes | Modified Date = 10/03/2004 15:27:18 | Attr = ]
(asc) asc [Kernel | Disabled | Stopped] -> -> File not found
(asc3350p) asc3350p [Kernel | Disabled | Stopped] -> -> File not found
(asc3550) asc3550 [Kernel | Disabled | Stopped] -> -> File not found
(AsyncMac) RAS Asynchronous Media Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\asyncmac.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14336 bytes | Modified Date = 04/08/2004 06:05:04 | Attr = ]
(atapi) Standard IDE/ESDI Hard Disk Controller [Kernel | Boot | Running] -> %System32%\drivers\atapi.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 95360 bytes | Modified Date = 04/08/2004 05:59:42 | Attr = ]
(Atdisk) Atdisk [Kernel | Disabled | Stopped] -> -> File not found
(Atmarpc) ATM ARP Client Protocol [Kernel | On_Demand | Stopped] -> %System32%\drivers\atmarpc.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 59904 bytes | Modified Date = 04/08/2004 05:58:30 | Attr = ]
(audstub) Audio Stub Driver [Kernel | On_Demand | Running] -> %System32%\drivers\audstub.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 3072 bytes | Modified Date = 17/08/2001 13:59:44 | Attr = ]
(Avc) AVC Device [Kernel | On_Demand | Stopped] -> %System32%\drivers\avc.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 38912 bytes | Modified Date = 04/08/2004 07:10:10 | Attr = ]
(Beep) Beep [Kernel | System | Running] -> %System32%\drivers\beep.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 4224 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(cbidf2k) cbidf2k [Kernel | Disabled | Stopped] -> %System32%\drivers\cbidf2k.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 13952 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(CCDECODE) Closed Caption Decoder [Kernel | On_Demand | Stopped] -> %System32%\drivers\ccdecode.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 17024 bytes | Modified Date = 04/08/2004 06:10:16 | Attr = ]
(cd20xrnt) cd20xrnt [Kernel | Disabled | Stopped] -> -> File not found
(CdaC15BA) CdaC15BA [Kernel | Auto | Running] -> %System32%\drivers\CdaC15BA.SYS -> Macrovision Europe Ltd [Ver = 3.17.000 | Size = 12464 bytes | Modified Date = 27/10/2006 12:14:40 | Attr = ]
(Cdaudio) Cdaudio [Kernel | System | Stopped] -> %System32%\drivers\cdaudio.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 18688 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(Cdfs) Cdfs [File_System | Disabled | Running] -> %System32%\drivers\cdfs.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 63744 bytes | Modified Date = 04/08/2004 06:14:10 | Attr = ]
(Cdrom) CD-ROM Driver [Kernel | System | Running] -> %System32%\drivers\cdrom.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 49536 bytes | Modified Date = 04/08/2004 05:59:52 | Attr = ]
(Changer) Changer [Kernel | System | Stopped] -> -> File not found
(CmdIde) CmdIde [Kernel | Disabled | Stopped] -> -> File not found
(cmuda) C-Media WDM Audio Interface [Kernel | On_Demand | Running] -> %System32%\drivers\cmuda.sys -> C-Media Inc [Ver = 5.12.01.0036.20 (36) | Size = 747840 bytes | Modified Date = 29/10/2003 17:22:28 | Attr = ]
(Cpqarray) Cpqarray [Kernel | Disabled | Stopped] -> -> File not found
(CSS DVP) Dynamic Virus Protection [Kernel | Auto | Running] -> %System32%\drivers\Css-Dvp.sys -> Authentium, Inc. [Ver = 4.94.107.403 | Size = 839880 bytes | Modified Date = 04/04/2007 16:15:02 | Attr = ]
(dac960nt) dac960nt [Kernel | Disabled | Stopped] -> -> File not found
(DCamUSBEMPIA) Dazzle DVC90 Video Device [Kernel | On_Demand | Stopped] -> %System32%\drivers\emDevice.sys -> eMPIA Technology, Inc. [Ver = 1.1.0406.0 | Size = 100957 bytes | Modified Date = 06/04/2004 13:08:06 | Attr = ]
(DefragFS) DefragFS [File_System | Boot | Running] -> %System32%\drivers\DefragFs.sys -> Raxco Software, Inc. [Ver = 8.0011 built by: WinDDK | Size = 67352 bytes | Modified Date = 02/03/2007 09:26:18 | Attr = ]
(Disk) Disk Driver [Kernel | Boot | Running] -> %System32%\drivers\disk.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 36352 bytes | Modified Date = 04/08/2004 05:59:54 | Attr = ]
(dmboot) dmboot [Kernel | Disabled | Stopped] -> %System32%\drivers\dmboot.sys -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 799744 bytes | Modified Date = 04/08/2004 06:07:18 | Attr = ]
(dmio) dmio [Kernel | Disabled | Stopped] -> %System32%\drivers\dmio.sys -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 153344 bytes | Modified Date = 04/08/2004 06:07:16 | Attr = ]
(dmload) dmload [Kernel | Disabled | Stopped] -> %System32%\drivers\dmload.sys -> Microsoft Corp., Veritas Software. [Ver = 2600.0.503.0 | Size = 5888 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(DMusic) Microsoft Kernel DLS Syntheiszer [Kernel | On_Demand | Stopped] -> %System32%\drivers\dmusic.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 52864 bytes | Modified Date = 04/08/2004 06:07:38 | Attr = ]
(dpti2o) dpti2o [Kernel | Disabled | Stopped] -> -> File not found
(drmkaud) Microsoft Kernel DRM Audio Descrambler [Kernel | On_Demand | Stopped] -> %System32%\drivers\drmkaud.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 2944 bytes | Modified Date = 04/08/2004 06:07:58 | Attr = ]
(EL90XBC) 3Com EtherLink XL 90XB/C Adapter Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\el90xbc5.sys -> 3Com Corporation [Ver = 4.05.00.0000 | Size = 66591 bytes | Modified Date = 17/08/2001 12:11:06 | Attr = ]
(emAudio) Dazzle DVC90 Audio Device [Kernel | On_Demand | Stopped] -> %System32%\drivers\emAudio.sys -> Pinnacle Systems, Inc. [Ver = 1.1.0505.0 | Size = 19584 bytes | Modified Date = 05/05/2004 13:40:38 | Attr = ]
(ewido anti-spyware 4.0 driver) ewido anti-spyware 4.0 driver [Kernel | System | Running] -> %ProgramFiles%\ewido anti-spyware 4.0\guard.sys -> [Ver = | Size = 3968 bytes | Modified Date = 16/06/2006 14:38:54 | Attr = ]
(Fastfat) Fastfat [File_System | Disabled | Running] -> %System32%\drivers\fastfat.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 143360 bytes | Modified Date = 04/08/2004 06:14:16 | Attr = ]
(Fdc) Floppy Disk Controller Driver [Kernel | On_Demand | Running] -> %System32%\drivers\fdc.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 27392 bytes | Modified Date = 04/08/2004 05:59:28 | Attr = ]
(FETND5BV) VIA Rhine-Family Fast Ethernet Adapter Driver Service [Kernel | On_Demand | Running] -> %System32%\drivers\fetnd5bv.sys -> VIA Technologies, Inc. [Ver = 3.41.00.0426 | Size = 42496 bytes | Modified Date = 16/12/2004 12:36:30 | Attr = ]
(FETNDISB) VIA Rhine Family Fast Ethernet Adapter Driver Service [Kernel | On_Demand | Stopped] -> %System32%\drivers\fetnd5b.sys -> VIA Technologies, Inc. [Ver = 3.22.00.0407 | Size = 41984 bytes | Modified Date = 29/07/2003 10:31:16 | Attr = ]
(FiltUSBEMPIA) USB Device Lower Filter [Kernel | On_Demand | Stopped] -> %System32%\drivers\emFilter.sys -> eMPIA Technology, Inc. [Ver = 1.1.0406.0 | Size = 5245 bytes | Modified Date = 06/04/2004 13:07:58 | Attr = ]
(Fips) Fips [Kernel | System | Running] -> %System32%\drivers\fips.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 34944 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(Flpydisk) Floppy Disk Driver [Kernel | On_Demand | Running] -> %System32%\drivers\flpydisk.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 20480 bytes | Modified Date = 04/08/2004 05:59:28 | Attr = ]
(FltMgr) FltMgr [File_System | Boot | Running] -> %System32%\drivers\fltmgr.sys -> Microsoft Corporation [Ver = 5.1.2600.2978 (xpsp_sp2_gdr.060821-0039) | Size = 128896 bytes | Modified Date = 21/08/2006 09:14:58 | Attr = ]
(Ftdisk) Volume Manager Driver [Kernel | Boot | Running] -> %System32%\drivers\ftdisk.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 125056 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(gameenum) Game Port Enumerator [Kernel | On_Demand | Running] -> %System32%\drivers\gameenum.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 10624 bytes | Modified Date = 04/08/2004 06:08:22 | Attr = ]
(GEARAspiWDM) GEARAspiWDM [Kernel | On_Demand | Running] -> %System32%\drivers\GEARAspiWDM.sys -> GEAR Software Inc. [Ver = 2.0.6.1 | Size = 15664 bytes | Modified Date = 19/09/2006 15:44:04 | Attr = ]
(Gpc) Generic Packet Classifier [Kernel | On_Demand | Running] -> %System32%\drivers\msgpc.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 35072 bytes | Modified Date = 04/08/2004 06:04:12 | Attr = ]
(hpn) hpn [Kernel | Disabled | Stopped] -> -> File not found
(HPZid412) IEEE-1284.4 Driver HPZid412 [Kernel | On_Demand | Running] -> %System32%\drivers\hpzid412.sys -> HP [Ver = 4, 5, 0, 642 | Size = 50960 bytes | Modified Date = 15/02/2002 18:26:22 | Attr = R ]
(HPZipr12) Print Class Driver for IEEE-1284.4 HPZipr12 [Kernel | On_Demand | Running] -> %System32%\drivers\HPZipr12.sys -> HP [Ver = 4, 5, 0, 479 | Size = 16112 bytes | Modified Date = 21/03/2002 17:37:52 | Attr = R ]
(HPZius12) USB to IEEE-1284.4 Translation Driver HPZius12 [Kernel | On_Demand | Running] -> %System32%\drivers\HPZius12.sys -> HP [Ver = 4, 5, 0, 328 | Size = 22512 bytes | Modified Date = 08/03/2002 10:49:26 | Attr = R ]
(HTTP) HTTP [Kernel | On_Demand | Running] -> %System32%\drivers\http.sys -> Microsoft Corporation [Ver = 5.1.2600.2869 (xpsp_sp2_gdr.060316-1512) | Size = 262784 bytes | Modified Date = 17/03/2006 00:33:10 | Attr = ]
(i2omgmt) i2omgmt [Kernel | System | Stopped] -> -> File not found
(i2omp) i2omp [Kernel | Disabled | Stopped] -> -> File not found
(i8042prt) i8042 Keyboard and PS/2 Mouse Port Driver [Kernel | System | Running] -> %System32%\drivers\i8042prt.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 52736 bytes | Modified Date = 04/08/2004 07:14:36 | Attr = ]
(Imapi) CD-Burning Filter Driver [Kernel | System | Running] -> %System32%\drivers\imapi.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 41856 bytes | Modified Date = 04/08/2004 06:00:16 | Attr = ]
(ini910u) ini910u [Kernel | Disabled | Stopped] -> -> File not found
(IntelIde) IntelIde [Kernel | Disabled | Stopped] -> -> File not found
(intelppm) Intel Processor Driver [Kernel | System | Running] -> %System32%\drivers\intelppm.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 36096 bytes | Modified Date = 04/08/2004 05:59:20 | Attr = ]
(Intels51) Creatix V.9X DSP Data Fax Modem [Kernel | On_Demand | Running] -> %System32%\drivers\ctxs51.sys -> Intel Corporation [Ver = 4.60.2 | Size = 670203 bytes | Modified Date = 22/05/2003 15:44:44 | Attr = ]
(Ip6Fw) IPv6 Windows Firewall Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\ip6fw.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 29056 bytes | Modified Date = 04/08/2004 06:00:06 | Attr = ]
(IpFilterDriver) IP Traffic Filter Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\ipfltdrv.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 32896 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(IpInIp) IP in IP Tunnel Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\ipinip.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 20992 bytes | Modified Date = 04/08/2004 06:04:46 | Attr = ]
(IpNat) IP Network Address Translator [Kernel | On_Demand | Running] -> %System32%\drivers\ipnat.sys -> Microsoft Corporation [Ver = 5.1.2600.2524 (xpsp_sp2_gdr.040919-1056) | Size = 134912 bytes | Modified Date = 29/09/2004 22:28:38 | Attr = ]
(IPSec) IPSEC driver [Kernel | System | Running] -> %System32%\drivers\ipsec.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 74752 bytes | Modified Date = 04/08/2004 06:14:28 | Attr = ]
(IRENUM) IR Enumerator Service [Kernel | On_Demand | Stopped] -> %System32%\drivers\irenum.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 11264 bytes | Modified Date = 04/08/2004 06:00:46 | Attr = ]
(isapnp) PnP ISA/EISA Bus Driver [Kernel | Boot | Running] -> %System32%\drivers\isapnp.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 35840 bytes | Modified Date = 17/08/2001 21:58:02 | Attr = ]
(k750bus) Sony Ericsson 750 driver (WDM) [Kernel | On_Demand | Stopped] -> %System32%\drivers\k750bus.sys -> MCCI [Ver = V4.28 | Size = 55216 bytes | Modified Date = 03/06/2005 13:46:52 | Attr = R ]
(k750mdfl) Sony Ericsson 750 USB WMC Modem Filter [Kernel | On_Demand | Stopped] -> %System32%\drivers\k750mdfl.sys -> MCCI [Ver = V4.28 | Size = 6576 bytes | Modified Date = 03/06/2005 13:46:58 | Attr = R ]
(k750mdm) Sony Ericsson 750 USB WMC Modem Drivers [Kernel | On_Demand | Stopped] -> %System32%\drivers\k750mdm.sys -> MCCI [Ver = V4.28 | Size = 89872 bytes | Modified Date = 03/06/2005 13:47:00 | Attr = R ]
(k750mgmt) Sony Ericsson 750 USB WMC Device Management Drivers [Kernel | On_Demand | Stopped] -> %System32%\drivers\k750mgmt.sys -> MCCI [Ver = V4.28 | Size = 81728 bytes | Modified Date = 03/06/2005 13:47:04 | Attr = R ]
(k750obex) Sony Ericsson 750 USB WMC OBEX Interface Drivers [Kernel | On_Demand | Stopped] -> %System32%\drivers\k750obex.sys -> MCCI [Ver = V4.28 | Size = 79488 bytes | Modified Date = 03/06/2005 13:47:06 | Attr = R ]
(kaspersky1) kaspersky1 [Kernel | On_Demand | Stopped] -> %SystemDrive%\Documents and Settings\Daniel\Desktop\kaspersky\kaspersky.sys -> File not found
(Kbdclass) Keyboard Class Driver [Kernel | System | Running] -> %System32%\drivers\kbdclass.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 24576 bytes | Modified Date = 04/08/2004 06:58:32 | Attr = ]
(kbdhid) Keyboard HID Driver [Kernel | System | Stopped] -> %System32%\drivers\kbdhid.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 14848 bytes | Modified Date = 04/08/2004 06:58:34 | Attr = ]
(kmixer) Microsoft Kernel Wave Audio Mixer [Kernel | On_Demand | Running] -> %System32%\drivers\kmixer.sys -> Microsoft Corporation [Ver = 5.1.2600.2929 (xpsp_sp2_gdr.060613-2359) | Size = 172416 bytes | Modified Date = 14/06/2006 08:47:46 | Attr = ]
(KSecDD) KSecDD [Kernel | Boot | Running] -> %System32%\drivers\ksecdd.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 92032 bytes | Modified Date = 04/08/2004 05:59:48 | Attr = ]
(L8042Kbd) Logitech SetPoint Keyboard Driver [Kernel | On_Demand | Running] -> %System32%\drivers\L8042Kbd.sys -> Logitech, Inc. [Ver = 2.20.698.00 | Size = 13106 bytes | Modified Date = 01/09/2004 16:57:18 | Attr = ]
(L8042mou) Logitech SetPoint PS/2 Mouse Filter Driver [Kernel | On_Demand | Running] -> %System32%\drivers\L8042mou.Sys -> Logitech, Inc. [Ver = 2.20.698.00 | Size = 55042 bytes | Modified Date = 01/09/2004 16:56:16 | Attr = ]
(lbrtfdc) lbrtfdc [Kernel | System | Stopped] -> -> File not found
(LHidUsbK) Logitech SetPoint USB Receiver Device Driver [Kernel | On_Demand | Stopped] -> System32\Drivers\LHidUsbK.Sys -> File not found
(LMouKE) Logitech SetPoint Mouse Filter Driver [Kernel | On_Demand | Running] -> %System32%\drivers\LMouKE.Sys -> Logitech, Inc. [Ver = 2.20.698.00 | Size = 71758 bytes | Modified Date = 01/09/2004 16:56:06 | Attr = ]
(LUsbKbd) Logitech SetPoint USB Keyboard Filter [Kernel | On_Demand | Stopped] -> System32\Drivers\LUsbKbd.Sys -> File not found
(LVUSBSta) Logitech USB Monitor Filter [Kernel | On_Demand | Running] -> %System32%\drivers\LVUSBSta.sys -> Logitech Inc. [Ver = 8.4.7.1032 | Size = 22016 bytes | Modified Date = 27/05/2005 08:31:28 | Attr = ]
(mnmdd) mnmdd [Kernel | System | Running] -> %System32%\drivers\mnmdd.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 4224 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(Modem) Modem [Kernel | On_Demand | Running] -> %System32%\drivers\modem.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 30080 bytes | Modified Date = 04/08/2004 06:08:06 | Attr = ]
(Mouclass) Mouse Class Driver [Kernel | System | Running] -> %System32%\drivers\mouclass.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 23040 bytes | Modified Date = 04/08/2004 06:58:32 | Attr = ]
(mouhid) Mouse HID Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\mouhid.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 12160 bytes | Modified Date = 17/08/2001 12:48:00 | Attr = ]
(MountMgr) Mount Point Manager [Kernel | Boot | Running] -> %System32%\drivers\mountmgr.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 42240 bytes | Modified Date = 04/08/2004 05:58:30 | Attr = ]
(MozyFilter) MozyFilter [File_System | System | Running] -> %System32%\drivers\mozy.sys -> Berkeley Data Systems [Ver = 1, 8, 4, 0 | Size = 52728 bytes | Modified Date = 30/08/2007 16:16:46 | Attr = ]
(mraid35x) mraid35x [Kernel | Disabled | Stopped] -> -> File not found
(MRxDAV) WebDav Client Redirector [File_System | On_Demand | Running] -> %System32%\drivers\mrxdav.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 181248 bytes | Modified Date = 04/08/2004 06:00:56 | Attr = ]
(MRxSmb) MRxSmb [File_System | System | Running] -> %System32%\drivers\mrxsmb.sys -> Microsoft Corporation [Ver = 5.1.2600.2902 (xpsp_sp2_gdr.060505-0036) | Size = 453120 bytes | Modified Date = 05/05/2006 09:41:46 | Attr = ]
(MSDV) Microsoft DV Camera and VCR [Kernel | On_Demand | Stopped] -> %System32%\drivers\msdv.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 51328 bytes | Modified Date = 04/08/2004 06:09:58 | Attr = ]
(Msfs) Msfs [File_System | System | Running] -> %System32%\drivers\msfs.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 19072 bytes | Modified Date = 04/08/2004 06:00:42 | Attr = ]
(MSKSSRV) Microsoft Streaming Service Proxy [Kernel | On_Demand | Stopped] -> %System32%\drivers\mskssrv.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 7552 bytes | Modified Date = 04/08/2004 05:58:42 | Attr = ]
(MSPCLOCK) Microsoft Streaming Clock Proxy [Kernel | On_Demand | Stopped] -> %System32%\drivers\mspclock.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5376 bytes | Modified Date = 04/08/2004 05:58:38 | Attr = ]
(MSPQM) Microsoft Streaming Quality Manager Proxy [Kernel | On_Demand | Stopped] -> %System32%\drivers\mspqm.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 4992 bytes | Modified Date = 04/08/2004 05:58:40 | Attr = ]
(mssmbios) Microsoft System Management BIOS Driver [Kernel | On_Demand | Running] -> %System32%\drivers\mssmbios.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 15488 bytes | Modified Date = 04/08/2004 06:07:48 | Attr = ]
(MSTEE) Microsoft Streaming Tee/Sink-to-Sink Converter [Kernel | On_Demand | Stopped] -> %System32%\drivers\mstee.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 5504 bytes | Modified Date = 04/08/2004 05:58:38 | Attr = ]
(ms_mpu401) Microsoft MPU-401 MIDI UART Driver [Kernel | On_Demand | Running] -> %System32%\drivers\msmpu401.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 2944 bytes | Modified Date = 17/08/2001 14:00:04 | Attr = ]
(Mup) Mup [File_System | Boot | Running] -> %System32%\drivers\mup.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 107904 bytes | Modified Date = 04/08/2004 06:15:20 | Attr = ]
(MxlW2k) MxlW2k [Kernel | On_Demand | Running] -> %System32%\drivers\MxlW2k.sys -> MusicMatch, Inc. [Ver = 1.1.0.121 | Size = 28352 bytes | Modified Date = 17/09/2006 14:34:36 | Attr = ]
(NABTSFEC) NABTS/FEC VBI Codec [Kernel | On_Demand | Stopped] -> %System32%\drivers\nabtsfec.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 85376 bytes | Modified Date = 04/08/2004 06:10:28 | Attr = ]
(NDIS) NDIS System Driver [Kernel | Boot | Running] -> %System32%\drivers\ndis.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 182912 bytes | Modified Date = 04/08/2004 06:14:28 | Attr = ]
(NdisIP) Microsoft TV/Video Connection [Kernel | On_Demand | Stopped] -> %System32%\drivers\ndisip.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 10880 bytes | Modified Date = 04/08/2004 06:10:12 | Attr = ]
(NdisTapi) Remote Access NDIS TAPI Driver [Kernel | On_Demand | Running] -> %System32%\drivers\ndistapi.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 9600 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(Ndisuio) NDIS Usermode I/O Protocol [Kernel | On_Demand | Running] -> %System32%\drivers\ndisuio.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 12928 bytes | Modified Date = 04/08/2004 06:03:12 | Attr = ]
(NdisWan) Remote Access NDIS WAN Driver [Kernel | On_Demand | Running] -> %System32%\drivers\ndiswan.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 91776 bytes | Modified Date = 04/08/2004 06:14:32 | Attr = ]
(NDProxy) NDIS Proxy [Kernel | On_Demand | Running] -> %System32%\drivers\ndproxy.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 38016 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(NetBIOS) NetBIOS Interface [File_System | System | Running] -> %System32%\drivers\netbios.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 34560 bytes | Modified Date = 04/08/2004 06:03:22 | Attr = ]
(NetBT) NetBios over Tcpip [Kernel | System | Running] -> %System32%\drivers\netbt.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 162816 bytes | Modified Date = 04/08/2004 06:14:38 | Attr = ]
(NIC1394) 1394 Net Driver [Kernel | On_Demand | Running] -> %System32%\drivers\nic1394.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 61824 bytes | Modified Date = 04/08/2004 05:58:30 | Attr = ]
(Npfs) Npfs [File_System | System | Running] -> %System32%\drivers\npfs.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 30848 bytes | Modified Date = 04/08/2004 06:00:44 | Attr = ]
(npkcrypt) npkcrypt [Kernel | Auto | Running] -> %SystemDrive%\Programs\Wizet\MapleStory\npkcrypt.sys -> INCA Internet Co., Ltd. [Ver = 2006. 11. 20. 1 | Size = 23217 bytes | Modified Date = 20/12/2006 10:53:30 | Attr = ]
(Ntfs) Ntfs [File_System | Disabled | Running] -> %System32%\drivers\ntfs.sys -> Microsoft Corporation [Ver = 5.1.2600.3081 (xpsp_sp2_gdr.070209-0028) | Size = 574464 bytes | Modified Date = 09/02/2007 11:10:36 | Attr = ]
(Null) Null [Kernel | System | Running] -> %System32%\drivers\null.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 2944 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(nv) nv [Kernel | On_Demand | Running] -> %System32%\drivers\nv4_mini.sys -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 3994624 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
(NwlnkFlt) IPX Traffic Filter Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\nwlnkflt.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 12416 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(NwlnkFwd) IPX Traffic Forwarder Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\nwlnkfwd.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 32512 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(ohci1394) VIA OHCI Compliant IEEE 1394 Host Controller [Kernel | Boot | Running] -> %System32%\drivers\ohci1394.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 61056 bytes | Modified Date = 04/08/2004 06:10:08 | Attr = ]
(Parport) Parallel port driver [Kernel | On_Demand | Running] -> %System32%\drivers\parport.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 80128 bytes | Modified Date = 04/08/2004 05:59:06 | Attr = ]
(PartMgr) Partition Manager [Kernel | Boot | Running] -> %System32%\drivers\partmgr.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 18688 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(ParVdm) ParVdm [Kernel | Auto | Running] -> %System32%\drivers\parvdm.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 6784 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(PCI) PCI Bus Driver [Kernel | Boot | Running] -> %System32%\drivers\pci.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 68224 bytes | Modified Date = 04/08/2004 06:07:46 | Attr = ]
(PCIDump) PCIDump [Kernel | System | Stopped] -> -> File not found
(PCIIde) PCIIde [Kernel | Boot | Running] -> %System32%\drivers\pciide.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 3328 bytes | Modified Date = 17/08/2001 21:51:52 | Attr = ]
(PCLEPCI) PCLEPCI [Kernel | System | Running] -> %System32%\drivers\Pclepci.sys -> Pinnacle Systems GmbH [Ver = 1.06 | Size = 14165 bytes | Modified Date = 19/03/2002 08:29:16 | Attr = ]
(Pcmcia) Pcmcia [Kernel | Disabled | Stopped] -> %System32%\drivers\pcmcia.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 119936 bytes | Modified Date = 04/08/2004 06:07:46 | Attr = ]
(PDCOMP) PDCOMP [Kernel | On_Demand | Stopped] -> -> File not found
(PDFRAME) PDFRAME [Kernel | On_Demand | Stopped] -> -> File not found
(PDRELI) PDRELI [Kernel | On_Demand | Stopped] -> -> File not found
(PDRFRAME) PDRFRAME [Kernel | On_Demand | Stopped] -> -> File not found
(perc2) perc2 [Kernel | Disabled | Stopped] -> -> File not found
(perc2hib) perc2hib [Kernel | Disabled | Stopped] -> -> File not found
(pfc) Padus ASPI Shell [Kernel | On_Demand | Running] -> %System32%\drivers\pfc.sys -> Padus, Inc. [Ver = 2, 5, 0, 201 | Size = 9856 bytes | Modified Date = 20/03/2003 14:01:46 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

(PptpMiniport) WAN Miniport (PPTP) [Kernel | On_Demand | Running] -> %System32%\drivers\raspptp.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48384 bytes | Modified Date = 04/08/2004 06:14:26 | Attr = ]
(Processor) Processor Driver [Kernel | System | Stopped] -> %System32%\drivers\processr.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 35328 bytes | Modified Date = 04/08/2004 05:59:18 | Attr = ]
(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> %System32%\drivers\ptilink.sys -> Parallel Technologies, Inc. [Ver = 1.10 (XPClient.010817-1148) | Size = 17792 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(PxHelp20) PxHelp20 [Kernel | Boot | Running] -> %System32%\drivers\pxhelp20.sys -> Sonic Solutions [Ver = 3.00.56a | Size = 43528 bytes | Modified Date = 26/07/2007 02:53:30 | Attr = ]
(QCMerced) Logitech QuickCam Communicate [Kernel | On_Demand | Running] -> %System32%\drivers\lvcm.sys -> [Ver = | Size = 1317152 bytes | Modified Date = 27/05/2005 08:32:52 | Attr = ]
(ql1080) ql1080 [Kernel | Disabled | Stopped] -> -> File not found
(Ql10wnt) Ql10wnt [Kernel | Disabled | Stopped] -> -> File not found
(ql12160) ql12160 [Kernel | Disabled | Stopped] -> -> File not found
(ql1240) ql1240 [Kernel | Disabled | Stopped] -> -> File not found
(ql1280) ql1280 [Kernel | Disabled | Stopped] -> -> File not found
(RasAcd) Remote Access Auto Connection Driver [Kernel | System | Running] -> %System32%\drivers\rasacd.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 8832 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(Rasl2tp) WAN Miniport (L2TP) [Kernel | On_Demand | Running] -> %System32%\drivers\rasl2tp.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 51328 bytes | Modified Date = 04/08/2004 06:14:22 | Attr = ]
(RasPppoe) Remote Access PPPOE Driver [Kernel | On_Demand | Running] -> %System32%\drivers\raspppoe.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 41472 bytes | Modified Date = 04/08/2004 06:05:08 | Attr = ]
(Raspti) Direct Parallel [Kernel | On_Demand | Running] -> %System32%\drivers\raspti.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 16512 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(Rdbss) Rdbss [File_System | System | Running] -> %System32%\drivers\rdbss.sys -> Microsoft Corporation [Ver = 5.1.2600.2902 (xpsp_sp2_gdr.060505-0036) | Size = 174592 bytes | Modified Date = 05/05/2006 09:47:58 | Attr = ]
(RDPCDD) RDPCDD [Kernel | System | Running] -> %System32%\drivers\rdpcdd.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 4224 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(RDPWD) RDPWD [Kernel | On_Demand | Stopped] -> %System32%\drivers\rdpwd.sys -> Microsoft Corporation [Ver = 5.1.2600.2695 (xpsp_sp2_gdr.050609-1528) | Size = 139528 bytes | Modified Date = 10/06/2005 04:09:46 | Attr = ]
(redbook) Digital CD Audio Playback Filter Driver [Kernel | System | Running] -> %System32%\drivers\redbook.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 57472 bytes | Modified Date = 04/08/2004 05:59:38 | Attr = ]
(ROOTMODEM) Microsoft Legacy Modem Driver [Kernel | On_Demand | Running] -> %System32%\drivers\rootmdm.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 5888 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
(RPPKT) Radialpoint Filter (x86) [Kernel | On_Demand | Running] -> %System32%\drivers\rp_pkt32.sys -> Radialpoint, Inc. [Ver = 6.0.0.0 | Size = 48384 bytes | Modified Date = 19/04/2007 10:36:50 | Attr = ]
(RPSKT) Security Services Driver (x86) [Kernel | Auto | Running] -> %System32%\drivers\rp_skt32.sys -> Radialpoint, Inc. [Ver = 6.0.0.0 | Size = 55296 bytes | Modified Date = 06/03/2007 12:24:00 | Attr = ]
(RT25USBAP) Nintendo Wi-Fi USB Connector Service [Kernel | On_Demand | Stopped] -> %System32%\drivers\rt25usbap.sys -> Ralink Technology Inc. [Ver = 2.00.2.8 built by: WinDDK | Size = 162944 bytes | Modified Date = 09/12/2005 04:53:14 | Attr = ]
(RT61) D-Link Wireless Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\rt61.sys -> Ralink Technology Inc. [Ver = 1.00.00.0000 | Size = 319104 bytes | Modified Date = 04/06/2005 20:07:56 | Attr = ]
(ScanUSBEMPIA) USB Still Image Capture Device [Kernel | On_Demand | Stopped] -> %System32%\drivers\emScan.sys -> eMPIA Technology, Inc. [Ver = 1.1.0406.0 | Size = 4493 bytes | Modified Date = 06/04/2004 13:07:54 | Attr = ]
(Secdrv) Secdrv [Kernel | Auto | Running] -> %System32%\drivers\secdrv.sys -> Macrovision Europe Ltd [Ver = 3.18.000 | Size = 12400 bytes | Modified Date = 17/09/2006 12:32:12 | Attr = ]
(serenum) Serenum Filter Driver [Kernel | On_Demand | Running] -> %System32%\drivers\serenum.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 15488 bytes | Modified Date = 04/08/2004 05:59:08 | Attr = ]
(Serial) Serial port driver [Kernel | System | Running] -> %System32%\drivers\serial.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 64896 bytes | Modified Date = 04/08/2004 06:15:52 | Attr = ]
(sfdrv01) StarForce Protection Environment Driver (version 1.x) [Kernel | Boot | Running] -> %System32%\drivers\sfdrv01.sys -> Protection Technology [Ver = 1.32 | Size = 48640 bytes | Modified Date = 03/03/2005 17:53:58 | Attr = ]
(sfhlp02) StarForce Protection Helper Driver (version 2.x) [Kernel | Boot | Running] -> %System32%\drivers\sfhlp02.sys -> Protection Technology [Ver = 2.2 | Size = 6656 bytes | Modified Date = 23/02/2005 15:59:56 | Attr = ]
(Sfloppy) Sfloppy [Kernel | System | Stopped] -> %System32%\drivers\sfloppy.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 11392 bytes | Modified Date = 04/08/2004 05:59:54 | Attr = ]
(sfsync02) StarForce Protection Synchronization Driver (version 2.x) [Kernel | Boot | Running] -> %System32%\drivers\sfsync02.sys -> Protection Technology [Ver = 2.7 | Size = 20544 bytes | Modified Date = 03/12/2004 10:20:42 | Attr = ]
(Simbad) Simbad [Kernel | Disabled | Stopped] -> -> File not found
(SLIP) BDA Slip De-Framer [Kernel | On_Demand | Stopped] -> %System32%\drivers\slip.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 11136 bytes | Modified Date = 04/08/2004 06:10:16 | Attr = ]
(SONYPVU1) Sony USB Filter Driver (SONYPVU1) [Kernel | On_Demand | Stopped] -> %System32%\drivers\SONYPVU1.SYS -> Sony Corporation [Ver = 1.3.0526.0 (XPClient.010817-1148) | Size = 7552 bytes | Modified Date = 17/08/2001 12:56:16 | Attr = ]
(Sparrow) Sparrow [Kernel | Disabled | Stopped] -> -> File not found
(splitter) Microsoft Kernel Audio Splitter [Kernel | On_Demand | Stopped] -> %System32%\drivers\splitter.sys -> Microsoft Corporation [Ver = 5.1.2600.2929 (xpsp_sp2_gdr.060613-2359) | Size = 6400 bytes | Modified Date = 14/06/2006 08:47:46 | Attr = ]
(sr) System Restore Filter Driver [File_System | Boot | Running] -> %System32%\drivers\sr.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 73472 bytes | Modified Date = 04/08/2004 06:06:26 | Attr = ]
(Srv) Srv [File_System | On_Demand | Running] -> %System32%\drivers\srv.sys -> Microsoft Corporation [Ver = 5.1.2600.2974 (xpsp_sp2_gdr.060814-0101) | Size = 332928 bytes | Modified Date = 14/08/2006 10:34:42 | Attr = ]
(ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM) [Kernel | On_Demand | Stopped] -> %System32%\drivers\ss_bus.sys -> MCCI [Ver = V4.34 | Size = 58320 bytes | Modified Date = 30/08/2005 17:57:18 | Attr = ]
(ss_mdfl) SAMSUNG Mobile USB Modem 1.0 Filter [Kernel | On_Demand | Stopped] -> %System32%\drivers\ss_mdfl.sys -> MCCI [Ver = V4.34 | Size = 8304 bytes | Modified Date = 30/08/2005 17:58:56 | Attr = ]
(ss_mdm) SAMSUNG Mobile USB Modem 1.0 Drivers [Kernel | On_Demand | Stopped] -> %System32%\drivers\ss_mdm.sys -> MCCI [Ver = V4.34 | Size = 94000 bytes | Modified Date = 30/08/2005 17:59:00 | Attr = ]
(StarOpen) StarOpen [File_System | System | Running] -> %System32%\drivers\StarOpen.sys -> [Ver = | Size = 5632 bytes | Modified Date = 20/02/2007 13:07:56 | Attr = R ]
(streamip) BDA IPSink [Kernel | On_Demand | Stopped] -> %System32%\drivers\streamip.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 15360 bytes | Modified Date = 04/08/2004 06:10:12 | Attr = ]
(swenum) Software Bus Driver [Kernel | On_Demand | Running] -> %System32%\drivers\swenum.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 4352 bytes | Modified Date = 04/08/2004 05:58:42 | Attr = ]
(swmidi) Microsoft Kernel GS Wavetable Synthesizer [Kernel | On_Demand | Stopped] -> %System32%\drivers\swmidi.sys -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 54272 bytes | Modified Date = 17/08/2001 14:00:52 | Attr = ]
(symc810) symc810 [Kernel | Disabled | Stopped] -> -> File not found
(symc8xx) symc8xx [Kernel | Disabled | Stopped] -> -> File not found
(sym_hi) sym_hi [Kernel | Disabled | Stopped] -> -> File not found
(sym_u3) sym_u3 [Kernel | Disabled | Stopped] -> -> File not found
(sysaudio) Microsoft Kernel System Audio Device [Kernel | On_Demand | Running] -> %System32%\drivers\sysaudio.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 60800 bytes | Modified Date = 04/08/2004 06:15:56 | Attr = ]
(Tcpip) TCP/IP Protocol Driver [Kernel | System | Running] -> %System32%\drivers\tcpip.sys -> Microsoft Corporation [Ver = 5.1.2600.2892 (xpsp_sp2_gdr.060420-0254) | Size = 359808 bytes | Modified Date = 20/04/2006 11:51:50 | Attr = ]
(TDPIPE) TDPIPE [Kernel | On_Demand | Stopped] -> %System32%\drivers\tdpipe.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 12040 bytes | Modified Date = 04/08/2004 08:01:08 | Attr = ]
(TDTCP) TDTCP [Kernel | On_Demand | Stopped] -> %System32%\drivers\tdtcp.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 21896 bytes | Modified Date = 04/08/2004 08:01:08 | Attr = ]
(TermDD) Terminal Device Driver [Kernel | System | Running] -> %System32%\drivers\termdd.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 40840 bytes | Modified Date = 04/08/2004 08:01:08 | Attr = ]
(toshidpt) TOSHIBA Bluetooth HID port driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\Toshidpt.sys -> TOSHIBA Corporation. [Ver = Version 1.00.00 | Size = 2851 bytes | Modified Date = 16/10/2002 12:55:48 | Attr = ]
(TosIde) TosIde [Kernel | Disabled | Stopped] -> -> File not found
(tosporte) Bluetooth Port Driver from Toshiba [Kernel | On_Demand | Running] -> %System32%\drivers\Tosporte.sys -> TOSHIBA Corporation [Ver = 1.02.00 | Size = 51582 bytes | Modified Date = 08/01/2005 00:15:40 | Attr = ]
(Tosrfbd) Bluetooth RFBUS from TOSHIBA [Kernel | On_Demand | Stopped] -> %System32%\drivers\TosRfbd.sys -> TOSHIBA CORPORATION [Ver = 01.03.29 | Size = 97792 bytes | Modified Date = 24/12/2004 17:36:38 | Attr = ]
(Tosrfbnp) Bluetooth RFBNEP from TOSHIBA [Kernel | On_Demand | Stopped] -> %System32%\drivers\tosrfbnp.sys -> TOSHIBA Corporation [Ver = 1.00 | Size = 36531 bytes | Modified Date = 08/07/2004 16:07:34 | Attr = ]
(Tosrfcom) Bluetooth RFCOMM from TOSHIBA [Kernel | System | Running] -> %System32%\drivers\tosrfcom.sys -> TOSHIBA Corporation [Ver = 1.02 | Size = 62799 bytes | Modified Date = 04/10/2004 09:33:02 | Attr = ]
(Tosrfhid) Bluetooth RFHID from TOSHIBA [Kernel | On_Demand | Stopped] -> %System32%\drivers\TosRfhid.sys -> TOSHIBA Corporation. [Ver = Version 1.03.13 | Size = 50048 bytes | Modified Date = 15/11/2004 21:51:54 | Attr = ]
(tosrfnds) Bluetooth Personal Area Network from TOSHIBA [Kernel | On_Demand | Stopped] -> %System32%\drivers\tosrfnds.sys -> TOSHIBA Corporation. [Ver = Version 1.00.03 | Size = 18612 bytes | Modified Date = 06/01/2005 12:42:42 | Attr = ]
(TosRfSnd) Bluetooth Audio Device (WDM) from TOSHIBA [Kernel | On_Demand | Stopped] -> %System32%\drivers\TosRfSnd.sys -> TOSHIBA Corporation [Ver = 1.0.0.0 | Size = 50048 bytes | Modified Date = 15/12/2004 16:30:14 | Attr = ]
(Tosrfusb) Bluetooth USB Controller [Kernel | On_Demand | Stopped] -> %System32%\drivers\tosrfusb.sys -> TOSHIBA CORPORATION [Ver = 02.00.11 | Size = 34816 bytes | Modified Date = 21/12/2004 10:38:12 | Attr = ]
(Udfs) Udfs [File_System | Disabled | Stopped] -> %System32%\drivers\udfs.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 66176 bytes | Modified Date = 04/08/2004 06:00:32 | Attr = ]
(ultra) ultra [Kernel | Disabled | Stopped] -> -> File not found
(Update) Microcode Update Driver [Kernel | On_Demand | Running] -> %System32%\drivers\update.sys -> Microsoft Corporation [Ver = 5.1.2600.3124 (xpsp_sp2_gdr.070423-0049) | Size = 364160 bytes | Modified Date = 23/04/2007 10:32:54 | Attr = ]
(USBAAPL) Apple Mobile USB Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\usbaapl.sys -> Apple, Inc. [Ver = 1, 25, 0, 0 | Size = 30464 bytes | Modified Date = 31/10/2007 14:09:14 | Attr = ]
(usbaudio) USB Audio Driver (WDM) [Kernel | On_Demand | Running] -> %System32%\drivers\usbaudio.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 59264 bytes | Modified Date = 04/08/2004 06:07:56 | Attr = ]
(usbccgp) Microsoft USB Generic Parent Driver [Kernel | On_Demand | Running] -> %System32%\drivers\usbccgp.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 31616 bytes | Modified Date = 04/08/2004 06:08:46 | Attr = ]
(usbehci) Microsoft USB 2.0 Enhanced Host Controller Miniport Driver [Kernel | On_Demand | Running] -> %System32%\drivers\usbehci.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 26624 bytes | Modified Date = 04/08/2004 06:08:38 | Attr = ]
(usbhub) USB2 Enabled Hub [Kernel | On_Demand | Running] -> %System32%\drivers\usbhub.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 57600 bytes | Modified Date = 04/08/2004 06:08:42 | Attr = ]
(usbprint) Microsoft USB PRINTER Class [Kernel | On_Demand | Running] -> %System32%\drivers\usbprint.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 25856 bytes | Modified Date = 04/08/2004 06:01:24 | Attr = ]
(usbscan) USB Scanner Driver [Kernel | On_Demand | Running] -> %System32%\drivers\usbscan.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 15104 bytes | Modified Date = 04/08/2004 05:58:46 | Attr = ]
(usbstor) USB Mass Storage Driver [Kernel | On_Demand | Stopped] -> %System32%\drivers\usbstor.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 26496 bytes | Modified Date = 04/08/2004 06:08:46 | Attr = ]
(usbuhci) Microsoft USB Universal Host Controller Miniport Driver [Kernel | On_Demand | Running] -> %System32%\drivers\usbuhci.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 20480 bytes | Modified Date = 04/08/2004 06:08:38 | Attr = ]
(VgaSave) VGA Display Controller. [Kernel | System | Running] -> %System32%\drivers\vga.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 20992 bytes | Modified Date = 04/08/2004 06:07:06 | Attr = ]
(ViaIde) ViaIde [Kernel | Disabled | Stopped] -> -> File not found
(VolSnap) VolSnap [Kernel | Boot | Running] -> %System32%\drivers\volsnap.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 52352 bytes | Modified Date = 04/08/2004 06:00:16 | Attr = ]
(Wanarp) Remote Access IP ARP Driver [Kernel | On_Demand | Running] -> %System32%\drivers\wanarp.sys -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 34560 bytes | Modified Date = 04/08/2004 06:04:58 | Attr = ]
(WDICA) WDICA [Kernel | On_Demand | Stopped] -> -> File not found
(wdmaud) Microsoft WINMM WDM Audio Compatibility Driver [Kernel | On_Demand | Running] -> %System32%\drivers\wdmaud.sys -> Microsoft Corporation [Ver = 5.1.2600.2929 (xpsp_sp2_gdr.060613-2359) | Size = 82944 bytes | Modified Date = 14/06/2006 09:00:46 | Attr = ]
(WpdUsb) WpdUsb [Kernel | On_Demand | Stopped] -> %System32%\drivers\wpdusb.sys -> Microsoft Corporation [Ver = 5.2.5721.5145 (WMP_11.061018-2006) | Size = 38528 bytes | Modified Date = 18/10/2006 20:00:00 | Attr = ]
(WSTCODEC) World Standard Teletext Codec [Kernel | On_Demand | Stopped] -> %System32%\drivers\wstcodec.sys -> Microsoft Corporation [Ver = 5.3.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 19328 bytes | Modified Date = 04/08/2004 06:10:22 | Attr = ]
(WudfPf) Windows Driver Foundation - User-mode Driver Framework Platform Driver [Kernel | Boot | Running] -> %System32%\drivers\WudfPf.sys -> Microsoft Corporation [Ver = 6.0.5716.32 (winmain(wmbla).060928-1756) | Size = 77568 bytes | Modified Date = 28/09/2006 18:55:50 | Attr = ]
(WudfRd) Windows Driver Foundation - User-mode Driver Framework Reflector [Kernel | On_Demand | Stopped] -> %System32%\drivers\WudfRd.sys -> Microsoft Corporation [Ver = 6.0.5716.32 (winmain(wmbla).060928-1756) | Size = 82944 bytes | Modified Date = 28/09/2006 19:00:34 | Attr = ]
(zntport) NTPort Library Driver [Kernel | Auto | Stopped] -> %System32%\zntport.sys -> File not found


----------



## carrie_uk (Jul 7, 2004)

[Registry - Additional Scans - All]
< ActiveX StubPath [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ -> 
{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -> -> 
{22d6f312-b0f6-11d0-94ab-0080c74c7e95} -> -> 
{2C7339CF-2B09-4501-B3F3-F3508C9228ED} -> %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll -> 
{44BBA840-CC51-11CF-AAFA-00AA00B6015C} -> "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install -> 
{44BBA842-CC51-11CF-AAFA-00AA00B6015B} -> rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT -> 
{5945c046-1e7d-11d1-bc44-00c04fd912be} -> rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser -> 
{6BF52A52-394A-11d3-B153-00C04F79FAA6} -> rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub -> 
{73FA19D0-2D75-11D2-995D-00C04F98BBC9} -> -> 
{7790769C-0471-11d2-AF11-00C04FA35D02} -> "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install -> 
{89820200-ECBD-11cf-8B85-00AA005B4340} -> regsvr32.exe /s /n /i:U shell32.dll -> 
{89820200-ECBD-11cf-8B85-00AA005B4383} -> C:\WINDOWS\system32\ie4uinit.exe -BaseSettings -> 
{89B4C1CD-B018-4511-B0A1-5476DBF70820} -> C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install -> 
{8b15971b-5355-4c82-8c07-7e181ea07608} -> rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser -> 
{94de52c8-2d59-4f1b-883e-79663d2d9a8c} -> -> 
<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} -> C:\WINDOWS\system32\ieudinit.exe -> 
>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} -> C:\WINDOWS\inf\unregmp2.exe /ShowWMP -> 
>{26923b43-4d38-484f-9b9e-de460746276c} -> C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig -> 
>{60B49E34-C7CC-11D0-8953-00A0C90347FF} -> RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP -> 
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} -> %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE -> 
< Approved Shell Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved -> 
[HKLM] -> Reg Data - Key not found [] -> File not found
{00020D75-0000-0000-C000-000000000046} [HKLM] -> %SystemDrive%\Programs\Microsoft Office\OFFICE11\MLSHEXT.DLL [Microsoft Office Outlook Desktop Icon Handler] -> Microsoft Corporation [Ver = 11.0.5510 | Size = 29240 bytes | Modified Date = 14/07/2003 21:41:54 | Attr = ]
{00022613-0000-0000-C000-000000000046} [HKLM] -> %System32%\mmsys.cpl [Multimedia File Property Sheet] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 618496 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
{0006F045-0000-0000-C000-000000000046} [HKLM] -> %SystemDrive%\Programs\Microsoft Office\OFFICE11\OLKFSTUB.DLL [Microsoft Office Outlook Custom Icon Handler] -> Microsoft Corporation [Ver = 11.0.5510 | Size = 232512 bytes | Modified Date = 14/07/2003 21:46:42 | Attr = ]
{00BB2763-6A77-11D0-A535-00C04FD7D062} [HKLM] -> %System32%\browseui.dll [Microsoft AutoComplete] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{00BB2764-6A77-11D0-A535-00C04FD7D062} [HKLM] -> %System32%\browseui.dll [Microsoft History AutoComplete List] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr =  ]
{00BB2765-6A77-11D0-A535-00C04FD7D062} [HKLM] -> %System32%\browseui.dll [Microsoft Multiple AutoComplete List Container] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} [HKLM] -> Reg Data - Key not found [Autoplay for SlideShow] -> File not found
{01E04581-4EEE-11d0-BFE9-00AA005B4383} [HKLM] -> %System32%\browseui.dll [&Address] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{03C036F1-A186-11D0-824A-00AA005B4383} [HKLM] -> %System32%\browseui.dll [Microsoft Shell Folder AutoComplete List] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{07798131-AF23-11d1-9111-00A0C98BA67D} [HKLM] -> %System32%\browseui.dll [Web Search] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{07C45BB1-4A8C-4642-A1F5-237E7215FF66} [HKLM] -> %System32%\ieframe.dll [IE Microsoft BrowserBand] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{08165EA0-E946-11CF-9C87-00AA005127ED} [HKLM] -> %System32%\webcheck.dll [WebCheckWebCrawler] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{0A89A860-D7B1-11CE-8350-444553540000} [HKLM] -> %System32%\shdocvw.dll [Shell Automation Inproc Service] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{0B124F8F-91F0-11D1-B8B5-006008059382} [HKLM] -> %System32%\appwiz.cpl [Installed Apps Enumerator] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 549888 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} [HKLM] -> %System32%\cabview.dll [.CAB file viewer] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 84480 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{0D45D530-764B-11d0-A1CA-00AA00C16E65} [HKLM] -> %System32%\dsuiext.dll [Directory Property UI] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 113152 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{0DF44EAA-FF21-4412-828E-260A8728E7F1} [HKLM] -> Reg Data - Key not found [Taskbar and Start Menu] -> File not found
{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} [HKLM] -> %System32%\docprop2.dll [Microsoft DocProp Inplace Droplist Combo Control] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{10CFC467-4392-11d2-8DB4-00C04FA31A66} [HKLM] -> %System32%\cscui.dll [Offline Files Folder Options] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 326656 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{131A6951-7F78-11D0-A979-00C04FD705A2} [HKLM] -> %System32%\shdocvw.dll [ISFBand OC] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{143A62C8-C33B-11D1-84FE-00C04FA34A14} [HKLM] -> %SystemRoot%\msagent\agentpsh.dll [Microsoft Agent Character Property Sheet Handler] -> Microsoft Corporation [Ver = 2.00.0.3422 | Size = 24064 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{1530F7EE-5128-43BD-9977-84A4B0FAD7DF} [HKLM] -> %System32%\phototoys.dll [PhotoToys] -> Microsoft Corporation [Ver = 5.1.2455.0 | Size = 21504 bytes | Modified Date = 19/03/2002 16:30:00 | Attr = ]
{16148659-720A-457d-850B-2DBD87BB129D} [HKLM] -> %SystemDrive%\Programs\Audible\Bin\AudibleExt.dll [Audible Shlell Extension] -> Audible, Inc. [Ver = 1, 0, 0, 5 | Size = 263768 bytes | Modified Date = 03/11/2007 08:55:40 | Attr = ]
{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} [HKLM] -> %System32%\dsquery.dll [Directory Object Find] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 239104 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{169A0691-8DF9-11d1-A1C4-00C04FD75D13} [HKLM] -> %System32%\browseui.dll [In-pane search] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{176d6597-26d3-11d1-b350-080036a75b03} [HKLM] -> %System32%\icmui.dll [ICM Scanner Management] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 54784 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{1C1EDB47-CE22-4bbb-B608-77B48F83C823} [HKLM] -> %System32%\ieframe.dll [IE Fade Task] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{1CDB2949-8F65-4355-8456-263E7C208A5D} [HKLM] -> %System32%\nvshell.dll [Desktop Explorer] -> [Ver = | Size = 466944 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
{1D2680C9-0E2A-469d-B787-065558BC7D43} [HKLM] -> %System32%\mscoree.dll [Fusion Cache] -> Microsoft Corporation [Ver = 2.0.50727.832 (QFE.050727-8300) | Size = 271360 bytes | Modified Date = 13/04/2007 02:21:14 | Attr = ]
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} [HKLM] -> %System32%\nvshell.dll [Desktop Explorer Menu] -> [Ver = | Size = 466944 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} [HKLM] -> %System32%\nvshell.dll [nView Desktop Context Menu] -> [Ver = | Size = 466944 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
{1F2E5C40-9550-11CE-99D2-00AA006E086C} [HKLM] -> %System32%\rshx32.dll [NTFS Security Page] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 39936 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{1F77B17B-F531-44DB-ACA4-76ABB5010A28} [HKLM] -> %SystemDrive%\Programs\AIMP2\System\aimp_shell.dll [AIMP2: Shell Extention] -> AIMP DevTeam [Ver = 3.0.0.0 | Size = 60928 bytes | Modified Date = 23/07/2007 11:07:12 | Attr = ]
{205D7A97-F16D-4691-86EF-F3075DCCA57D} [HKLM] -> %System32%\ieframe.dll [IE Menu Desk Bar] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{21569614-B795-46b1-85F4-E737A8DC09AD} [HKLM] -> %System32%\browseui.dll [Shell Search Band] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{2206CDB2-19C1-11D1-89E0-00C04FD7A829} [HKLM] -> %CommonProgramFiles%\System\Ole DB\oledb32.dll [Microsoft Data Link] -> Microsoft Corporation [Ver = 2.81.1117.0 (xpsp_sp2_rtm.040803-2158) | Size = 487424 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{22BF0C20-6DA7-11D0-B373-00A0C9034938} [HKLM] -> %System32%\browseui.dll [Download Status] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [Search] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [Help and Support] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [Help and Support] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [Run...] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [Internet] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [E-mail] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} [HKLM] -> %System32%\shdocvw.dll [Set Program Access and Defaults] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} [HKLM] -> %System32%\docprop2.dll [Microsoft DocProp Inplace Time Control] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{3028902F-6374-48b2-8DC6-9725E775B926} [HKLM] -> %System32%\ieframe.dll [IE AutoComplete] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{30D02401-6A81-11d0-8274-00C04FD5AE38} [HKLM] -> %System32%\ieframe.dll [IE Search Band] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Media Band] -> File not found
{32714800-2E5F-11d0-8B85-00AA0044F941} [HKLM] -> %ProgramFiles%\Outlook Express\wabfind.dll [For &People...] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 32768 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{352EC2B7-8B9A-11D1-B8AE-006008059382} [HKLM] -> %System32%\appwiz.cpl [Shell Application Manager] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 549888 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
{35786D3C-B075-49b9-88DD-029876E11C01} [HKLM] -> %System32%\WpdShext.dll [Portable Devices] -> Microsoft Corporation [Ver = 5.2.5721.5145 (WMP_11.061018-2006) | Size = 2603008 bytes | Modified Date = 18/10/2006 21:47:22 | Attr = ]
{3C374A40-BAE4-11CF-BF7D-00AA006946EE} [HKLM] -> %System32%\ieframe.dll [Microsoft Url History Service] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} [HKLM] -> %System32%\browseui.dll [Shell DeskBarApp] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} [HKLM] -> %System32%\ieframe.dll [The Internet] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{3EA48300-8CF6-101B-84FB-666CCB9BCD32} [HKLM] -> %System32%\docprop.dll [OLE Docfile Property Page] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 46080 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{3F30C968-480A-4C6C-862D-EFC0897BB84B} [HKLM] -> %System32%\shimgvw.dll [GDI+ file thumbnail extractor] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 438272 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{3F953603-1008-4f6e-A73A-04AAC7A992F1} [HKLM] -> %System32%\wiashext.dll [Scanners & Cameras] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 589312 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3} [HKLM] -> %ProgramFiles%\Logitech\Video\Namespc2.dll [My Logitech Pictures] -> Logitech Inc. [Ver = 8.4.7.1034 | Size = 135168 bytes | Modified Date = 08/06/2005 14:25:52 | Attr = ]
{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} [HKLM] -> %System32%\shmedia.dll [Video Media Properties Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 151552 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{40dd6e20-7c17-11ce-a804-00aa003ca9f6} [HKLM] -> %System32%\ntshrui.dll [Shell extensions for sharing] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 143872 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{41E300E0-78B6-11ce-849B-444553540000} [HKLM] -> %System32%\themeui.dll [PlusPack CPL Extension] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 385536 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{42042206-2D85-11D3-8CFF-005004838597} [HKLM] -> %SystemDrive%\Programs\Microsoft Office\OFFICE11\MSOHEV.DLL [Microsoft Office HTML Icon Handler] -> Microsoft Corporation [Ver = 11.0.5510 | Size = 67128 bytes | Modified Date = 14/07/2003 21:52:58 | Attr = ]
{42071712-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> %System32%\deskadp.dll [Display Adapter CPL Extension] -> Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 16384 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{42071713-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> %System32%\deskmon.dll [Display Monitor CPL Extension] -> Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 16896 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{42071714-76d4-11d1-8b24-00a0c9068ff3} [HKLM] -> deskpan.dll [Display Panning CPL Extension] -> File not found
{43886CD5-6529-41c4-A707-7B3C92C05E68} [HKLM] -> %System32%\ieframe.dll [IE Navigation Bar] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{44C76ECD-F7FA-411c-9929-1B77BA77F524} [HKLM] -> %System32%\ieframe.dll [IE Menu Site] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{4a7ded0a-ad25-11d0-98a8-0800361b1103} [HKLM] -> %System32%\mydocs.dll [MyDocs Properties] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 90624 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{4B78D326-D922-44f9-AF2A-07805C2A3560} [HKLM] -> %System32%\ieframe.dll [IE Menu Band] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{4E40F770-369C-11d0-8922-00A024AB2DBB} [HKLM] -> %System32%\dssec.dll [DS Security Page] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 51200 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} [HKLM] -> %SystemDrive%\Programs\Microsoft Office\Visio11\VISSHE.DLL [{506F4668-F13E-4AA1-BB04-B43203AB3CC0}] -> [Ver = | Size = 785464 bytes | Modified Date = 16/08/2003 05:29:34 | Attr = ]
{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} [HKLM] -> %System32%\slayerxp.dll [Compatibility Page] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 25088 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{5464D816-CF16-4784-B9F3-75C0DB52B499} [HKLM] -> %ProgramFiles%\Yahoo!\Common\ymmapi2005010104.dll [Yahoo! Mail] -> Yahoo! Inc. [Ver = 2005, 1, 1, 4 | Size = 190496 bytes | Modified Date = 30/10/2006 14:50:00 | Attr = ]
{56117100-C0CD-101B-81E2-00AA004AE837} [HKLM] -> %System32%\shscrap.dll [Shell Scrap DataHandler] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 27648 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{58f1f272-9240-4f51-b6d4-fd63d1618591} [HKLM] -> %System32%\netplwiz.dll [Get a Passport Wizard] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 875008 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{59099400-57FF-11CE-BD94-0020AF85B590} [HKLM] -> %System32%\diskcopy.dll [Disk Copy Extension] -> Microsoft Corporation [Ver = 6.00.2600.0000 (xpclient.010817-1148) | Size = 1501696 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{596AB062-B4D2-4215-9F74-E9109B0A8153} [HKLM] -> %System32%\twext.dll [Previous Versions Property Page] -> Microsoft Corporation [Ver = 6.00.3800.2180 (xpsp_sp2_rtm.040803-2158) | Size = 44032 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{59be4990-f85c-11ce-aff7-00aa003ca9f6} [HKLM] -> %System32%\ntlanui2.dll [Shell extensions for Microsoft Windows Network objects] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 14336 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{5DB2625A-54DF-11D0-B6C4-0800091AA605} [HKLM] -> %System32%\icmui.dll [ICM Monitor Management] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 54784 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{5E6AB780-7743-11CF-A12B-00AA004AE837} [HKLM] -> %System32%\browseui.dll [Microsoft Internet Toolbar] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{5F327514-6C5E-4d60-8F16-D07FA08A78ED} [HKLM] -> %System32%\wuaucpl.cpl [Auto Update Property Sheet Extension] -> Microsoft Corporation [Ver = 7.0.6000.381 (winmain(wmbla).070730-1740) | Size = 216408 bytes | Modified Date = 30/07/2007 18:19:28 | Attr = ]
{60254CA5-953B-11CF-8C96-00AA00B8708C} [HKLM] -> %System32%\wshext.dll [Shell extensions for Windows Script Host] -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 65536 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{6038EF75-ABFC-4e59-AB6F-12D397F6568D} [HKLM] -> %System32%\ieframe.dll [IE Microsoft History AutoComplete List] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{60fd46de-f830-4894-a628-6fa81bc0190d} [HKLM] -> %System32%\photowiz.dll [%DESC_PublishDropTarget%] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 176128 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{62AE1F9A-126A-11D0-A14B-0800361B1103} [HKLM] -> %System32%\dsuiext.dll [Directory Context Menu Verbs] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 113152 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{63da6ec0-2e98-11cf-8d82-444553540000} [HKLM] -> %System32%\msieftp.dll [FTP Folders Webview] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 248832 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{640167b4-59b0-47a6-b335-a6b3c0695aea} [HKLM] -> %System32%\audiodev.dll [Portable Media Devices] -> Microsoft Corporation [Ver = 5.2.5721.5145 (WMP_11.061018-2006) | Size = 276992 bytes | Modified Date = 18/10/2006 21:47:08 | Attr = ]
{6413BA2C-B461-11d1-A18A-080036B11A03} [HKLM] -> %System32%\browseui.dll [Augmented Shell Folder 2] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} [HKLM] -> %System32%\shimgvw.dll [Shell Image Data Factory] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 438272 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{6756A641-DE71-11d0-831B-00AA005B4383} [HKLM] -> %System32%\browseui.dll [MRU AutoComplete List] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{675F097E-4C4D-11D0-B6C1-0800091AA605} [HKLM] -> %System32%\icmui.dll [ICM Printer Management] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 54784 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{67EA19A0-CCEF-11d0-8024-00C04FD75D13} [HKLM] -> %System32%\shdocvw.dll [CDF Extension Copy Hook] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{692F0339-CBAA-47e6-B5B5-3B84DB604E87} [HKLM] -> %System32%\extmgr.dll [Extensions Manager Folder] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 132608 bytes | Modified Date = 20/08/2007 10:04:34 | Attr = ]
{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} [HKLM] -> %System32%\browseui.dll [Custom MRU AutoCompleted List] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

{6A205B57-2567-4A2C-B881-F787FAB579A3} [HKLM] -> %System32%\docprop2.dll [Microsoft DocProp Inplace Calendar Control] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{6b33163c-76a5-4b6c-bf21-45de9cd503a1} [HKLM] -> %System32%\netplwiz.dll [Shell Publishing Wizard Object] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 875008 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} [HKLM] -> %System32%\ieframe.dll [IE Tracking Shell Menu] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{6CF48EF8-44CD-45d2-8832-A16EA016311B} [HKLM] -> %System32%\ieframe.dll [IE IShellFolderBand] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{7007ACC7-3202-11D1-AAD2-00805FC1270E} [HKLM] -> %System32%\netshell.dll [Network Connections] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 1708032 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{7376D660-C583-11d0-A3A5-00C04FD706EC} [HKLM] -> %System32%\browseui.dll [TridentImageExtractor] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{73B24247-042E-4EF5-ADC2-42F62E6FD654} [HKLM] -> %SystemDrive%\Programs\ICQLite\ICQLiteShell.dll [ICQ Lite Shell Extension] -> [Ver = 20, 52, 2573, 0 | Size = 57451 bytes | Modified Date = 07/05/2006 16:28:48 | Attr = ]
{73CFD649-CD48-4fd8-A272-2070EA56526B} [HKLM] -> %System32%\ieframe.dll [IE BandProxy] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{7444C717-39BF-11D1-8CD9-00C04FC29D45} [HKLM] -> %System32%\cryptext.dll [Crypto PKO Extension] -> Microsoft Corporation [Ver = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 53760 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{7444C719-39BF-11D1-8CD9-00C04FC29D45} [HKLM] -> %System32%\cryptext.dll [Crypto Sign Extension] -> Microsoft Corporation [Ver = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 53760 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{747E722C-CB46-4a9d-BDFE-192AAD5099B1} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [MozyHome Remote Backup Shell Extensions Icon Overlay 2] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{750fdf0e-2a26-11d1-a3ea-080036587f03} [HKLM] -> %System32%\cscui.dll [Offline Files Menu] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 326656 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{764BF0E1-F219-11ce-972D-00AA00A14F56} [HKLM] -> Reg Data - Key not found [Shell extensions for file compression] -> File not found
{77597368-7b15-11d0-a0c2-080036af3f03} [HKLM] -> %System32%\printui.dll [Web Printer Shell Extension] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 560640 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} [HKLM] -> %System32%\mstask.dll [Tasks Folder Shell Extension] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 274944 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{7988B573-EC89-11cf-9C00-00AA00A14F56} [HKLM] -> %System32%\dskquoui.dll [Disk Quota UI] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 144384 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{7A80E4A8-8005-11D2-BCF8-00C04F72C717} [HKLM] -> %System32%\mmcshext.dll [MMC Icon Handler] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 50688 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{7A9D77BD-5403-11d2-8785-2E0420524153} [HKLM] -> Reg Data - Key not found [User Accounts] -> File not found
{7BA4C742-9E81-11CF-99D3-00AA004AE837} [HKLM] -> %System32%\browseui.dll [Microsoft BrowserBand] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{7BD29E00-76C1-11CF-9DD0-00A0C9034933} [HKLM] -> %System32%\ieframe.dll [Temporary Internet Files] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{7BD29E01-76C1-11CF-9DD0-00A0C9034933} [HKLM] -> %System32%\ieframe.dll [Temporary Internet Files] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{7D559C10-9FE9-11d0-93F7-00AA0059CE02} [HKLM] -> %System32%\webcheck.dll [Code Download Agent] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{7e653215-fa25-46bd-a339-34a2790f3cb7} [HKLM] -> %System32%\browseui.dll [Accessible] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{7F1CF152-04F8-453A-B34C-E609530A9DC8} [HKLM] -> %CommonProgramFiles%\Ahead\Lib\NeroDigitalExt.dll [NeroDigitalPropSheetHandler] -> File not found
{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} [HKLM] -> %System32%\webcheck.dll [WebCheck SyncMgr Handler] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{83bbcbf3-b28a-4919-a5aa-73027445d672} [HKLM] -> %System32%\wiashext.dll [Scanners & Cameras] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 589312 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} [HKLM] -> Reg Data - Key not found [Encryption Context Menu] -> File not found
{85BBD920-42A0-1069-A2E4-08002B30309D} [HKLM] -> %System32%\syncui.dll [Briefcase] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 191488 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{871C5380-42A0-1069-A2EA-08002B30309D} [HKLM] -> %System32%\ieframe.dll [Internet Name Space] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} [HKLM] -> %System32%\shmedia.dll [Audio Media Properties Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 151552 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{87D62D94-71B3-4b9a-9489-5FE6850DC73E} [HKLM] -> %System32%\shmedia.dll [Avi Properties Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 151552 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{883373C3-BF89-11D1-BE35-080036B11A03} [HKLM] -> %System32%\docprop2.dll [Microsoft DocProp Shell Ext] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{88895560-9AA2-1069-930E-00AA0030EBC8} [HKLM] -> %System32%\hticons.dll [HyperTerminal Icon Ext] -> Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} [HKLM] -> %System32%\zipfldr.dll [Compressed (zipped) Folder SendTo Target] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 337920 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{88C6C381-2E85-11D0-94DE-444553540000} [HKLM] -> %System32%\occache.dll [ActiveX Cache Folder] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 102400 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{8A23E65E-31C2-11d0-891C-00A024AB2DBB} [HKLM] -> %System32%\dsquery.dll [Directory Query UI] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 239104 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{8DD448E6-C188-4aed-AF92-44956194EB1F} [HKLM] -> %System32%\wmpshell.dll [Windows Media Player Burn Audio CD Context Menu Handler] -> Microsoft Corporation [Ver = 11.0.5721.5145 (WMP_11.061018-2006) | Size = 99840 bytes | Modified Date = 18/10/2006 21:47:20 | Attr = ]
{8EE97210-FD1F-4B19-91DA-67914005F020} [HKLM] -> %System32%\docprop2.dll [Microsoft DocProp Inplace ML Edit Box Control] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{905667aa-acd6-11d2-8080-00805f6596d2} [HKLM] -> %System32%\wiashext.dll [Scanners & Cameras] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 589312 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{91EA3F8B-C99B-11d0-9815-00C04FD91972} [HKLM] -> %System32%\browseui.dll [Augmented Shell Folder] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{9461b922-3c5a-11d2-bf8b-00c04fb93661} [HKLM] -> %System32%\shdocvw.dll [Search Assistant OC] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} [HKLM] -> %System32%\ieframe.dll [IE MRU AutoComplete List] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{992CFFA0-F557-101A-88EC-00DD010CCC48} [HKLM] -> %System32%\netshell.dll [Network Connections] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 1708032 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} [HKLM] -> %System32%\ieframe.dll [IE RSS Feeder Folder] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} [HKLM] -> %System32%\ieframe.dll [IE Microsoft Shell Folder AutoComplete List] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{9DB7A13C-F208-4981-8353-73CC61AE2783} [HKLM] -> %System32%\twext.dll [Previous Versions] -> Microsoft Corporation [Ver = 6.00.3800.2180 (xpsp_sp2_rtm.040803-2158) | Size = 44032 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{9DBD2C50-62AD-11d0-B806-00C04FD706EC} [HKLM] -> %System32%\shimgvw.dll [Summary Info Thumbnail handler (DOCFILES)] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 438272 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} [HKLM] -> %System32%\dsquery.dll [Shell properties for a DS object] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 239104 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} [HKLM] -> %System32%\sendmail.dll [Sendmail service] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 55296 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} [HKLM] -> %System32%\sendmail.dll [Sendmail service] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 55296 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{A08C11D2-A228-11d0-825B-00AA005B4383} [HKLM] -> %System32%\browseui.dll [Address EditBox] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} [HKLM] -> %System32%\shdocvw.dll [IE4 Suite Splash Screen] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{A5110426-177D-4e08-AB3F-785F10B4439C} [HKLM] -> %ProgramFiles%\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll [Sony Ericsson File Manager] -> Sony Ericsson Mobile Communications AB [Ver = 1, 3, 11, 0 | Size = 397312 bytes | Modified Date = 14/03/2006 15:23:00 | Attr = R ]
{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} [HKLM] -> %System32%\shdocvw.dll [Microsoft Browser Architecture] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{A6FD9E45-6E44-43f9-8644-08598F5A74D9} [HKLM] -> %System32%\shmedia.dll [Midi Properties Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 151552 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{A70C977A-BF00-412C-90B7-034C51DA2439} [HKLM] -> %System32%\nvcpl.dll [NvCpl DesktopContext Class] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 7700480 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
{A9CF0EAE-901A-4739-A481-E35B73E47F6D} [HKLM] -> %System32%\docprop2.dll [Microsoft DocProp Inplace Edit Box Control] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 48128 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} [HKLM] -> %System32%\webcheck.dll [Subscription Mgr] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{acf35015-526e-4230-9596-becbe19f0ac9} [HKLM] -> %System32%\browseui.dll [Track Popup Bar] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{add36aa8-751a-4579-a266-d66f5202ccbb} [HKLM] -> %System32%\netplwiz.dll [Print Ordering via the Web] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 875008 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{AF4F6510-F982-11d0-8595-00AA004CD6D8} [HKLM] -> %System32%\browseui.dll [Registry Tree Options Utility] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} [HKLM] -> %System32%\cscui.dll [Offline Files Folder] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 326656 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{B31C5FAE-961F-415b-BAF0-E697A5178B94} [HKLM] -> %System32%\ieframe.dll [IE Microsoft Multiple AutoComplete List Container] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{B327765E-D724-4347-8B16-78AE18552FC3} [HKLM] -> %CommonProgramFiles%\Ahead\Lib\NeroDigitalExt.dll [NeroDigitalIconHandler] -> File not found
{b32a6748-f273-4546-b60a-3c5adc239de5} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [MozyHome Remote Backup Shell Extensions] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{B41DB860-8EE4-11D2-9906-E49FADC173CA} [HKLM] -> %ProgramFiles%\WinRAR\RarExt.dll [WinRAR shell extension] -> [Ver = | Size = 126464 bytes | Modified Date = 05/08/2006 10:34:34 | Attr = ]
{b6b69199-aca1-4cc4-a7e3-3dc9aec7b947} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [MozyHome Remote Backup Shell Extensions NSE] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} [HKLM] -> %SystemDrive%\Programs\iTunes\iTunesMiniPlayer.dll [iTunes] -> Apple Inc. [Ver = 7.5.0.20 | Size = 132392 bytes | Modified Date = 15/11/2007 13:11:04 | Attr = ]
{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} [HKLM] -> %System32%\ieframe.dll [Microsoft Browser Architecture] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{BD472F60-27FA-11cf-B8B4-444553540000} [HKLM] -> %System32%\zipfldr.dll [Compressed (zipped) Folder Right Drag Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 337920 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{BD84B380-8CA2-1069-AB1D-08000948F534} [HKLM] -> %System32%\fontext.dll [Fonts] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 382976 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} [HKLM] -> %CommonProgramFiles%\Microsoft Shared\Web Folders\MSONSEXT.DLL [Web Folders] -> Microsoft Corporation [Ver = 11.0.5510.0 | Size = 1292872 bytes | Modified Date = 11/07/2003 01:15:48 | Attr = ]
{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} [HKLM] -> %System32%\ieframe.dll [IE Shell Rebar BandSite] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{c5a40261-cd64-4ccf-84cb-c394da41d590} [HKLM] -> %System32%\shmedia.dll [Video Thumbnail Extractor] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 151552 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{CC6EEFFB-43F6-46c5-9619-51D571967F7D} [HKLM] -> %System32%\netplwiz.dll [Web Publishing Wizard] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 875008 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} [HKLM] -> %System32%\wmpshell.dll [Windows Media Player Play as Playlist Context Menu Handler] -> Microsoft Corporation [Ver = 11.0.5721.5145 (WMP_11.061018-2006) | Size = 99840 bytes | Modified Date = 18/10/2006 21:47:20 | Attr = ]
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} [HKLM] -> %System32%\ieframe.dll [Microsoft Url Search Hook] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{CFCCC7A0-A282-11D1-9082-006008059382} [HKLM] -> %System32%\appwiz.cpl [Darwin App Publisher] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 549888 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
{D20EA4E1-3957-11d2-A40B-0C5020524152} [HKLM] -> %System32%\shdocvw.dll [Fonts] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{D20EA4E1-3957-11d2-A40B-0C5020524153} [HKLM] -> %System32%\shdocvw.dll [Administrative Tools] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{D6277990-4C6A-11CF-8D87-00AA0060F5BF} [HKLM] -> %System32%\mstask.dll [Scheduled Tasks] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 274944 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{D66DC78C-4F61-447F-942B-3FB6980118CF} [HKLM] -> %SystemDrive%\Programs\Microsoft Office\Visio11\VISSHE.DLL [{D66DC78C-4F61-447F-942B-3FB6980118CF}] -> [Ver = | Size = 785464 bytes | Modified Date = 16/08/2003 05:29:34 | Attr = ]
{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} [HKLM] -> %System32%\WpdShext.dll [Portable Devices Menu] -> Microsoft Corporation [Ver = 5.2.5721.5145 (WMP_11.061018-2006) | Size = 2603008 bytes | Modified Date = 18/10/2006 21:47:22 | Attr = ]
{D8BD2030-6FC9-11D0-864F-00AA006809D9} [HKLM] -> %System32%\webcheck.dll [PostAgent] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{DBCE2480-C732-101B-BE72-BA78E9AD5B27} [HKLM] -> %System32%\icmui.dll [ICC Profile] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 54784 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{DCED20BE-3645-11D4-BC95-00C04F0E0588} [HKLM] -> Reg Data - Value does not exist [InoShell] -> File not found
{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} [HKLM] -> %System32%\mstask.dll [Tasks Folder Icon Handler] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 274944 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{DD313E04-FEFF-11d1-8ECD-0000F87A470C} [HKLM] -> %System32%\browseui.dll [User Assist] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{E0E11A09-5CB8-4B6C-8332-E00720A168F2} [HKLM] -> %System32%\browseui.dll [Address Bar Parser] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{E211B736-43FD-11D1-9EFB-0000F8757FCD} [HKLM] -> %System32%\wiashext.dll [Scanners & Cameras] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 589312 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} [HKLM] -> %System32%\dfshim.dll [Shell Icon Handler for Application References] -> Microsoft Corporation [Ver = 2.0.50727.42 (RTM.050727-4200) | Size = 83456 bytes | Modified Date = 23/09/2005 06:28:38 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} [HKLM] -> %System32%\webcheck.dll [WebCheckChannelAgent] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{E4B29F9D-D390-480b-92FD-7DDB47101D71} [HKLM] -> %System32%\shmedia.dll [Wav Properties Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 151552 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} [HKLM] -> %System32%\webcheck.dll [ConnectionAgent] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{E6EE9AAC-F76B-4947-8260-A9F136138E11} [HKLM] -> %System32%\ieframe.dll [IE Shell Band Site Menu] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} [HKLM] -> %System32%\webcheck.dll [WebCheck] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} [HKLM] -> %System32%\ieframe.dll [Shell DocObject Viewer] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{e82a2d71-5b2f-43a0-97b8-81be15854de8} [HKLM] -> %System32%\dfshim.dll [ShellLink for Application References] -> Microsoft Corporation [Ver = 2.0.50727.42 (RTM.050727-4200) | Size = 83456 bytes | Modified Date = 23/09/2005 06:28:38 | Attr = ]
{e84fda7c-1d6a-45f6-b725-cb260c236066} [HKLM] -> %System32%\shimgvw.dll [Shell Image Verbs] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 438272 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} [HKLM] -> %System32%\zipfldr.dll [Compressed (zipped) Folder] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 337920 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} [HKLM] -> %System32%\webcheck.dll [TrayAgent] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{EAB841A0-9550-11cf-8C16-00805F1408F3} [HKLM] -> %System32%\shimgvw.dll [HTML Thumbnail Extractor] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 438272 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} [HKLM] -> %System32%\shimgvw.dll [Shell Image Property Handler] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 438272 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} [HKLM] -> %System32%\dfsshlex.dll [DfsShell] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 28672 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{ECD4FC4C-521C-11D0-B792-00A0C90312E1} [HKLM] -> %System32%\browseui.dll [Shell DeskBar] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{ECD4FC4D-521C-11D0-B792-00A0C90312E1} [HKLM] -> %System32%\browseui.dll [Shell Rebar BandSite] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{ECD4FC4E-521C-11D0-B792-00A0C90312E1} [HKLM] -> %System32%\browseui.dll [Shell Band Site Menu] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{ECF03A32-103D-11d2-854D-006008059367} [HKLM] -> %System32%\mydocs.dll [MyDocs Drop Target] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 90624 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{ECF03A33-103D-11d2-854D-006008059367} [HKLM] -> %System32%\mydocs.dll [MyDocs Copy Hook] -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 90624 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [MozyHome Remote Backup Shell Extensions Icon Overlay 3] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} [HKLM] -> %System32%\browseui.dll [Global Folder Settings] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{EFA24E61-B078-11d0-89E4-00C04FC9E26E} [HKLM] -> %System32%\shdocvw.dll [Favorites Band] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{EFA24E64-B078-11d0-89E4-00C04FC9E26E} [HKLM] -> %System32%\shdocvw.dll [Explorer Band] -> Microsoft Corporation [Ver = 6.00.2900.2987 (xpsp.060901-0211) | Size = 1497088 bytes | Modified Date = 04/09/2006 06:12:56 | Attr = ]
{F0152790-D56E-4445-850E-4F3117DB740C} [HKLM] -> %System32%\remotepg.dll [Remote Sessions CPL Extension] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 60416 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{F020E586-5264-11d1-A532-0000F8757D7E} [HKLM] -> %System32%\dsquery.dll [Directory Start/Search Find] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 239104 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} [HKLM] -> %SystemDrive%\Programs\Real\RealPlayer\rpshell.dll [Shell Extensions for RealOne Player] -> RealNetworks, Inc. [Ver = 1.0.1.2237 | Size = 49198 bytes | Modified Date = 16/06/2006 19:42:52 | Attr = ]
{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} [HKLM] -> %System32%\wmpshell.dll [Windows Media Player Add to Playlist Context Menu Handler] -> Microsoft Corporation [Ver = 11.0.5721.5145 (WMP_11.061018-2006) | Size = 99840 bytes | Modified Date = 18/10/2006 21:47:20 | Attr = ]
{F2CF5485-4E02-4f68-819C-B92DE9277049} [HKLM] -> %System32%\ieframe.dll [&Links] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{F37C5810-4D3F-11d0-B4BF-00AA00BBB723} [HKLM] -> %System32%\rshx32.dll [Printers Security Page] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 39936 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{F5175861-2688-11d0-9C5E-00AA00A45957} [HKLM] -> %System32%\webcheck.dll [Subscription Folder] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 232960 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
{F5D92341-0A64-11D0-9956-0000E8096023} [HKLM] -> %System32%\ShellExt\CDWshext.dll [CD Copy Shell Extension] -> Pinnacle Systems, Inc. [Ver = 6.0.0.0 | Size = 100352 bytes | Modified Date = 24/02/2003 10:48:50 | Attr = ]
{F5D92342-0A64-11D0-9956-0000E8096023} [HKLM] -> %System32%\ShellExt\CDWshext.dll [CD Wizard Shell Extension] -> Pinnacle Systems, Inc. [Ver = 6.0.0.0 | Size = 100352 bytes | Modified Date = 24/02/2003 10:48:50 | Attr = ]
{F61FFEC1-754F-11d0-80CA-00AA005B4383} [HKLM] -> %System32%\browseui.dll [BandProxy] -> Microsoft Corporation [Ver = 6.00.2900.2995 (xpsp.060913-0019) | Size = 1022976 bytes | Modified Date = 23/09/2006 12:12:50 | Attr = ]
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} [HKLM] -> %System32%\ntshrui.dll [Shell extensions for sharing] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 143872 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} [HKLM] -> %System32%\ieframe.dll [IE Registry Tree Options Utility] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{f92e8c40-3d33-11d2-b1aa-080036a75b03} [HKLM] -> %System32%\deskperf.dll [Display TroubleShoot CPL Extension] -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 18432 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} [HKLM] -> %System32%\ieframe.dll [IE User Assist] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} [HKLM] -> %System32%\wiashext.dll [Scanners & Cameras] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 589312 bytes | Modified Date = 04/08/2004 07:56:46 | Attr = ]
{FBF23B40-E3F0-101B-8488-00AA003E56F8} [HKLM] -> %System32%\ieframe.dll [InternetShortcut] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} [HKLM] -> %ProgramFiles%\MSN Messenger\fsshext.8.1.0178.00.dll [Messenger Sharing Folders] -> Microsoft Corporation [Ver = 8.1.0178.00 | Size = 321392 bytes | Modified Date = 19/01/2007 12:54:52 | Attr = ]
{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} [HKLM] -> %System32%\ieframe.dll [IE Custom MRU AutoCompleted List] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{FF393560-C2A7-11CF-BFF4-444553540000} [HKLM] -> %System32%\ieframe.dll [History] -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
{FFB699E0-306A-11d3-8BD1-00104B6F7516} [HKLM] -> %System32%\nvcpl.dll [Play on my TV helper] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 7700480 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
< BotCheck > -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\DefaultLaunchPermission -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\EnableDCOM -> Y -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\MachineLaunchRestriction -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\\MachineAccessRestriction -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{A50398B8-9075-4FBF-A7A1-456BF21937AD} -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{AD65A69D-3831-40D7-9629-9B0B50A93843} -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{0040D221-54A1-11D1-9DE0-006097042D69} -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList\\{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3} -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST\\System.EnterpriseServices.Thunk.dll -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusDisableNotify -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallDisableNotify -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\UpdatesDisableNotify -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusOverride -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallOverride -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate not found. -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile not found. -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages -> msv1_0; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Bounds -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Security Packages -> kerberos;msv1_0;schannel;wdigest; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\LsaPid -> 692 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\SecureBoot -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\auditbaseobjects -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\crashonauditfail -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\disabledomaincreds -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\everyoneincludesanonymous -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\fipsalgorithmpolicy -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\forceguest -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\fullprivilegeauditing -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\limitblankpassworduse -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\lmcompatibilitylevel -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\nodefaultadminowner -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\nolmhash -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\restrictanonymous -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\restrictanonymoussam -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Notification Packages -> scecli; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\ImpersonatePrivilegeUpgradeToolHasRun -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\\ProviderOrder -> Windows NT Access Provider; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider\\ProviderPath -> %SystemRoot%\system32\ntmarta.dll -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Data\\Pattern -> åYoÛ8}]f4÷(\2ede09fc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\GBG\\GrafBlumGroup -> Ùañ";'ØÈ -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\JD\\Lookup -> î¹Uzx -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\SidCache\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0\\ntlmminclientsec -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\msv1_0\\ntlmminserversec -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Skew1\\SkewMatrix -> £~>ç¢tBlò¤ú -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SSO\Passport1.4\\SSOURL -> http://www.passport.com -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\\Time -> f¯ÐÆ -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Name -> Digest -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Comment -> Digest SSPI Authentication Package -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Capabilities -> 16464 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\RpcId -> 65535 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Version -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\TokenSize -> 65535 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Time -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\digest.dll\\Type -> 49 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Name -> DPA -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Comment -> DPA Security Package -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Capabilities -> 55 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\RpcId -> 17 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Version -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\TokenSize -> 768 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Time -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll\\Type -> 49 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Name -> MSN -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Comment -> MSN Security Package -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Capabilities -> 55 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\RpcId -> 18 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Version -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\TokenSize -> 768 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Time -> oãøyÄ -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll\\Type -> 49 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Type -> 32 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Start -> 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ErrorControl -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ImagePath -> %SystemRoot%\System32\svchost.exe -k netsvcs -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DisplayName -> Windows Firewall/Internet Connection Sharing (ICS) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnService -> Netman;WinMgmt; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnGroup -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ObjectName -> LocalSystem -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Description -> Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\\Epoch -> 11586 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\\ServiceDll -> %SystemRoot%\System32\ipnathlp.dll -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msncall.exe -> C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\livecall.exe -> C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe -> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\EnableFirewall -> 1 ->


----------



## carrie_uk (Jul 7, 2004)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\IncrediMail\bin\IncMail.exe -> C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\IncrediMail\bin\IMApp.exe -> C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\LimeWire\LimeWire.exe -> C:\Programs\LimeWire\LimeWire.exe:*:Enabled:LimeWire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\ypager.exe -> C:\Program Files\Yahoo!\Messenger\ypager.exe:*:Enabled:Yahoo! Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\LimeWire Pro\LimeWire.exe -> C:\Programs\LimeWire Pro\LimeWire.exe:*:Enabled:LimeWire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\StubInstaller.exe -> C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\ICQLite\ICQLite.exe -> C:\Programs\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\AIM\aim.exe -> C:\Programs\AIM\aim.exe:*:Enabled:AOL Instant Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\dpvsetup.exe -> C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\rundll32.exe -> C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\PocketSoft\RTPatch\AutoRTP\artpschd.exe -> C:\Program Files\Common Files\PocketSoft\RTPatch\AutoRTP\artpschd.exe:*:Enabled:artpschd -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Messenger\msmsgs.exe -> C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe -> C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\YServer.exe -> C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\StubInstaller.exe -> D:\StubInstaller.exe:*isabled:LimeWire swarmed installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Dan\LimeWire\LimeWire.exe -> D:\Dan\LimeWire\LimeWire.exe:*:Enabled:LimeWire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Magentic\bin\MgImp.exe -> C:\Program Files\Magentic\bin\MgImp.exe:*:Enabled:Magentic -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Magentic\bin\Magentic.exe -> C:\Program Files\Magentic\bin\Magentic.exe:*:Enabled:Magentic -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Magentic\bin\MgApp.exe -> C:\Program Files\Magentic\bin\MgApp.exe:*:Enabled:Magentic -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\IncrediMail\bin\ImpCnt.exe -> C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msncall.exe -> C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike source\hl2.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike source\hl2.exe:*:Enabled:hl2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\source dedicated server\srcds.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\source dedicated server\srcds.exe:*:Enabled:srcds -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\rtcshare.exe -> C:\WINDOWS\system32\rtcshare.exe:*:Enabled:RTC App Sharing -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\NetMeeting\conf.exe -> C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\pezza91\counter-strike source\hl2.exe -> C:\Programs\Valve\Steam\SteamApps\pezza91\counter-strike source\hl2.exe:*:Enabled:hl2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Xfire\Xfire.exe -> C:\Programs\Xfire\Xfire.exe:*:Enabled:Xfire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\livecall.exe -> C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe -> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\World of Warcraft\BackgroundDownloader.exe -> D:\Games\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\SecondLife\SecondLife.exe -> C:\Programs\SecondLife\SecondLife.exe:*:Enabled:Second Life -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\F:\Carrie\Anthony Robbins\UPW\incredimail_install.exe -> F:\Carrie\Anthony Robbins\UPW\incredimail_install.exe:*:Enabled:IncrediMail Installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\Carrie\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe -> C:\Documents and Settings\Carrie\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe:*:Enabled:IncrediMail Installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\Daniel\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe -> C:\Documents and Settings\Daniel\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe:*:Enabled:IncrediMail Installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike\hl.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero\hl.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero\hl.exe:*:Enabled:Half-Life Launcher -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\day of defeat source\hl2.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\day of defeat source\hl2.exe:*:Enabled:hl2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero deleted scenes\hl.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\EA Games\BF2.exe -> D:\Games\EA Games\BF2.exe:*:Enabled:Battlefield 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe -> C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\Steam.exe -> D:\Games\Steam.exe:*:Enabled:Steam -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\Diablo\Diablo.exe -> D:\Games\Diablo\Diablo.exe:*:Enablediablo -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\F:\Dan\private server\DB\bin\mysqld-nt.exe -> F:\Dan\private server\DB\bin\mysqld-nt.exe:*:Enabled:mysqld-nt -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\F:\Dan\private server\mangosd.exe -> F:\Dan\private server\mangosd.exe:*isabled:mangosd -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\AOL\Loader\aolload.exe -> C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Google\Google Talk\googletalk.exe -> C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\iTunes\iTunes.exe -> C:\Programs\iTunes\iTunes.exe:*:Enabled:iTunes -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Wizet\MapleStory\Patcher.exe -> C:\Programs\Wizet\MapleStory\Patcher.exe:*:Enabledatcher MFC ?? ???? -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Skype\Phone\Skype.exe -> C:\Programs\Skype\Phone\Skype.exe:*:Enabled:Skype -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1900:UDP -> 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2869:TCP -> 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\3724:TCP -> 3724:TCP:*:Enabled:Blizzard Downloader: 3724 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security\\Security -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\\ServiceUpgrade -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\{AF349E0B-DBC0-4230-AEAD-C2140BFE97D7} -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\{D6E7FCEB-3A95-4C0C-A5EF-BA5488E3257B} -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\{3FA99160-939B-4C8F-89DE-AC17E396FD25} -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\0 -> Root\LEGACY_SHAREDACCESS\0000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\Count -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\NextInstance -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Type -> 32 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Start -> 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ErrorControl -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ImagePath -> %systemroot%\system32\svchost.exe -k netsvcs -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\DisplayName -> Automatic Updates -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ObjectName -> LocalSystem -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Description -> Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site. -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\\ServiceDll -> C:\WINDOWS\system32\wuauserv.dll -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\\Security -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\0 -> Root\LEGACY_WUAUSERV\0000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\Count -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\NextInstance -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry not found. -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr not found. -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings\\ProxyEnable -> 0 -> 
< ColumnHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ -> 
{0D2E74C4-3C34-11d2-A27E-00C04FC30871} [HKLM] -> %System32%\shell32.dll [Reg Data - Value does not exist] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{16148659-720A-457d-850B-2DBD87BB129D} [HKLM] -> %SystemDrive%\Programs\Audible\Bin\AudibleExt.dll [AudibleShlExt Class] -> Audible, Inc. [Ver = 1, 0, 0, 5 | Size = 263768 bytes | Modified Date = 03/11/2007 08:55:40 | Attr = ]
{24F14F01-7B1C-11d1-838f-0000F80461CF} [HKLM] -> %System32%\shell32.dll [Reg Data - Value does not exist] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{24F14F02-7B1C-11d1-838f-0000F80461CF} [HKLM] -> %System32%\shell32.dll [Reg Data - Value does not exist] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{66742402-F9B9-11D1-A202-0000F81FEDEE} [HKLM] -> %System32%\shell32.dll [Reg Data - Value does not exist] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

{7D4D6379-F301-4311-BEBA-E26EB0561882} [HKLM] -> %CommonProgramFiles%\Ahead\Lib\NeroDigitalExt.dll [NeroDigitalColumnHandler Class] -> File not found
{F9DB5320-233E-11D1-9F84-707F02C10627} [HKLM] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\pdfshell.dll [PDF Shell Extension] -> Adobe Systems, Inc. [Ver = 8.1.0.0 | Size = 372736 bytes | Modified Date = 10/05/2007 21:54:08 | Attr = ]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\ -> 
{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} [HKLM] -> %System32%\shell32.dll [Start Menu Pin] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{FFFFE5C1-34AF-4d4d-B3D3-5BB86A2BAA7B} [HKLM] -> %ProgramFiles%\Virgin Broadband\PCguard\AVCntxtR.dll [AVMenu Class] -> Radialpoint Inc. [Ver = 6.0.1.22212 | Size = 106736 bytes | Modified Date = 05/09/2007 13:09:10 | Attr = ]
{1F77B17B-F531-44DB-ACA4-76ABB5010A28} [HKLM] -> %SystemDrive%\Programs\AIMP2\System\aimp_shell.dll [AIMPClassic] -> AIMP DevTeam [Ver = 3.0.0.0 | Size = 60928 bytes | Modified Date = 23/07/2007 11:07:12 | Attr = ]
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> %ProgramFiles%\ewido anti-spyware 4.0\context.dll [ewido anti-spyware] -> Anti-Malware Development a.s. [Ver = 4, 0, 0, 172 | Size = 94208 bytes | Modified Date = 16/06/2006 14:38:38 | Attr = ]
{73B24247-042E-4EF5-ADC2-42F62E6FD654} [HKLM] -> %SystemDrive%\Programs\ICQLite\ICQLiteShell.dll [ICQLiteMenu] -> [Ver = 20, 52, 2573, 0 | Size = 57451 bytes | Modified Date = 07/05/2006 16:28:48 | Attr = ]
{DCED20BE-3645-11D4-BC95-00C04F0E0588} [HKLM] -> Reg Data - Value does not exist [InoShell] -> File not found
{750fdf0e-2a26-11d1-a3ea-080036587f03} [HKLM] -> %System32%\cscui.dll [Offline Files] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 326656 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{09799AFB-AD67-11d1-ABCD-00C04FC30936} [HKLM] -> %System32%\shell32.dll [Open With] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{A470F8CF-A1E8-4f65-8335-227475AA5C46} [HKLM] -> %System32%\shell32.dll [Open With EncryptionMenu] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{B41DB860-8EE4-11D2-9906-E49FADC173CA} [HKLM] -> %ProgramFiles%\WinRAR\RarExt.dll [WinRAR] -> [Ver = | Size = 126464 bytes | Modified Date = 05/08/2006 10:34:34 | Attr = ]
{5464D816-CF16-4784-B9F3-75C0DB52B499} [HKLM] -> %ProgramFiles%\Yahoo!\Common\ymmapi2005010104.dll [Yahoo! Mail] -> Yahoo! Inc. [Ver = 2005, 1, 1, 4 | Size = 190496 bytes | Modified Date = 30/10/2006 14:50:00 | Attr = ]
< ContextMenuHandlers - AllFilesystemObjects [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ -> 
{B32A6748-F273-4546-B60A-3C5ADC239DE5} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [Mozy] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{7BA4C740-9E81-11CF-99D3-00AA004AE837} [HKLM] -> %System32%\shell32.dll [Send To] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shell\ -> 
%SystemRoot%\Explorer.exe -> %SystemRoot%\explorer.exe [find] -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
"C:\Programs\Winamp\winamp.exe" /BOOKMARK "%1" -> %SystemDrive%\Programs\Winamp\winamp.exe [Winamp.Bookmark] -> Nullsoft [Ver = 5,3,5,1305 | Size = 1137664 bytes | Modified Date = 14/05/2007 22:23:58 | Attr = ]
"C:\Programs\Winamp\winamp.exe" /ADD "%1" -> %SystemDrive%\Programs\Winamp\winamp.exe [Winamp.Enqueue] -> Nullsoft [Ver = 5,3,5,1305 | Size = 1137664 bytes | Modified Date = 14/05/2007 22:23:58 | Attr = ]
"C:\Programs\Winamp\winamp.exe" "%1" -> %SystemDrive%\Programs\Winamp\winamp.exe [Winamp.Play] -> Nullsoft [Ver = 5,3,5,1305 | Size = 1137664 bytes | Modified Date = 14/05/2007 22:23:58 | Attr = ]
< ContextMenuHandlers - Directory [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\ -> 
{FFFFE5C1-34AF-4d4d-B3D3-5BB86A2BAA7B} [HKLM] -> %ProgramFiles%\Virgin Broadband\PCguard\AVCntxtR.dll [AVMenu Class] -> Radialpoint Inc. [Ver = 6.0.1.22212 | Size = 106736 bytes | Modified Date = 05/09/2007 13:09:10 | Attr = ]
{1F77B17B-F531-44DB-ACA4-76ABB5010A28} [HKLM] -> %SystemDrive%\Programs\AIMP2\System\aimp_shell.dll [AIMPClassic] -> AIMP DevTeam [Ver = 3.0.0.0 | Size = 60928 bytes | Modified Date = 23/07/2007 11:07:12 | Attr = ]
{A470F8CF-A1E8-4f65-8335-227475AA5C46} [HKLM] -> %System32%\shell32.dll [EncryptionMenu] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{8934FCEF-F5B8-468f-951F-78A921CD3920} [HKLM] -> %ProgramFiles%\ewido anti-spyware 4.0\context.dll [ewido anti-spyware] -> Anti-Malware Development a.s. [Ver = 4, 0, 0, 172 | Size = 94208 bytes | Modified Date = 16/06/2006 14:38:38 | Attr = ]
{73B24247-042E-4EF5-ADC2-42F62E6FD654} [HKLM] -> %SystemDrive%\Programs\ICQLite\ICQLiteShell.dll [ICQLiteMenu] -> [Ver = 20, 52, 2573, 0 | Size = 57451 bytes | Modified Date = 07/05/2006 16:28:48 | Attr = ]
{DCED20BE-3645-11D4-BC95-00C04F0E0588} [HKLM] -> Reg Data - Value does not exist [InoShell] -> File not found
{B32A6748-F273-4546-B60A-3C5ADC239DE5} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [Mozy] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{750fdf0e-2a26-11d1-a3ea-080036587f03} [HKLM] -> %System32%\cscui.dll [Offline Files] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 326656 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} [HKLM] -> %System32%\ntshrui.dll [Sharing] -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 143872 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
{B41DB860-8EE4-11D2-9906-E49FADC173CA} [HKLM] -> %ProgramFiles%\WinRAR\RarExt.dll [WinRAR] -> [Ver = | Size = 126464 bytes | Modified Date = 05/08/2006 10:34:34 | Attr = ]
< ContextMenuHandlers - Directory\Background [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Directory\Background\shellex\ContextMenuHandlers\ -> 
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} [HKLM] -> %System32%\nvshell.dll [00nView] -> [Ver = | Size = 466944 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
{B32A6748-F273-4546-B60A-3C5ADC239DE5} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [Mozy] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{D969A300-E7FF-11d0-A93B-00A0C90F2719} [HKLM] -> %System32%\shell32.dll [New] -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
{A70C977A-BF00-412C-90B7-034C51DA2439} [HKLM] -> %System32%\nvcpl.dll [NvCplDesktopContext] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 7700480 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shell\ -> 
"C:\Programs\Jasc Software Inc\Paint Shop Pro 7\psp.exe" "/Browse" "%L" -> %SystemDrive%\Programs\Jasc Software Inc\Paint Shop Pro 7\psp.exe [Browse With Paint Shop Pro 7] -> Jasc Software, Inc. [Ver = 7.04 Release | Size = 9293824 bytes | Modified Date = 13/07/2001 06:04:00 | Attr = ]
%SystemRoot%\Explorer.exe /e,/idlist,%I,%L -> %SystemRoot%\explorer.exe [explore] -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
%SystemRoot%\Explorer.exe /idlist,%I,%L -> %SystemRoot%\explorer.exe [open] -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\ -> 
{FFFFE5C1-34AF-4d4d-B3D3-5BB86A2BAA7B} [HKLM] -> %ProgramFiles%\Virgin Broadband\PCguard\AVCntxtR.dll [AVMenu Class] -> Radialpoint Inc. [Ver = 6.0.1.22212 | Size = 106736 bytes | Modified Date = 05/09/2007 13:09:10 | Attr = ]
{B32A6748-F273-4546-B60A-3C5ADC239DE5} [HKLM] -> %SystemDrive%\Programs\Mozy\mozyshell.dll [Mozy] -> [Ver = | Size = 2274616 bytes | Modified Date = 30/08/2007 16:17:00 | Attr = ]
{B41DB860-8EE4-11D2-9906-E49FADC173CA} [HKLM] -> %ProgramFiles%\WinRAR\RarExt.dll [WinRAR] -> [Ver = | Size = 126464 bytes | Modified Date = 05/08/2006 10:34:34 | Attr = ]
< ControlSets > -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\Select\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\Select\\Current -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\Select\\Default -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\Select\\Failed -> 0 -> 
HKEY_LOCAL_MACHINE\SYSTEM\Select\\LastKnownGood -> 3 -> 
< Desktop Components > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\ -> 
0 -> [Key] -> 
0 -> FriendlyName = My Current Home Page -> 
0 -> Source = About:Home -> 
0 -> SubscribedURL = About:Home -> 
< Disabled MSConfig Folder Items[HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\ -> 
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk -> %CommonProgramFiles%\Adobe\Calibration\Adobe Gamma Loader.exe -> Adobe Systems, Inc. [Ver = 1, 0, 0, 1 | Size = 113664 bytes | Modified Date = 04/11/1999 14:06:48 | Attr = ]
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk -> %SystemDrive%\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE -> File not found
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Audible Download Manager.lnk -> %ProgramFiles%\Audible\Bin\AudibleDownloadHelper.exe -> File not found
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk -> %ProgramFiles%\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe -> TOSHIBA CORPORATION. [Ver = 3.03.4z24.US | Size = 479232 bytes | Modified Date = 24/12/2004 16:22:30 | Attr = ]
C:^Documents and Settings^Carrie^Start Menu^Programs^Startup^Registration-InstantCopy.lnk -> %ProgramFiles%\Pinnacle\Shared Files\InstantCDDVD\Pixie\RegTool.exe -> Pinnacle Systems, Inc. [Ver = Version 2.5.0.2 | Size = 245760 bytes | Modified Date = 26/09/2002 13:18:00 | Attr = ]
C:^Documents and Settings^Carrie^Start Menu^Programs^Startup^WkCalRem.LNK -> %CommonProgramFiles%\Microsoft Shared\Works Shared\WkCalRem.exe -> Microsoft® Corporation [Ver = 7.02.0620.0 | Size = 24651 bytes | Modified Date = 20/06/2002 11:21:32 | Attr = ]
< Disabled MSConfig Registry Items [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ -> 
Adobe Photo Downloader -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.2.0.77764 | Size = 63712 bytes | Modified Date = 09/03/2007 10:09:58 | Attr = ]
Adobe Reader Speed Launcher -> %ProgramFiles%\Adobe\Reader 8.0\Reader\Reader_sl.exe -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 39792 bytes | Modified Date = 10/10/2007 18:51:56 | Attr = ]
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} -> %CommonProgramFiles%\Ahead\Lib\NMBgMonitor.exe -> File not found
iTunesHelper -> %SystemDrive%\Programs\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.5.0.20 | Size = 267048 bytes | Modified Date = 15/11/2007 13:11:04 | Attr = ]
LogitechSoftwareUpdate -> %ProgramFiles%\Logitech\Video\ManifestEngine.exe -> Logitech Inc. [Ver = 8.4.7.1034 | Size = 196608 bytes | Modified Date = 08/06/2005 13:44:14 | Attr = ]
LogitechVideoRepair -> %ProgramFiles%\Logitech\Video\ISStart.exe -> Logitech Inc. [Ver = 8.4.7.1034 | Size = 458752 bytes | Modified Date = 08/06/2005 14:24:32 | Attr = ]
LogitechVideoTray -> %ProgramFiles%\Logitech\Video\LogiTray.exe -> Logitech Inc. [Ver = 8.4.7.1034 | Size = 217088 bytes | Modified Date = 08/06/2005 14:14:44 | Attr = ]
Magentic -> %ProgramFiles%\Magentic\bin\Magentic.exe -> [Ver = 1, 0, 0, 0296 | Size = 311340 bytes | Modified Date = 18/06/2006 08:56:38 | Attr = ]
mmtask -> %ProgramFiles%\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe -> TODO: <Company name> [Ver = 1.0.0.1 | Size = 53248 bytes | Modified Date = 30/03/2004 21:12:56 | Attr = ]
NUDGEMANIA -> %ProgramFiles%\NudgeMania\NudgeMania.exe -> File not found
nwiz -> %System32%\nwiz.exe -> [Ver = | Size = 1622016 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
QuickTime Task -> %SystemDrive%\Programs\QuickTime\QTTask.exe -> Apple Inc. [Ver = 7.3 | Size = 286720 bytes | Modified Date = 14/11/2007 23:43:10 | Attr = ]
Share-to-Web Namespace Daemon -> %SystemDrive%\Programs\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe -> Hewlett-Packard [Ver = 2,3,0,0\*161 | Size = 69632 bytes | Modified Date = 11/04/2002 03:19:34 | Attr = ]
Sony Ericsson PC Suite -> %ProgramFiles%\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe -> Sony Ericsson Mobile Communications AB [Ver = 1.1.1.3 | Size = 159744 bytes | Modified Date = 26/10/2005 16:17:24 | Attr = R ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.5.0_10\bin\jusched.exe -> File not found
SweetIM -> %ProgramFiles%\Macrogaming\SweetIM\SweetIM.exe -> File not found
swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 26/04/2007 17:00:56 | Attr = ]
USBToolTip -> %ProgramFiles%\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe -> Pinnacle Systems [Ver = 1, 0, 0, 9 | Size = 192512 bytes | Modified Date = 23/04/2004 10:00:36 | Attr = ]
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ -> 
.bat [@ = batfile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.chm [@ = chm.file] -> PersistentHandler = Reg Data - Key not found -> 
.cmd [@ = cmdfile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.com [@ = comfile] -> PersistentHandler = {098f2470-bae0-11cd-b579-08002b30bfeb} -> 
.cpl [@ = cplfile] -> PersistentHandler = {098f2470-bae0-11cd-b579-08002b30bfeb} -> 
.exe [@ = exefile] -> PersistentHandler = {098f2470-bae0-11cd-b579-08002b30bfeb} -> 
.hlp [@ = hlpfile] -> PersistentHandler = Reg Data - Key not found -> 
.hta [@ = htafile] -> PersistentHandler = {eec97550-47a9-11cf-b952-00aa0051fe20} -> 
.html [@ = htmlfile] -> PersistentHandler = {eec97550-47a9-11cf-b952-00aa0051fe20} -> 
.inf [@ = inffile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.ini [@ = inifile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.url [@ = InternetShortcut] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.js [@ = JSFile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.jse [@ = JSEFile] -> PersistentHandler = Reg Data - Key not found -> 
.pif [@ = piffile] -> PersistentHandler = Reg Data - Key not found -> 
.reg [@ = regfile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.scr [@ = scrfile] -> PersistentHandler = Reg Data - Key not found -> 
.txt [@ = txtfile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.vbe [@ = VBEFile] -> PersistentHandler = Reg Data - Key not found -> 
.vbs [@ = VBSFile] -> PersistentHandler = {5e941d80-bf96-11cd-b579-08002b30bfeb} -> 
.wsf [@ = WSFFile] -> PersistentHandler = Reg Data - Key not found -> 
.wsh [@ = WSHFile] -> PersistentHandler = Reg Data - Key not found -> 
< Internet Explorer CmdMapping [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping -> 
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -> 8192 - Sun Java Console -> 
{92780B25-18CC-41C8-B9BE-3C9C571A8263} -> 8193 - Reg Data - Key not found -> 
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -> 8194 - Reg Data - Key not found -> 
{B863453A-26C3-4e1f-A54D-A2CD196348E9} -> 8195 - Reg Data - Key not found -> 
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -> 8196 - Reg Data - Key not found -> 
{d9288080-1baa-4bc4-9cf8-a92d743db949} -> 8198 - Reg Data - Key not found -> 
{FB5F1910-F110-11d2-BB9E-00C04F795683} -> 8197 - Reg Data - Key not found -> 
NextId -> 8199 ->


----------



## carrie_uk (Jul 7, 2004)

< Security Settings > -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusDisableNotify -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallDisableNotify -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\UpdatesDisableNotify -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\AntiVirusOverride -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\FirewallOverride -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\Type -> 32 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\Start -> 3 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\ErrorControl -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\ImagePath -> %SystemRoot%\System32\svchost.exe -k netsvcs -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\DisplayName -> Background Intelligent Transfer Service -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\DependOnService -> Rpcss; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\DependOnGroup -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\ObjectName -> LocalSystem -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\Description -> Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled. -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\\FailureActions -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Parameters\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Parameters\\ServiceDll -> C:\WINDOWS\System32\qmgr.dll -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Security\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Security\\Security -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\\0 -> Root\LEGACY_BITS\0000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\\Count -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS\Enum\\NextInstance -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Type -> 32 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Start -> 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ErrorControl -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ImagePath -> %SystemRoot%\System32\svchost.exe -k netsvcs -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DisplayName -> Windows Firewall/Internet Connection Sharing (ICS) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnService -> Netman;WinMgmt; -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\DependOnGroup -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\ObjectName -> LocalSystem -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\\Description -> Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\\Epoch -> 11586 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\\ServiceDll -> %SystemRoot%\System32\ipnathlp.dll -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msncall.exe -> C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\livecall.exe -> C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe -> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\EnableFirewall -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\system32\sessmgr.exe -> %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\IncrediMail\bin\IncMail.exe -> C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\IncrediMail\bin\IMApp.exe -> C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\LimeWire\LimeWire.exe -> C:\Programs\LimeWire\LimeWire.exe:*:Enabled:LimeWire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\ypager.exe -> C:\Program Files\Yahoo!\Messenger\ypager.exe:*:Enabled:Yahoo! Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\LimeWire Pro\LimeWire.exe -> C:\Programs\LimeWire Pro\LimeWire.exe:*:Enabled:LimeWire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\StubInstaller.exe -> C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\ICQLite\ICQLite.exe -> C:\Programs\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\AIM\aim.exe -> C:\Programs\AIM\aim.exe:*:Enabled:AOL Instant Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\dpvsetup.exe -> C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\rundll32.exe -> C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\PocketSoft\RTPatch\AutoRTP\artpschd.exe -> C:\Program Files\Common Files\PocketSoft\RTPatch\AutoRTP\artpschd.exe:*:Enabled:artpschd -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Messenger\msmsgs.exe -> C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe -> C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\YServer.exe -> C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\StubInstaller.exe -> D:\StubInstaller.exe:*isabled:LimeWire swarmed installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Dan\LimeWire\LimeWire.exe -> D:\Dan\LimeWire\LimeWire.exe:*:Enabled:LimeWire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Magentic\bin\MgImp.exe -> C:\Program Files\Magentic\bin\MgImp.exe:*:Enabled:Magentic -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Magentic\bin\Magentic.exe -> C:\Program Files\Magentic\bin\Magentic.exe:*:Enabled:Magentic -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Magentic\bin\MgApp.exe -> C:\Program Files\Magentic\bin\MgApp.exe:*:Enabled:Magentic -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\IncrediMail\bin\ImpCnt.exe -> C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msncall.exe -> C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike source\hl2.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike source\hl2.exe:*:Enabled:hl2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\source dedicated server\srcds.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\source dedicated server\srcds.exe:*:Enabled:srcds -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\rtcshare.exe -> C:\WINDOWS\system32\rtcshare.exe:*:Enabled:RTC App Sharing -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\NetMeeting\conf.exe -> C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\pezza91\counter-strike source\hl2.exe -> C:\Programs\Valve\Steam\SteamApps\pezza91\counter-strike source\hl2.exe:*:Enabled:hl2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Xfire\Xfire.exe -> C:\Programs\Xfire\Xfire.exe:*:Enabled:Xfire -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\%windir%\Network Diagnostic\xpnetdiag.exe -> %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe -> C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\livecall.exe -> C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe -> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\World of Warcraft\BackgroundDownloader.exe -> D:\Games\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\SecondLife\SecondLife.exe -> C:\Programs\SecondLife\SecondLife.exe:*:Enabled:Second Life -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\F:\Carrie\Anthony Robbins\UPW\incredimail_install.exe -> F:\Carrie\Anthony Robbins\UPW\incredimail_install.exe:*:Enabled:IncrediMail Installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\Carrie\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe -> C:\Documents and Settings\Carrie\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe:*:Enabled:IncrediMail Installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\Daniel\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe -> C:\Documents and Settings\Daniel\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe:*:Enabled:IncrediMail Installer -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike\hl.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero\hl.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero\hl.exe:*:Enabled:Half-Life Launcher -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\day of defeat source\hl2.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\day of defeat source\hl2.exe:*:Enabled:hl2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero deleted scenes\hl.exe -> C:\Programs\Valve\Steam\SteamApps\dan1471\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\EA Games\BF2.exe -> D:\Games\EA Games\BF2.exe:*:Enabled:Battlefield 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe -> C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\Steam.exe -> D:\Games\Steam.exe:*:Enabled:Steam -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\D:\Games\Diablo\Diablo.exe -> D:\Games\Diablo\Diablo.exe:*:Enablediablo -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\F:\Dan\private server\DB\bin\mysqld-nt.exe -> F:\Dan\private server\DB\bin\mysqld-nt.exe:*:Enabled:mysqld-nt -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\F:\Dan\private server\mangosd.exe -> F:\Dan\private server\mangosd.exe:*isabled:mangosd -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\AOL\Loader\aolload.exe -> C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Google\Google Talk\googletalk.exe -> C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\iTunes\iTunes.exe -> C:\Programs\iTunes\iTunes.exe:*:Enabled:iTunes -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Wizet\MapleStory\Patcher.exe -> C:\Programs\Wizet\MapleStory\Patcher.exe:*:Enabledatcher MFC ?? ???? -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Programs\Skype\Phone\Skype.exe -> C:\Programs\Skype\Phone\Skype.exe:*:Enabled:Skype -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1900:UDP -> 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2869:TCP -> 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\3724:TCP -> 3724:TCP:*:Enabled:Blizzard Downloader: 3724 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security\\Security -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\\ServiceUpgrade -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\{AF349E0B-DBC0-4230-AEAD-C2140BFE97D7} -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\{D6E7FCEB-3A95-4C0C-A5EF-BA5488E3257B} -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate\\{3FA99160-939B-4C8F-89DE-AC17E396FD25} -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\0 -> Root\LEGACY_SHAREDACCESS\0000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\Count -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum\\NextInstance -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Type -> 32 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Start -> 2 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ErrorControl -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ImagePath -> %systemroot%\system32\svchost.exe -k netsvcs -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\DisplayName -> Automatic Updates -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\ObjectName -> LocalSystem -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\\Description -> Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site. -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters\\ServiceDll -> C:\WINDOWS\system32\wuauserv.dll -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security\\Security -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\ -> -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\0 -> Root\LEGACY_WUAUSERV\0000 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\Count -> 1 -> 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum\\NextInstance -> 1 -> 
< Session Manager Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager -> 
BootExecute -> PDBoot.exe;autocheck autochk *; ->


----------



## carrie_uk (Jul 7, 2004)

< Session Manager Environment Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment -> 
ComSpec -> C:\WINDOWS\system32\cmd.exe -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 388608 bytes | Modified Date = 04/08/2004 07:56:48 | Attr = ]
TEMP -> %SystemRoot%\TEMP -> 
TMP -> %SystemRoot%\TEMP -> 
windir -> %SystemRoot% -> 
*Path* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\\Path -> 
%SystemRoot%\system32 -> -> 
%SystemRoot% -> -> 
%SystemRoot%\System32\Wbem -> -> 
C:\Programs\MICROS~1\Office -> -> 
C:\Program Files\Microsoft SQL Server\90\Tools\binn\ -> -> 
C:\Program Files\Common Files\Teleca Shared -> -> 
C:\Programs\Samsung\Samsung PC Studio 3 -> -> 
C:\Program Files\CA\PPRT\bin -> -> 
C:\Programs\QuickTime\QTSystem\ -> -> 
*PATHEXT* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\\PATHEXT -> 
.COM -> -> 
.EXE -> -> 
.BAT -> -> 
.CMD -> -> 
.VBS -> -> 
.VBE -> -> 
.JS -> -> 
.JSE -> -> 
.WSF -> -> 
.WSH -> -> 
< Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> 
batfile [edit] -> %SystemRoot%\System32\NOTEPAD.EXE %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
batfile [open] -> "%1" %* -> 
batfile [print] -> %SystemRoot%\System32\NOTEPAD.EXE /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
chm.file [open] -> "%SystemRoot%\hh.exe" %1 -> Microsoft Corporation [Ver = 5.2.3790.2453 (srv03_sp1_gdr.050525-1542) | Size = 10752 bytes | Modified Date = 26/05/2005 23:22:02 | Attr = ]
cmdfile [edit] -> %SystemRoot%\System32\NOTEPAD.EXE %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
cmdfile [open] -> "%1" %* -> 
cmdfile [print] -> %SystemRoot%\System32\NOTEPAD.EXE /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
comfile [open] -> "%1" %* -> 
cplfile [cplopen] -> rundll32.exe shell32.dll,Control_RunDLL "%1",%* -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
exefile [open] -> "%1" %* -> 
helpfile [open] -> winhlp32.exe %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 283648 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
hlpfile [open] -> %SystemRoot%\System32\winhlp32.exe %1 -> Microsoft Corporation [Ver = 5.1.2600.0 (XPClient.010817-1148) | Size = 8192 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
htafile [open] -> %System32%\mshta.exe "%1" %* -> Microsoft Corporation [Ver = 7.00.5730.11 (winmain(wmbla).061017-1135) | Size = 45568 bytes | Modified Date = 17/10/2006 11:56:10 | Attr = ]
htmlfile [edit] -> "%SystemDrive%\Programs\Microsoft Office\OFFICE11\msohtmed.exe" %1 -> Microsoft Corporation [Ver = 11.0.5510 | Size = 55360 bytes | Modified Date = 14/07/2003 21:52:56 | Attr = ]
htmlfile [open] -> "%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" -nohome -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 625152 bytes | Modified Date = 17/08/2007 10:21:22 | Attr = ]
htmlfile [opennew] -> "%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" %1 -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 625152 bytes | Modified Date = 17/08/2007 10:21:22 | Attr = ]
htmlfile [print] -> "%SystemDrive%\Programs\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 -> Microsoft Corporation [Ver = 11.0.5510 | Size = 55360 bytes | Modified Date = 14/07/2003 21:52:56 | Attr = ]
http [open] -> "%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" -nohome -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 625152 bytes | Modified Date = 17/08/2007 10:21:22 | Attr = ]
https [open] -> "%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" -nohome -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 625152 bytes | Modified Date = 17/08/2007 10:21:22 | Attr = ]
inffile [install] -> %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 33280 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
inffile [open] -> %SystemRoot%\System32\NOTEPAD.EXE %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
inffile [print] -> %SystemRoot%\System32\NOTEPAD.EXE /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
inifile [open] -> %SystemRoot%\System32\NOTEPAD.EXE %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
inifile [print] -> %SystemRoot%\System32\NOTEPAD.EXE /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
InternetShortcut [open] -> rundll32.exe ieframe.dll,OpenURL %l -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 6058496 bytes | Modified Date = 20/08/2007 10:04:38 | Attr = ]
InternetShortcut [print] -> rundll32.exe %System32%\mshtml.dll,PrintHTML "%1" -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 3584512 bytes | Modified Date = 20/08/2007 10:04:42 | Attr = ]
jsfile [edit] -> "%SystemDrive%\Programs\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" -> Macromedia, Inc. [Ver = 8.0.0.2734 | Size = 14602240 bytes | Modified Date = 30/08/2005 15:04:14 | Attr = ]
jsfile [open] -> %SystemRoot%\System32\WScript.exe "%1" %* -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 114688 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
jsfile [print] -> %SystemRoot%\System32\Notepad.exe /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
jsefile [edit] -> %SystemRoot%\System32\Notepad.exe %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
jsefile [open] -> %SystemRoot%\System32\WScript.exe "%1" %* -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 114688 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
jsefile [print] -> %SystemRoot%\System32\Notepad.exe /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
piffile [open] -> "%1" %* -> 
regfile [edit] -> %SystemRoot%\system32\NOTEPAD.EXE %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
regfile [open] -> regedit.exe "%1" -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 146432 bytes | Modified Date = 04/08/2004 07:56:56 | Attr = ]
regfile [merge] -> Reg Data - Key not found -> 
regfile [print] -> %SystemRoot%\system32\NOTEPAD.EXE /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
scrfile [config] -> "%1" -> 
scrfile [install] -> rundll32.exe desk.cpl,InstallScreenSaver %l -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 135168 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
scrfile [open] -> "%1" /S -> 
txtfile [edit] -> Reg Data - Key not found -> 
txtfile [open] -> %SystemRoot%\system32\NOTEPAD.EXE %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
txtfile [print] -> %SystemRoot%\system32\NOTEPAD.EXE /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
txtfile [printto] -> %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
vbefile [edit] -> %SystemRoot%\System32\Notepad.exe %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
vbefile [open] -> %SystemRoot%\System32\WScript.exe "%1" %* -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 114688 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
vbefile [print] -> %SystemRoot%\System32\Notepad.exe /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
vbsfile [edit] -> %SystemRoot%\System32\Notepad.exe %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
vbsfile [open] -> %SystemRoot%\System32\WScript.exe "%1" %* -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 114688 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
vbsfile [print] -> %SystemRoot%\System32\Notepad.exe /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
wsffile [edit] -> %SystemRoot%\System32\Notepad.exe %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
wsffile [open] -> %SystemRoot%\System32\WScript.exe "%1" %* -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 114688 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
wsffile [print] -> %SystemRoot%\System32\Notepad.exe /p %1 -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 69120 bytes | Modified Date = 04/08/2004 07:56:54 | Attr = ]
wshfile [open] -> %SystemRoot%\System32\WScript.exe "%1" %* -> Microsoft Corporation [Ver = 5.6.0.8820 | Size = 114688 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
Unknown [openas] -> %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
Directory [find] -> %SystemRoot%\Explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
Directory [Winamp.Bookmark] -> "%SystemDrive%\Programs\Winamp\winamp.exe" /BOOKMARK "%1" -> Nullsoft [Ver = 5,3,5,1305 | Size = 1137664 bytes | Modified Date = 14/05/2007 22:23:58 | Attr = ]
Directory [Winamp.Enqueue] -> "%SystemDrive%\Programs\Winamp\winamp.exe" /ADD "%1" -> Nullsoft [Ver = 5,3,5,1305 | Size = 1137664 bytes | Modified Date = 14/05/2007 22:23:58 | Attr = ]
Directory [Winamp.Play] -> "%SystemDrive%\Programs\Winamp\winamp.exe" "%1" -> Nullsoft [Ver = 5,3,5,1305 | Size = 1137664 bytes | Modified Date = 14/05/2007 22:23:58 | Attr = ]
Folder [open] -> %SystemRoot%\Explorer.exe /idlist,%I,%L -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
Folder [explore] -> %SystemRoot%\Explorer.exe /e,/idlist,%I,%L -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
Drive [find] -> %SystemRoot%\Explorer.exe -> Microsoft Corporation [Ver = 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Size = 1033216 bytes | Modified Date = 13/06/2007 10:23:08 | Attr = ]
Applications\iexplore.exe [open] -> "%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" %1 -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 625152 bytes | Modified Date = 17/08/2007 10:21:22 | Attr = ]
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -> "%ProgramFiles%\Internet Explorer\iexplore.exe" -> Microsoft Corporation [Ver = 7.00.6000.16544 (vista_gdr.070814-1500) | Size = 625152 bytes | Modified Date = 17/08/2007 10:21:22 | Attr = ]
< Software Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\policies\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\cDefaultExecMenuItems\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\cDefaultExecMenuItems\\tWhiteList -> Close|GeneralInfo|Quit|FirstPage|PrevPage|NextPage|LastPage|ActualSize|FitPage|FitWidth|FitHeight|SinglePage|OneColumn|TwoPages|TwoColumns|ZoomViewIn|ZoomViewOut|ShowHideBookmarks|ShowHideThumbnails|Print|GoToPage|ZoomTo|GeneralPrefs|SaveAs|FullScreen|OpenOrganizer|Scan|Web2PDF:OpnURL|AcroSendMail:SendMail|Spelling:Check Spelling|PageSetup|Find|FindSearch|GoBack|GoForward|FitVisible|ShowHideToolbarEditing|ShowHideToolbarCommenting|ShowHideToolbarEdit|ShowHideToolbarFile|ShowHideToolbarFind|ShowHideToolbarForms|ShowHideToolbarMeasuring|ShowHideToolbarData|ShowHideToolbarPageDisplay|ShowHideToolbarNavigation|ShowHideToolbarPrintProduction|ShowHideToolbarRedaction|ShowHideToolbarBasicTools|ShowHideToolbarTasks|ShowHideToolbarTypewriter|PropertyToolbar|ShowHideArticles|ShowHideFileAttachment|ShowHideAnnotManager|ShowHideFields|ShowHideOptCont|ShowHideModelTree|ShowHideSignatures|InsertPages|ExtractPages|ReplacePages|DeletePages|CropPages|RotatePages|AddFileAttachment|FindCurrentBookmark|BookmarkShowLocation|GoBackDoc|GoForwardDoc|HelpUserGuide|HelpReader -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\cDefaultLaunchAttachmentPerms\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\cDefaultLaunchAttachmentPerms\\tBuiltInPermList -> version:1|.ade:3|.adp:3|.app:3|.asp:3|.bas:3|.bat:3|.bz:3|.bz2:3|.chm:3|.class:3|.cmd:3|.com:3|.command:3|.cpl:3|.crt:3|.csh:3|.desktop:3|.exe:3|.fxp:3|.gz:3|.hex:3|.hlp:3|.hqx:3|.hta:3|.inf:3|.ini:3|.ins:3|.isp:3|.its:3|.job:3|.js:3|.jse:3|.ksh:3|.lnk:3|.lzh:3|.mad:3|.maf:3|.mag:3|.mam:3|.maq:3|.mar:3|.mas:3|.mat:3|.mau:3|.mav:3|.maw:3|.mda:3|.mde:3|.mdt:3|.mdw:3|.mdz:3|.msc:3|.msi:3|.msp:3|.mst:3|.ocx:3|.ops:3|.pcd:3|.pi:3|.pif:3|.prf:3|.prg:3|.pst:3|.rar:3|.reg:3|.scf:3|.scr:3|.sct:3|.sea:3|.shb:3|.shs:3|.sit:3|.tar:3|.tgz:3|.tmp:3|.url:3|.vb:3|.vbe:3|.vbs:3|.vsmacros:3|.vss:3|.vst:3|.vsw:3|.webloc:3|.ws:3|.wsc:3|.wsf:3|.wsh:3|.zip:3|.zlo:3|.zoo:3|.pdf:2|.fdf:2 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\cDefaultLaunchURLPerms\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Adobe\Acrobat Reader\8.0\FeatureLockdown\cDefaultLaunchURLPerms\\tSchemePerms -> version:1|shell:3|hcp:3|ms-help:3|ms-its:3|ms-itss:3|its:3|mk:3|mhtml:3|help:3|disk:3|afp:3|disks:3|telnet:3|ssh:3|acrobat:2|mailto:2|file:1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Conferencing\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Messenger\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Messenger\Client\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\MRT\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\RTC\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\\DisableServerCheck -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\\LegacyPresence -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\CertificatePolicy\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\PortRange\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\DriverSearching\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\DriverSearching\\DontSearchWindowsUpdate -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\DriverSearching\\DontPromptForWindowsUpdate -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Installer\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Installer\\EnableAdminTSRemote -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\RTC\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\RTC\CertificatePolicy\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\RTC\PortRange\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\RTC\PortRange\\Enabled -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\\ExecutableTypes -> ADE;ADP;BAS;BAT;CHM;CMD;COM;CPL;CRT;EXE;HLP;HTA;INF;INS;ISP;LNK;MDB;MDE;MSC;MSI;MSP;MST;OCX;PCD;PIF;REG;SCR;SHS;URL;VB;WSC; -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\\TransparentEnabled -> 1 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\\DefaultLevel -> 262144 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\\AuthenticodeEnabled -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\\PolicyScope -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\Description -> Stop the download of this file -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\FriendlyName -> Mdac11.cab -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\SaferFlags -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\HashAlg -> 32771 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\ItemData -> ^«0O•zI‰j
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\LastModified -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}\\ItemSize -> ; -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\Description -> Stop the download of this file -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\FriendlyName -> mdac20.cab -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\SaferFlags -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\HashAlg -> 32771 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\ItemData -> g°Ô‹4:?Ó¼éÜdgó" -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\LastModified -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}\\ItemSize -> ; -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\Description -> Stop the download of this file -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\FriendlyName -> mdac20_a.cab -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\SaferFlags -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\HashAlg -> 32771 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\ItemData -> 2xÜþøÈ"ÜŠ°Ý„} -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\LastModified -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}\\ItemSize -> -; -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\ -> ->


----------



## carrie_uk (Jul 7, 2004)

HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\Description -> Stop the download of this file -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\FriendlyName -> _msadc10.cab -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\SaferFlags -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\HashAlg -> 32771 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\ItemData -> ½š*ÛBëØV%Mø/g -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\LastModified -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}\\ItemSize -> å; -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\Description -> Stop the download of this file -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\FriendlyName -> msadc11.cab -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\SaferFlags -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\HashAlg -> 32771 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\ItemData -> 8k_„ìöiÓk•j"À€ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\LastModified -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}\\ItemSize -> r; -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\\Description -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\\SaferFlags -> 0 -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\\ItemData -> %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache%OLK* -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}\\LastModified -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows NT\ -> -> 
HKEY_LOCAL_MACHINE\SOFTWARE\policies\Microsoft\Windows NT\Terminal Services\ -> -> 
< Software Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\policies\ -> 
HKEY_CURRENT_USER\Software\Policies\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ConferencingRTC\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ConferencingRTC\{A5B45060-354F-4097-A928-5125436C46F1}\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ConferencingRTC\{A5B45060-354F-4097-A928-5125436C46F1}\Software\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ConferencingRTC\{A5B45060-354F-4097-A928-5125436C46F1}\Software\Policies\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ConferencingRTC\{A5B45060-354F-4097-A928-5125436C46F1}\Software\Policies\Microsoft\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\ConferencingRTC\{A5B45060-354F-4097-A928-5125436C46F1}\Software\Policies\Microsoft\Conferencing\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\RTC\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\ -> -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\\DisableServerCheck -> 1 -> 
HKEY_CURRENT_USER\Software\Policies\Microsoft\RTC\{A5B45060-354F-4097-A928-5125436C46F1}\\LegacyPresence -> 1 -> 
< Tcpip Persistent Routes > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes -> 
< Uninstall List > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ -> 
{01339AE5-04D4-43F8-008E-13AD788DC4F7} -> SimCity 4 Rush Hour -> 
{01521746-02A6-4A72-00BD-A285DF6B80C6} -> The Sims 2 University -> 
{048298C9-A4D3-490B-9FF9-AB023A9238F3} -> Steam -> 
{04858915-9F49-4B2A-AED4-DC49A7DE6A7B} -> Battlefield 2(TM) -> 
{05BCCF27-DC23-4ED9-87A2-F8D5B244B4C4} -> RPS AntiVirus -> 
{0837A661-FEC3-48B3-876C-91E7D32048A9} -> Macromedia Dreamweaver 8 -> 
{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} -> MSXML 6.0 Parser (KB933579) -> 
{0AB149EB-2AE0-466C-9BA4-3A718CF06432} -> Informations about your PC -> 
{153BC7CA-9F2F-45AC-B4A1-AFAFBD5D904B} -> Virgin Broadband PCguard -> 
{16E217EA-C3E0-402D-8D4F-6189DB74497A} -> Studio 9.4 Patch -> 
{18D10072035C4515918F7E37EAFAACFC} -> AutoUpdate -> 
{1ACE3F9D-CDA4-4F39-9605-334CF37A1579} -> Authentium AntiVirus SDK - 2 -> 
{1CB92574-96F2-467B-B793-5CEB35C40C29} -> Image Resizer Powertoy for Windows XP -> 
{1CBE3804-20DF-48DA-B048-895C206E80A5} -> Microsoft SQL Server VSS Writer -> 
{1FABA7C7-6DC0-11D6-9EAB-0050BAE317E1} -> VideoLive Mail -> 
{212F5777-1190-4DEF-8E4D-6B2F313B45E7} -> PerfectDisk -> 
{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk -> Google Talk (remove only) -> 
{2318C2B1-4965-11d4-9B18-009027A5CD4F} -> Google Toolbar for Internet Explorer -> 
{23E5C72C-CC08-4EE0-9CC2-D925B232B331} -> Microsoft MSDN 2005 Express Edition - ENU -> 
{2750B389-A2D2-4953-99CA-27C1F2A8E6FD} -> Microsoft SQL Server 2005 Tools Express Edition -> 
{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F} -> Microsoft SQL Server 2005 Express Edition (SQLEXPRESS) -> 
{2BD5C305-1B27-4D41-B690-7A61172D2FEB} -> Macromedia Flash 8 -> 
{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3} -> Logitech SetPoint -> 
{30BB4D60-81DB-11D5-BB77-00400536ABAC} -> OLYMPUS CAMEDIA Master 4.0 -> 
{30C10EE3-EFB3-4B7A-9CDC-50790C2B5200} -> CA Licensing -> 
{3248F0A8-6813-11D6-A77B-00B0D0160030} -> Java(TM) 6 Update 3 -> 
{324D4909-7A7B-45CD-B199-E975DC108249} -> RPS PopupBlocker -> 
{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227} -> WebFldrs XP -> 
{37477865-A3F1-4772-AD43-AAFC6BCFF99F} -> MSXML 4.0 SP2 (KB927978) -> 
{3A836186-46F8-4388-9830-820E35C02992} -> RPS Diagnostic Utility -> 
{3AFF4279-A590-4010-8C8A-3B096A220CFC} -> RPS Zip -> 
{3C441434-737C-4D54-8EAB-B409BE54E734} -> RPS App Detector -> 
{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B} -> Google Earth -> 
{3F866D37-22D0-435D-94F1-31A64D566D0E} -> Pinnacle device drivers -> 
{43DCF766-6838-4F9A-8C91-D92DA586DFA7} -> Microsoft Windows Journal Viewer -> 
{45EBDA59-D33B-433A-956E-B2F236468B56} -> MUSICMATCH® Jukebox -> 
{4817189D-1785-4627-A33C-39FD90919300} -> The Sims 2 Pets -> 
{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E} -> SmartSound Quicktracks Plugin -> 
{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D} -> Macromedia Fireworks 8 -> 
{4C643986-DE3C-4737-8472-CCEC36CCC267} -> Studio Content CD -> 
{4F41AD68-89F2-4262-A32C-2F70B01FCE9E} -> Photo Story 3 for Windows -> 
{4F5CE18C-D97D-48FF-A510-A0D90C918294} -> iTunes -> 
{53C32728-D434-4143-9C9D-D73D68D00893} -> RPS ParentalControl -> 
{53F5C3EE-05ED-4830-994B-50B2F0D50FCE} -> Microsoft SQL Server Setup Support Files (English) -> 
{5546CDB5-2CE2-498B-B059-5B3BF81FC41F} -> Macromedia Extension Manager -> 
{571700F0-DB9D-4B3A-B03D-35A14BB5939F} -> Windows Live Messenger -> 
{577AD794-8B34-40B4-9E7A-BE4CFFE396E6} -> Microsoft Visual Basic 2005 Express Edition - ENU -> 
{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} -> Skype™ 3.5 -> 
{5DFDEAAA-E050-482E-A5B6-138CAE53F7BF} -> Radialpoint Security Services -> 
{5E7EBB6D-F44B-4D8B-9C52-F0F9173FD166} -> RPS Security Cleanup -> 
{6811CAA0-BF12-11D4-9EA1-0050BAE317E1} -> PowerDVD -> 
{6B103F43-069C-11D6-9EA2-0050BAE317E1} -> Home Cinema XL II -> 
{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0} -> The Sims 2 Family Fun Stuff -> 
{6D7B631E-52DB-4A33-88EF-4FA0195EDDB1} -> CSI -> 
{6E65247F-58F9-41CA-BE69-0316F7907170} -> Disc2Phone -> 
{6E7DD182-9FC6-4651-0095-2E666CC6AF35} -> The Sims 2 -> 
{6EA0ABC4-172B-48D4-AF26-93322D7FDE72} -> RPS Ad Blocker -> 
{7131646D-CD3C-40F4-97B9-CD9E4E6262EF} -> Microsoft .NET Framework 2.0 -> 
{7299052b-02a4-4627-81f2-1818da5d550d} -> Microsoft Visual C++ 2005 Redistributable -> 
{764D06D8-D8DE-411E-A1C8-D9E9380F8A84} -> Microsoft Works 7.0 -> 
{76EFFC7C-17A6-479D-9E47-8E658C1695AE} -> Windows Backup Utility -> 
{789289CA-F73A-4A16-A331-54D498CE069F} -> Ventrilo Client -> 
{7B3577F5-1D82-4C9B-008B-69D026FD8BCA} -> The Sims 2 Open For Business -> 
{7B63B2922B174135AFC0E1377DD81EC2} -> DivX Codec -> 
{82DFB852-9594-4668-9C66-28BB6E94BCB2} -> HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet -> 
{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75} -> The Sims™ 2 H&M® Fashion Stuff -> 
{8ADFC4160D694100B5B8A22DE9DCABD9} -> DivX Player -> 
{8BF2C401-02CE-424D-BC26-6C4F9FB446B6} -> Macromedia Flash 8 Video Encoder -> 
{900B1197-53F5-4F46-A882-2CFFFE2EEDCB} -> Logitech Desktop Messenger -> 
{90110409-6000-11D3-8CFE-0150048383C9} -> Microsoft Office Professional Edition 2003 -> 
{90170409-6000-11D3-8CFE-0150048383C9} -> Microsoft Office FrontPage 2003 -> 
{90510409-6000-11D3-8CFE-0150048383C9} -> Microsoft Office Visio Professional 2003 -> 
{907B4640-266B-4A21-92FB-CD1A86CD0F63} -> RollerCoaster Tycoon 3 -> 
{91057632-CA70-413C-B628-2D3CDBBB906B} -> Macromedia Flash Player 8 Plugin -> 
{9763E36A-08E9-4228-BBCE-12989A4EB1A8} -> QuickTime -> 
{9ACEBC7B-4D46-462A-929C-99177EC5BEA6} -> InstantCopy -> 
{9BFFB382-0B2C-11D6-AB3E-000102B0F79A} -> Readiris 7.5 -> 
{9CDBC303-3EED-40b0-8E41-A7C65AA96C26} -> The Sims 2 Glamour Life Stuff -> 
{9E491AB7-4589-48CA-9CBB-874CB2788391} -> Studio 9 -> 
{A06275F4-324B-4E85-95E6-87B2CD729401} -> Windows Defender -> 
{A542D695-16D3-4F89-A6F1-091F009B8ABA} -> RPS Burn -> 
{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C} -> Windows Defender Signatures -> 
{A654A805-41D9-40C7-AA46-4AF04F044D61} -> Adobe® Photoshop® Album Starter Edition 3.2 -> 
{A7894110-9C15-43EF-89E9-060363290188} -> Samsung PC Studio -> 
{ac76930b-8c77-4a64-991c-b2ac308a8425} -> RelevantKnowledge -> 
{AC76BA86-7AD7-1033-7B44-A81000000003} -> Adobe Reader 8.1.1 -> 
{AFE0D559-DAC2-4DF0-B432-4CBA15769AA9} -> RPS RpsCore -> 
{B13A7C41581B411290FBC0395694E2A9} -> DivX Converter -> 
{B5C0FD16-3A5D-40D5-8B59-4B43279BB5D0} -> RPS Backup -> 
{B5C209B1-8DDB-4642-A573-375B951514CB} -> Apple Mobile Device Support -> 
{B67624DE-75CE-4FAD-9F29-5C115773CE61} -> Studio Content DVD -> 
{B7050CBDB2504B34BC2A9CA0A692CC29} -> DivX Web Player -> 
{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} -> Apple Software Update -> 
{B7A0CE06-068E-11D6-97FD-0050BACBF861} -> PowerProducer -> 
{BABAEBE4-9FFB-4B5D-9453-64FF11517CA2} -> Tom Clancy's Splinter Cell Chaos Theory -> 
{BF251EAF-8697-4E89-BF09-C998F97BBC40} -> Microsoft SQL Server Native Client -> 
{C04E32E0-0416-434D-AFB9-6969D703A9EF} -> MSXML 4.0 SP2 (KB936181) -> 
{C43048A9-742C-4DAD-90D2-E3B53C9DB825} -> Logitech QuickCam Software -> 
{C4A4722E-79F9-417C-BD72-8D359A090C97} -> Samsung PC Studio -> 
{C5ADA65A-7828-4D85-B071-ECC52B51F794} -> Sony Ericsson PC Suite 1.20.173 -> 
{C831972C-3834-4D9D-A095-8350B324AC3C} -> RPS AntiFraud -> 
{C869F4FF-E5FF-4FBB-9A31-33C23605E170} -> PPSDKRedistributables -> 
{CB099890-1D5F-11D5-9EA9-0050BAE317E1} -> PowerDirector -> 
{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} -> Microsoft .NET Framework 1.1 -> 
{CEBB6BFB-D708-4F99-A633-BC2600E01EF6} -> TOSHIBA Bluetooth Stack for Apache by CSR -> 
{D050D7362D214723AD585B541FFB6C11} -> DivX Content Uploader -> 
{D45EC259-4A19-4656-B588-C2C360DD18EA} -> Half-Life(R) 2 -> 
{D6DE02C7-1F47-11D4-9515-00105AE4B89A} -> Paint Shop Pro 7 Anniversary Edition -> 
{D8AEA1D1-78FE-4CE1-9405-D7E55E797C4D} -> RPS AsRealtime -> 
{DD1C392B-226D-42C9-B8E6-2A9BEF7583B4} -> RPS Performance Tool -> 
{DE98DCB3-8A2F-429C-B765-E4A711302FF8} -> Baby -> 
{DEC511B1-59CB-4F15-AD75-0543034572A5} -> MapleStory -> 
{DEE885E8-2C84-4CDA-BF34-076DCC9388A9} -> F-FR Launcher -> 
{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06} -> The Sims™ 2 Seasons -> 
{E52BFE61-E0FF-11D6-9D69-00065BABCB42} -> Reason -> 
{EA926717-CE5A-4CB4-AB21-9E6E9565A458} -> RCT3 Soaked -> 
{ECBDDBD7-43CC-417C-B87A-943AFED8EB57} -> RPS Firewall -> 
{ED93995E-8BF2-480F-8EA4-7D29E29A7052} -> HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet Drivers -> 
{EE1D5780-AF29-4DC4-A107-3FD5F79AC63A} -> RPS AntiSpyware -> 
{EFB21DE7-8C19-4A88-BB28-A766E16493BC} -> Adobe Photoshop CS -> 
{F248ADFA-64E0-4b03-8A83-059078BED6A0} -> The Sims™ 2 Bon Voyage -> 
{F7529650-B9DB-481B-0089-A2AC3C2821C1} -> The Sims 2 Nightlife -> 
{FCA586EB-8FB0-41A4-B724-13AED3A31A47} -> MTX MotoTrax Demo -> 
{FD2EC356-DB5E-40AE-907A-9A1D38F9396D} -> RPS Privacy Manager -> 
{FF262740-C85A-11D5-BBEC-00D0B740900A} -> Multimedia Keyboard Driver Ver1.0 (KB-0108) -> 
123 Advanced MP3 Cutter_is1 -> 123 Advanced MP3 Cutter -> 
Adobe Acrobat 5.0 -> Adobe Acrobat 5.0 -> 
Adobe Flash Player ActiveX -> Adobe Flash Player ActiveX -> 
Adobe Shockwave Player -> Adobe Shockwave Player -> 
Adobe® Photoshop® Album Starter Edition 3.2 -> Adobe® Photoshop® Album Starter Edition 3.2 -> 
Age of Empires -> Microsoft Age of Empires -> 
AIM_6 -> AIM 6 -> 
AudibleManager -> AudibleManager -> 
BitComet Ultra Accelerator_is1 -> BitComet Ultra Accelerator 2.7.0.0 -> 
Blaze Audio Voice Cloak Trial -> Voice Cloak Trial -> 
CdaC13Ba -> SafeCast Shared Components -> 
C-Media Audio -> C-Media 3D Audio -> 
Creative Removable Disk Manager -> Creative Removable Disk Manager -> 
Diablo -> Diablo -> 
Diablo II -> Diablo II -> 
Download Manager -> Download Manager 2.3.6 -> 
DVD Decrypter -> DVD Decrypter (Remove Only) -> 
DVD Shrink_is1 -> DVD Shrink 3.2 -> 
DVDFab Decrypter_is1 -> DVDFab Decrypter 2.9.8.0 -> 
DVDFab HD Decrypter_is1 -> DVDFab HD Decrypter 3.1.4.0 -> 
Elasto Mania -> Elasto Mania -> 
ewidoantispyware4 -> ewido anti-spyware 4.0 -> 
Fraps -> Fraps (remove only) -> 
Free Internet Eraser_is1 -> Free Internet Eraser 2.10 -> 
Game Maker 6.1 -> Game Maker 6.1 -> 
GCFScape_is1 -> GCFScape 1.3.1 -> 
GoogleVideoPlayer -> Google Video Player -> 
Guild Wars -> Guild Wars -> 
HijackThis -> HijackThis 1.99.1 -> 
Hollywood FX 5 -> Pinnacle Hollywood FX 5 -> 
hp instant support -> hp instant support -> 
hp psc 2100 series_Driver -> hp psc 2100 series -> 
ICQLite -> ICQ 5.1 -> 
IDNMitigationAPIs -> Microsoft Internationalized Domain Names Mitigation APIs -> 
ie7 -> Windows Internet Explorer 7 -> 
IncrediMail -> IncrediMail Xe -> 
InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E} -> SmartSound Quicktracks Plugin -> 
KB873339 -> Windows XP Hotfix - KB873339 -> 
KB885835 -> Windows XP Hotfix - KB885835 -> 
KB885836 -> Windows XP Hotfix - KB885836 -> 
KB886185 -> Windows XP Hotfix - KB886185 -> 
KB887472 -> Windows XP Hotfix - KB887472 -> 
KB887742 -> Windows XP Hotfix - KB887742 -> 
KB888113 -> Windows XP Hotfix - KB888113 -> 
KB888302 -> Windows XP Hotfix - KB888302 -> 
KB890046 -> Security Update for Windows XP (KB890046) -> 
KB890859 -> Windows XP Hotfix - KB890859 -> 
KB891781 -> Windows XP Hotfix - KB891781 -> 
KB893756 -> Security Update for Windows XP (KB893756) -> 
KB893803v2 -> Windows Installer 3.1 (KB893803) -> 
KB896358 -> Security Update for Windows XP (KB896358) -> 
KB896422 -> Security Update for Windows XP (KB896422) -> 
KB896423 -> Security Update for Windows XP (KB896423) -> 
KB896424 -> Security Update for Windows XP (KB896424) -> 
KB896428 -> Security Update for Windows XP (KB896428) -> 
KB898458 -> Security Update for Step By Step Interactive Training (KB898458) -> 
KB898461 -> Update for Windows XP (KB898461) -> 
KB899587 -> Security Update for Windows XP (KB899587) -> 
KB899591 -> Security Update for Windows XP (KB899591) -> 
KB900485 -> Update for Windows XP (KB900485) -> 
KB900725 -> Security Update for Windows XP (KB900725) -> 
KB901017 -> Security Update for Windows XP (KB901017) -> 
KB901190 -> Security Update for Windows XP (KB901190) -> 
KB901214 -> Security Update for Windows XP (KB901214) -> 
KB902400 -> Security Update for Windows XP (KB902400) -> 
KB904706 -> Security Update for Windows XP (KB904706) -> 
KB904942 -> Update for Windows XP (KB904942) -> 
KB905414 -> Security Update for Windows XP (KB905414) -> 
KB905749 -> Security Update for Windows XP (KB905749) -> 
KB908519 -> Security Update for Windows XP (KB908519) -> 
KB908531 -> Update for Windows XP (KB908531) -> 
KB910437 -> Update for Windows XP (KB910437) -> 
KB911280 -> Update for Windows XP (KB911280) -> 
KB911562 -> Security Update for Windows XP (KB911562) -> 
KB911564 -> Security Update for Windows Media Player (KB911564) -> 
KB911565 -> Security Update for Windows Media Player 10 (KB911565) -> 
KB911567 -> Security Update for Windows XP (KB911567) -> 
KB911927 -> Security Update for Windows XP (KB911927) -> 
KB912919 -> Security Update for Windows XP (KB912919) -> 
KB913580 -> Security Update for Windows XP (KB913580) -> 
KB914388 -> Security Update for Windows XP (KB914388) -> 
KB914389 -> Security Update for Windows XP (KB914389) -> 
KB914440 -> Hotfix for Windows XP (KB914440) -> 
KB915865 -> Hotfix for Windows XP (KB915865) -> 
KB916281 -> Security Update for Windows XP (KB916281) -> 
KB916595 -> Update for Windows XP (KB916595) -> 
KB917159 -> Security Update for Windows XP (KB917159) -> 
KB917344 -> Security Update for Windows XP (KB917344) -> 
KB917422 -> Security Update for Windows XP (KB917422) -> 
KB917734_WMP10 -> Security Update for Windows Media Player 10 (KB917734) -> 
KB917734_WMP9 -> Security Update for Windows Media Player 9 (KB917734) -> 
KB917953 -> Security Update for Windows XP (KB917953) -> 
KB918118 -> Security Update for Windows XP (KB918118) -> 
KB918899 -> Security Update for Windows XP (KB918899) -> 
KB919007 -> Security Update for Windows XP (KB919007) -> 
KB920213 -> Security Update for Windows XP (KB920213) -> 
KB920214 -> Security Update for Windows XP (KB920214) -> 
KB920670 -> Security Update for Windows XP (KB920670) -> 
KB920683 -> Security Update for Windows XP (KB920683) -> 
KB920685 -> Security Update for Windows XP (KB920685) -> 
KB920872 -> Update for Windows XP (KB920872) -> 
KB921398 -> Security Update for Windows XP (KB921398) -> 
KB921503 -> Security Update for Windows XP (KB921503) -> 
KB921883 -> Security Update for Windows XP (KB921883) -> 
KB922582 -> Update for Windows XP (KB922582) -> 
KB922616 -> Security Update for Windows XP (KB922616) -> 
KB922819 -> Security Update for Windows XP (KB922819) -> 
KB923191 -> Security Update for Windows XP (KB923191) -> 
KB923414 -> Security Update for Windows XP (KB923414) -> 
KB923694 -> Security Update for Windows XP (KB923694) -> 
KB923723 -> Security Update for Step By Step Interactive Training (KB923723) -> 
KB923980 -> Security Update for Windows XP (KB923980) -> 
KB924191 -> Security Update for Windows XP (KB924191) -> 
KB924270 -> Security Update for Windows XP (KB924270) -> 
KB924496 -> Security Update for Windows XP (KB924496) -> 
KB924667 -> Security Update for Windows XP (KB924667) -> 
KB925398_WMP64 -> Security Update for Windows Media Player 6.4 (KB925398) -> 
KB925486 -> Security Update for Windows XP (KB925486) -> 
KB925902 -> Security Update for Windows XP (KB925902) -> 
KB926239 -> Hotfix for Windows XP (KB926239) -> 
KB926255 -> Security Update for Windows XP (KB926255) -> 
KB926436 -> Security Update for Windows XP (KB926436) -> 
KB927779 -> Security Update for Windows XP (KB927779) -> 
KB927802 -> Security Update for Windows XP (KB927802) -> 
KB927891 -> Update for Windows XP (KB927891) -> 
KB928090-IE7 -> Security Update for Windows Internet Explorer 7 (KB928090) -> 
KB928255 -> Security Update for Windows XP (KB928255) -> 
KB928365.T1_1ToU569_1 -> Security Update for Microsoft .NET Framework 2.0 (KB928365) -> 
KB928843 -> Security Update for Windows XP (KB928843) -> 
KB929123 -> Security Update for Windows XP (KB929123) -> 
KB929338 -> Update for Windows XP (KB929338) -> 
KB929399 -> Hotfix for Windows Media Format 11 SDK (KB929399) -> 
KB929969 -> Security Update for Windows Internet Explorer 7 (KB929969) -> 
KB930178 -> Security Update for Windows XP (KB930178) -> 
KB930916 -> Update for Windows XP (KB930916) -> 
KB931261 -> Security Update for Windows XP (KB931261) -> 
KB931768-IE7 -> Security Update for Windows Internet Explorer 7 (KB931768) -> 
KB931784 -> Security Update for Windows XP (KB931784) -> 
KB931836 -> Update for Windows XP (KB931836) -> 
KB932168 -> Security Update for Windows XP (KB932168) -> 
KB933360 -> Update for Windows XP (KB933360) -> 
KB933566-IE7 -> Security Update for Windows Internet Explorer 7 (KB933566) -> 
KB933729 -> Security Update for Windows XP (KB933729) -> 
KB935839 -> Security Update for Windows XP (KB935839) -> 
KB935840 -> Security Update for Windows XP (KB935840) -> 
KB936021 -> Security Update for Windows XP (KB936021) -> 
KB936357 -> Update for Windows XP (KB936357) -> 
KB936782_WMP11 -> Security Update for Windows Media Player 11 (KB936782) -> 
KB937143-IE7 -> Security Update for Windows Internet Explorer 7 (KB937143) -> 
KB938127-IE7 -> Security Update for Windows Internet Explorer 7 (KB938127) -> 
KB938828 -> Update for Windows XP (KB938828) -> 
KB938829 -> Security Update for Windows XP (KB938829) -> 
KB939653-IE7 -> Security Update for Windows Internet Explorer 7 (KB939653) -> 
KB939683 -> Hotfix for Windows Media Player 11 (KB939683) -> 
KB941202 -> Security Update for Windows XP (KB941202) -> 
KB943460 -> Security Update for Windows XP (KB943460) -> 
M928366 -> Microsoft .NET Framework 1.1 Hotfix (KB928366) -> 
Magentic -> Magentic -> 
MediaShow -> [email protected] -> 
Messenger Plus! Live -> Messenger Plus! Live -> 
Microsoft .NET Framework 1.1 (1033) -> Microsoft .NET Framework 1.1 -> 
Microsoft .NET Framework 2.0 -> Microsoft .NET Framework 2.0 -> 
Microsoft MSDN 2005 Express Edition - ENU -> Microsoft MSDN 2005 Express Edition - ENU -> 
Microsoft SQL Server 2005 -> Microsoft SQL Server 2005 -> 
Microsoft Visual Basic 2005 Express Edition - ENU -> Microsoft Visual Basic 2005 Express Edition - ENU -> 
Mozilla Firefox (2.0.0.6) -> Mozilla Firefox (2.0.0.6) -> 
mozy_is1 -> MozyHome 1.8.4.7 -> 
MSCompPackV1 -> Microsoft Compression Client Pack 1.0 for Windows XP -> 
MSPUB5 -> Microsoft Publisher 98 -> 
Nero - Burning Rom!UninstallKey -> Ahead Nero OEM -> 
NLSDownlevelMapping -> Microsoft National Language Support Downlevel APIs -> 
NVIDIA Drivers -> NVIDIA Drivers -> 
PartyPoker -> PartyPoker -> 
PSC 2000 Series -> HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet -> 
QcDrv -> Logitech® Camera Driver -> 
RadialpointClientGateway_is1 -> Virgin Broadband advisor 1.5.14 -> 
RealPlayer 6.0 -> RealPlayer -> 
Reason Demo_is1 -> Reason Demo 3.0.4 -> 
Return To Wonderland Deluxe_is1 -> Return To Wonderland Deluxe v2.06 -> 
RipIt4Me -> RipIt4Me ->


----------



## carrie_uk (Jul 7, 2004)

SAMSUNG CDMA Modem -> SAMSUNG CDMA Modem Driver Set -> 
SAMSUNG Mobile USB Modem -> SAMSUNG Mobile USB Modem Software -> 
SAMSUNG Mobile USB Modem 1.0 -> SAMSUNG Mobile USB Modem 1.0 Software -> 
SCDNAS -> SHOUTcast DNAS (remove only) -> 
Scrabble ® -> Scrabble ® -> 
SecondLife -> SecondLife (remove only) -> 
Shockwave -> Shockwave -> 
SHOUTcastDSP -> SHOUTcast Source DSP 1.9.0 (remove only) -> 
SOFTIMAGE XSI 4.2 ModTool -> SOFTIMAGE®|XSI® 4.2 ModTool -> 
SpeederXP v1.60_is1 -> SpeederXP 1.60 -> 
Spybot - Search & Destroy_is1 -> Spybot - Search & Destroy 1.4 -> 
ST6UNST #1 -> Hero Editor V0.96 -> 
ST6UNST #2 -> TMPlayHome -> 
SysInfo -> Creative System Information -> 
Teamspeak 2 RC2_is1 -> TeamSpeak 2 RC2 -> 
VidCrop_is1 -> VidCrop -> 
VideoMach 3.5.2 -> VideoMach 3.5.2 -> 
ViewpointMediaPlayer -> Viewpoint Media Player -> 
VN_VUIns_Rhine_VIA -> VIA Rhine-Family Fast Ethernet Adapter -> 
Vodafone 804SS USB driver -> SAMSUNG Mobile USB Modem ^^ -> 
VTFEdit_is1 -> VTFEdit 1.2.3 -> 
Webshots Desktop -> Webshots Desktop -> 
WGA -> Windows Genuine Advantage Validation Tool (KB892130) -> 
WgaNotify -> Windows Genuine Advantage Notifications (KB905474) -> 
Winamp -> Winamp (remove only) -> 
Windows Media Format Runtime -> Windows Media Format 11 runtime -> 
Windows Media Player -> Windows Media Player 11 -> 
Windows XP Service Pack -> Windows XP Service Pack 2 -> 
WinRAR archiver -> WinRAR archiver -> 
WMFDist11 -> Windows Media Format 11 runtime -> 
wmp11 -> Windows Media Player 11 -> 
World of Warcraft -> World of Warcraft -> 
Wudf01000 -> Microsoft User-Mode Driver Framework Feature Pack 1.0 -> 
Xfire -> Xfire (remove only) -> 
Yahoo! Messenger -> Yahoo! Messenger -> 
Yahoo! Messenger with BT Communicator -> Yahoo! Messenger with BT Communicator -> 
< WOW Settings [HKLM] - Select to Repair > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW -> 
cmdline -> %SystemRoot%\system32\ntvdm.exe -> 
wowcmdline -> %SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386 -> 
< EventViewer Logs > -> Errors and Warnings -> Description
Application - Warning - 18/11/2007 15:46:12 -> Computer Name = MARDENS - User Name = MARDENS\Mum - Source = MsiInstaller -> Description = Detection of product B045B608-4A47-4C77-9EAD-06C394503306 feature iTunes component 2A7E5403-A5F5-4D02-AE05-7E93F2F0B9F4 failed The resource HKEYCURRENTUSERSoftwareMicrosoftOfficeOutlookAddinsiTunesAddInCalendarHelper does not exist
Application - Warning - 18/11/2007 15:46:12 -> Computer Name = MARDENS - User Name = MARDENS\Mum - Source = MsiInstaller -> Description = Detection of product B045B608-4A47-4C77-9EAD-06C394503306 feature iTunes failed during request for component E8A1D3E2-F5D3-4B24-AB93-52F7E602A235
Application - Error - 18/11/2007 16:08:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Application Hang -> Description = Hanging application explorerexe version 6029003156 hang module hungapp version 0000 hang address 0x00000000
Application - Error - 18/11/2007 18:48:42 -> Computer Name = MARDENS - User Name = (blank) - Source = Application Error -> Description = 
Application - Warning - 19/11/2007 17:21:07 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 19/11/2007 17:21:38 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 19/11/2007 18:26:54 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 19/11/2007 18:27:16 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 20/11/2007 21:14:40 -> Computer Name = MARDENS - User Name = MARDENS\Chris - Source = Userenv -> Description = 
Application - Warning - 20/11/2007 21:14:43 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 20/11/2007 23:35:59 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 20/11/2007 23:36:20 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Error - 21/11/2007 13:36:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Application Hang -> Description = Hanging application Patcherexe version 1001 hang module hungapp version 0000 hang address 0x00000000
Application - Warning - 21/11/2007 23:38:32 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 21/11/2007 23:38:53 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 22/11/2007 00:11:07 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 22/11/2007 00:11:26 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 22/11/2007 17:18:24 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 22/11/2007 17:18:44 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 22/11/2007 18:13:21 -> Computer Name = MARDENS - User Name = MARDENS\Mum - Source = Userenv -> Description = 
Application - Warning - 22/11/2007 18:13:21 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
Application - Warning - 23/11/2007 14:02:18 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Error - 23/11/2007 16:10:25 -> Computer Name = MARDENS - User Name = (blank) - Source = Application Hang -> Description = Hanging application TeamSpeakexe version 203260 hang module hungapp version 0000 hang address 0x00000000
Application - Warning - 24/11/2007 01:51:40 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = Userenv -> Description = 
Application - Warning - 24/11/2007 01:52:00 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = Userenv -> Description = 
System - Warning - 17/11/2007 23:19:40 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID 606DC589-E173-447F-818D-74CC1D9DBBE4User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found driverdumpwmimmcAlert Type 807Detection Type (null)
System - Warning - 18/11/2007 19:30:56 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Error - 19/11/2007 17:06:53 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Apple Mobile Device service terminated unexpectedly It has done this 1 time(s) The following corrective action will be taken in 60000 milliseconds Restart the service
System - Warning - 19/11/2007 17:08:25 -> Computer Name = MARDENS - User Name = (blank) - Source = PlugPlayManager -> Description = The service Apple Mobile Device may not have unregistered for device event notifications before it was stopped
System - Error - 19/11/2007 17:09:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Apple Mobile Device service terminated unexpectedly It has done this 2 time(s) The following corrective action will be taken in 60000 milliseconds Restart the service
System - Warning - 19/11/2007 17:14:51 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID 76FDB2C1-2761-4777-8B7E-FFB4FAE9BED5User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found regkeyHKLMSoftwareMicrosoftWindowsCurrentVersionRunQuickTime TaskrunkeyHKLMSoftwareMicrosoftWindowsCurrentVersionRunQuickTime TaskfileCProgramsQuickTimeQTTaskexeAlert Type 807Detection Type (null)
System - Warning - 19/11/2007 17:19:40 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID E76B2DBB-9654-4C9C-9930-CE81E1787389User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found regkeyHKLMSystemCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListCProgramsiTunesiTunesexefirewallokfileHKLMSystemCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListCProgramsiTunesiTunesexefileCProgramsiTunesiTunesexeAlert Type 807Detection Type (null)
System - Error - 19/11/2007 17:21:23 -> Computer Name = MARDENS - User Name = MARDENS\Carrie - Source = DCOM -> Description = 
System - Error - 19/11/2007 17:23:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Event Log Watch service failed to start due to the following error 3
System - Error - 19/11/2007 17:23:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The NTPort Library Driver service failed to start due to the following error 2
System - Warning - 19/11/2007 18:25:42 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID ACFE0A26-885E-4D4E-A611-C2938A49C7D6User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found runonceHKLMSoftwareMicrosoftWindowsCurrentVersionRunOnceExflagsAlert Type 807Detection Type (null)
System - Error - 19/11/2007 18:28:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Event Log Watch service failed to start due to the following error 3
System - Error - 19/11/2007 18:28:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The NTPort Library Driver service failed to start due to the following error 2
System - Error - 19/11/2007 19:27:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:09 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:10 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:11 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:12 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126


----------



## carrie_uk (Jul 7, 2004)

System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:14 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:15 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:16 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:58 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:27:59 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:01 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:02 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:03 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:04 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126


----------



## carrie_uk (Jul 7, 2004)

System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:05 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:07 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:28:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126


----------



## carrie_uk (Jul 7, 2004)

System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:39 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 19/11/2007 19:29:40 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Warning - 19/11/2007 19:38:57 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID 7E9CA2E3-1B0A-4DD8-BEAC-5C254DC88C5CUser MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found clsidHKLMSOFTWARECLASSESCLSIDCA8ACAFA-5FBB-467B-B348-90DD488DE003regkeyHKLMSOFTWARECLASSESTYPELIB209D651D-9AAE-47B4-AD74-16A8F03ACDDB10regkeyHKLMSOFTWARECLASSESCLSIDCA8ACAFA-5FBB-467B-B348-90DD488DE003regkeyHKLMSoftwareClassesshellexContextMenuHandlersCA8ACAFA-5FBB-467B-B348-90DD488DE003contextmenuHKLMSoftwareClassesshellexContextMenuHandlersCA8ACAFA-5FBB-467B-B348-90DD488DE003typelibversionHKLMSOFTWARECLASSESTYPELIB209D651D-9AAE-47B4-AD74-16A8F03ACDDB10fileCProgram FilesSUPERAntiSpywareSASCTXMNDLLAlert Type 807Detection Type (null)
System - Warning - 19/11/2007 19:39:01 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID FB5D8761-7269-4DFA-8A84-D67A8974E88BUser MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found driverSASDIFSVfileCProgram FilesSUPERAntiSpywareSASDIFSVSYSAlert Type 807Detection Type (null)
System - Warning - 19/11/2007 19:39:01 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID A2A89181-88E1-4CC9-B240-760FBB448453User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found driverSASKUTILfileCProgram FilesSUPERAntiSpywareSASKUTILsysAlert Type 807Detection Type (null)
System - Warning - 19/11/2007 19:39:02 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID 2EA14967-5073-443B-BC11-C5DD9EAEA196User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found driverSASENUMfileCProgram FilesSUPERAntiSpywareSASENUMSYSAlert Type 807Detection Type (null)
System - Warning - 19/11/2007 19:41:30 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID C9369824-35FD-4E89-BDE3-F984533B8B7AUser MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found regkeyHKCUS-1-5-21-2268760570-1984373704-3930355509-1006SoftwareMicrosoftWindowsCurrentVersionRunSUPERAntiSpywarerunkeyHKCUS-1-5-21-2268760570-1984373704-3930355509-1006SoftwareMicrosoftWindowsCurrentVersionRunSUPERAntiSpywarefileCProgram FilesSUPERAntiSpywareSUPERAntiSpywareexeAlert Type 807Detection Type (null)
System - Warning - 20/11/2007 07:40:52 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID 6AAF2925-806C-4A2B-8310-70AECCBC2978User MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found regkeyHKLMSoftwareMicrosoftWindowsCurrentVersionRunQuickTime TaskrunkeyHKLMSoftwareMicrosoftWindowsCurrentVersionRunQuickTime TaskfileCProgramsQuickTimeqttaskexeAlert Type 807Detection Type (null)
System - Warning - 20/11/2007 08:08:10 -> Computer Name = MARDENS - User Name = (blank) - Source = W32Time -> Description = The time service has not been able to synchronize the system timefor 49152 seconds because none of the time providers has been able toprovide a usable time stamp The system clock is unsynchronized
System - Error - 20/11/2007 10:51:34 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = DCOM -> Description = 
System - Warning - 20/11/2007 18:00:57 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Error - 20/11/2007 18:56:26 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:27 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:28 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:29 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:30 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:31 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:32 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126


----------



## carrie_uk (Jul 7, 2004)

System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:36 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 18:56:37 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Warning - 20/11/2007 19:00:30 -> Computer Name = MARDENS - User Name = (blank) - Source = WinDefend -> Description = 827 Real-Time Protection agent has detected changes Microsoft recommends you analyze the software that made these changes for potential risks You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer Allow changes only if you trust the program or the software publisher 827 cant undo changes that you allowFor more information please see the followinghttpgomicrosoftcomfwlinklinkid=74409Scan ID A500265B-8677-4E0F-9BAC-45FB57B91A6EUser MARDENSCarrieName UnknownID (null)Severity Not Yet ClassifiedCategory Not Yet ClassifiedPath Found iesearchHKLMSOFTWAREMicrosoftInternet ExplorerSearchSearchAssistantAlert Type 807Detection Type (null)
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:33 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:34 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:00:35 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:17 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:17 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:17 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:17 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:17 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:19 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:20 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:21 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:22 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:22 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:22 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:22 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126
System - Error - 20/11/2007 19:01:22 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Application Management service terminated with the following error 126


----------



## carrie_uk (Jul 7, 2004)

System - Warning - 22/11/2007 07:06:38 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Warning - 22/11/2007 16:03:08 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Warning - 22/11/2007 20:40:29 -> Computer Name = MARDENS - User Name = (blank) - Source = W32Time -> Description = The time service has not been able to synchronize the system timefor 49152 seconds because none of the time providers has been able toprovide a usable time stamp The system clock is unsynchronized
System - Warning - 22/11/2007 21:13:18 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Error - 23/11/2007 14:05:51 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Event Log Watch service failed to start due to the following error 3
System - Error - 23/11/2007 14:05:51 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The NTPort Library Driver service failed to start due to the following error 2
System - Error - 23/11/2007 14:09:35 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = DCOM -> Description = 
System - Warning - 23/11/2007 20:08:50 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Warning - 23/11/2007 22:00:06 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Error - 24/11/2007 08:06:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The Event Log Watch service failed to start due to the following error 3
System - Error - 24/11/2007 08:06:13 -> Computer Name = MARDENS - User Name = (blank) - Source = Service Control Manager -> Description = The NTPort Library Driver service failed to start due to the following error 2
System - Error - 24/11/2007 08:10:04 -> Computer Name = MARDENS - User Name = NT AUTHORITY\SYSTEM - Source = DCOM -> Description = 
System - Warning - 24/11/2007 08:18:00 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Warning - 24/11/2007 08:40:46 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Warning - 24/11/2007 17:15:44 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description = 
System - Warning - 24/11/2007 18:31:49 -> Computer Name = MARDENS - User Name = (blank) - Source = Tcpip -> Description =

[Files/Folders - Created Within 60 days]
fixwareout -> %SystemDrive%\fixwareout -> [Folder | Created Date = 19/11/2007 18:24:47 | Attr = ]
IPH.PH -> %SystemDrive%\IPH.PH -> [Ver = | Size = 1078 bytes | Created Date = 15/11/2007 14:26:34 | Attr = H ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Created Date = 19/11/2007 19:19:06 | Attr = ]
$NtUninstallKB933729$ -> %SystemRoot%\$NtUninstallKB933729$ -> [Folder | Created Date = 10/10/2007 06:29:44 | Attr = H ]
$NtUninstallKB941202$ -> %SystemRoot%\$NtUninstallKB941202$ -> [Folder | Created Date = 10/10/2007 06:25:59 | Attr = H ]
$NtUninstallKB943460$ -> %SystemRoot%\$NtUninstallKB943460$ -> [Folder | Created Date = 14/11/2007 07:50:01 | Attr = H ]
DiabUnin.dat -> %SystemRoot%\DiabUnin.dat -> [Ver = | Size = 5423 bytes | Created Date = 28/10/2007 18:12:16 | Attr = ]
DiabUnin.exe -> %SystemRoot%\DiabUnin.exe -> Blizzard Entertainment [Ver = 1, 0, 8, 0 | Size = 118784 bytes | Created Date = 28/10/2007 18:12:25 | Attr = ]
DiabUnin.pif -> %SystemRoot%\DiabUnin.pif -> [Ver = | Size = 2829 bytes | Created Date = 28/10/2007 18:12:25 | Attr = ]
FreedomInstallScript.log -> %SystemRoot%\FreedomInstallScript.log -> [Ver = | Size = 57223 bytes | Created Date = 04/10/2007 09:37:40 | Attr = ]
KB933729.log -> %SystemRoot%\KB933729.log -> [Ver = | Size = 14016 bytes | Created Date = 10/10/2007 06:29:41 | Attr = ]
KB939653-IE7.log -> %SystemRoot%\KB939653-IE7.log -> [Ver = | Size = 23483 bytes | Created Date = 10/10/2007 06:21:03 | Attr = ]
KB941202.log -> %SystemRoot%\KB941202.log -> [Ver = | Size = 10357 bytes | Created Date = 10/10/2007 06:20:54 | Attr = ]
KB943460.log -> %SystemRoot%\KB943460.log -> [Ver = | Size = 7133 bytes | Created Date = 14/11/2007 07:49:25 | Attr = ]
setupapi.log -> %SystemRoot%\setupapi.log -> [Ver = | Size = 15915 bytes | Created Date = 10/10/2007 06:26:15 | Attr = ]
awrdscdc.ax -> %System32%\awrdscdc.ax -> Audible, Inc. [Ver = 5, 1, 0, 1 | Size = 755320 bytes | Created Date = 03/11/2007 08:55:37 | Attr = ]
java.exe -> %System32%\java.exe -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 135168 bytes | Created Date = 19/11/2007 19:31:19 | Attr = ]
javacpl.cpl -> %System32%\javacpl.cpl -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 69632 bytes | Created Date = 19/11/2007 19:31:19 | Attr = ]
javaw.exe -> %System32%\javaw.exe -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 135168 bytes | Created Date = 19/11/2007 19:31:19 | Attr = ]
javaws.exe -> %System32%\javaws.exe -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 139264 bytes | Created Date = 19/11/2007 19:31:19 | Attr = ]
jupdate-1.6.0_03-b05.log -> %System32%\jupdate-1.6.0_03-b05.log -> [Ver = | Size = 5387 bytes | Created Date = 19/11/2007 19:31:02 | Attr = ]
QuickTime.qts -> %System32%\QuickTime.qts -> Apple Inc. [Ver = 7.3 | Size = 49152 bytes | Created Date = 14/11/2007 23:43:22 | Attr = ]
QuickTimeVR.qtx -> %System32%\QuickTimeVR.qtx -> Apple Inc. [Ver = 7.3 | Size = 65536 bytes | Created Date = 14/11/2007 23:43:22 | Attr = ]
ReWire.dll -> %System32%\ReWire.dll -> Propellerhead Software AB [Ver = 1.7 | Size = 368640 bytes | Created Date = 07/10/2007 20:33:25 | Attr = ]
REX Shared Library.dll -> %System32%\REX Shared Library.dll -> Propellerhead Software AB [Ver = 1.6 | Size = 233472 bytes | Created Date = 07/10/2007 20:33:25 | Attr = ]
rp_pkt32.sys -> %System32%\drivers\rp_pkt32.sys -> Radialpoint, Inc. [Ver = 6.0.0.0 | Size = 48384 bytes | Created Date = 04/10/2007 09:49:37 | Attr = ]
rp_skt32.sys -> %System32%\drivers\rp_skt32.sys -> Radialpoint, Inc. [Ver = 6.0.0.0 | Size = 55296 bytes | Created Date = 04/10/2007 09:49:50 | Attr = ]
AOL -> %AllUsersAppData%\AOL -> [Folder | Created Date = 15/11/2007 14:29:46 | Attr = ]
AOL Downloads -> %AllUsersAppData%\AOL Downloads -> [Folder | Created Date = 15/11/2007 14:26:42 | Attr = ]
AOL OCP -> %AllUsersAppData%\AOL OCP -> [Folder | Created Date = 15/11/2007 14:29:53 | Attr = ]
Avg7 -> %AllUsersAppData%\Avg7 -> [Folder | Created Date = 04/10/2007 09:58:03 | Attr = ]
Raxco -> %AllUsersAppData%\Raxco -> [Folder | Created Date = 04/10/2007 09:49:00 | Attr = ]
SUPERAntiSpyware.com -> %AllUsersAppData%\SUPERAntiSpyware.com -> [Folder | Created Date = 19/11/2007 19:38:58 | Attr = ]
Virgin Broadband -> %AllUsersAppData%\Virgin Broadband -> [Folder | Created Date = 04/10/2007 09:35:44 | Attr = ]
acccore -> %UserAppData%\acccore -> [Folder | Created Date = 15/11/2007 14:30:31 | Attr = ]
HouseCall 6.6 -> %UserAppData%\HouseCall 6.6 -> [Folder | Created Date = 17/11/2007 20:54:06 | Attr = ]
InstallShield -> %UserAppData%\InstallShield -> [Folder | Created Date = 04/10/2007 09:45:10 | Attr = ]
RipIt4Me -> %UserAppData%\RipIt4Me -> [Folder | Created Date = 21/10/2007 06:35:51 | Attr = ]
SUPERAntiSpyware.com -> %UserAppData%\SUPERAntiSpyware.com -> [Folder | Created Date = 19/11/2007 19:38:51 | Attr = ]
Virgin Broadband -> %UserAppData%\Virgin Broadband -> [Folder | Created Date = 04/10/2007 09:35:54 | Attr = ]
WinRAR -> %UserAppData%\WinRAR -> [Folder | Created Date = 01/11/2007 11:57:50 | Attr = ]
AOL OCP -> %LocalAppData%\AOL OCP -> [Folder | Created Date = 15/11/2007 14:29:37 | Attr = ]
Yahoo -> %LocalAppData%\Yahoo -> [Folder | Created Date = 10/11/2007 09:14:54 | Attr = ]
iTunes.lnk -> %AllUsersDesktop%\iTunes.lnk -> [Ver = | Size = 2117 bytes | Created Date = 19/11/2007 17:19:19 | Attr = ]
RipIt4Me.lnk -> %AllUsersDesktop%\RipIt4Me.lnk -> [Ver = | Size = 635 bytes | Created Date = 21/10/2007 06:36:54 | Attr = ]
00000564_001.jpg -> %UserDesktop%\00000564_001.jpg -> [Ver = | Size = 7958 bytes | Created Date = 17/10/2007 19:20:01 | Attr = ]
ATF-Cleaner.exe -> %UserDesktop%\ATF-Cleaner.exe -> Atribune.org [Ver = 3.00.0002 | Size = 50688 bytes | Created Date = 19/11/2007 19:33:20 | Attr = ]
@Alternate Data Stream - 26 bytes -> %UserDesktop%\ATF-Cleaner.exe:Zone.Identifier -> 
cockney slang.jpg -> %UserDesktop%\cockney slang.jpg -> [Ver = | Size = 212489 bytes | Created Date = 23/10/2007 13:46:15 | Attr = ]
LimeWire 4.14.10.lnk -> %UserDesktop%\LimeWire 4.14.10.lnk -> [Ver = | Size = 1525 bytes | Created Date = 04/10/2007 11:21:20 | Attr = ]
Untitled.stu -> %UserDesktop%\Untitled.stu -> [Ver = | Size = 30057 bytes | Created Date = 01/10/2007 10:24:30 | Attr = ]
WinPFind3u -> %UserDesktop%\WinPFind3u -> [Folder | Created Date = 23/11/2007 20:47:18 | Attr = ]
winpfind3u.exe -> %UserDesktop%\winpfind3u.exe -> [Ver = | Size = 404656 bytes | Created Date = 23/11/2007 20:46:47 | Attr = ]
@Alternate Data Stream - 26 bytes -> %UserDesktop%\winpfind3u.exe:Zone.Identifier -> 
AOL -> %CommonProgramFiles%\AOL -> [Folder | Created Date = 15/11/2007 14:28:50 | Attr = ]
Authentium -> %CommonProgramFiles%\Authentium -> [Folder | Created Date = 04/10/2007 09:49:20 | Attr = ]
Java -> %CommonProgramFiles%\Java -> [Folder | Created Date = 19/11/2007 19:30:38 | Attr = ]
Scanner -> %CommonProgramFiles%\Scanner -> [Folder | Created Date = 04/10/2007 09:48:47 | Attr = ]
Skype -> %CommonProgramFiles%\Skype -> [Folder | Created Date = 09/10/2007 13:35:54 | Attr = ]

[Files/Folders - Modified Within 30 days]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 18/11/2007 15:42:04 | Attr = ]
fixwareout -> %SystemDrive%\fixwareout -> [Folder | Modified Date = 19/11/2007 18:42:04 | Attr = ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 1073270784 bytes | Modified Date = 24/11/2007 08:05:48 | Attr = HS]
IPH.PH -> %SystemDrive%\IPH.PH -> [Ver = | Size = 1078 bytes | Modified Date = 15/11/2007 14:29:44 | Attr = H ]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 20/11/2007 17:53:36 | Attr = R ]
Programs -> %SystemDrive%\Programs -> [Folder | Modified Date = 03/11/2007 08:55:04 | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 24/11/2007 17:09:30 | Attr = HS]
System Volume Information -> %SystemDrive%\System Volume Information -> [Folder | Modified Date = 24/11/2007 09:54:48 | Attr = HS]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 23/11/2007 14:06:16 | Attr = ]
_OTMoveIt -> %SystemDrive%\_OTMoveIt -> [Folder | Modified Date = 19/11/2007 19:19:08 | Attr = ]
$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified Date = 14/11/2007 07:49:34 | Attr = H ]
$NtUninstallKB943460$ -> %SystemRoot%\$NtUninstallKB943460$ -> [Folder | Modified Date = 14/11/2007 07:50:04 | Attr = H ]
0.log -> %SystemRoot%\0.log -> [Ver = | Size = 0 bytes | Modified Date = 24/11/2007 08:06:34 | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 24/11/2007 08:05:50 | Attr = S]
comsetup.log -> %SystemRoot%\comsetup.log -> [Ver = | Size = 349119 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
DiabUnin.dat -> %SystemRoot%\DiabUnin.dat -> [Ver = | Size = 5423 bytes | Modified Date = 28/10/2007 18:14:08 | Attr = ]
DiabUnin.exe -> %SystemRoot%\DiabUnin.exe -> Blizzard Entertainment [Ver = 1, 0, 8, 0 | Size = 118784 bytes | Modified Date = 28/10/2007 18:12:26 | Attr = ]
DiabUnin.pif -> %SystemRoot%\DiabUnin.pif -> [Ver = | Size = 2829 bytes | Modified Date = 28/10/2007 18:12:26 | Attr = ]
DirectX.log -> %SystemRoot%\DirectX.log -> [Ver = | Size = 210748 bytes | Modified Date = 05/11/2007 18:48:48 | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 21/11/2007 16:59:14 | Attr = S]
FaxSetup.log -> %SystemRoot%\FaxSetup.log -> [Ver = | Size = 1228029 bytes | Modified Date = 14/11/2007 07:50:28 | Attr = ]
Help -> %SystemRoot%\Help -> [Folder | Modified Date = 15/11/2007 14:37:28 | Attr = ]
iis6.log -> %SystemRoot%\iis6.log -> [Ver = | Size = 190503 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
imsins.log -> %SystemRoot%\imsins.log -> [Ver = | Size = 1393 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 22/11/2007 17:36:16 | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 24/11/2007 17:09:28 | Attr = HS]
KB943460.log -> %SystemRoot%\KB943460.log -> [Ver = | Size = 7133 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
ModemLog_Creatix V.9X DSP Data Fax Modem.txt -> %SystemRoot%\ModemLog_Creatix V.9X DSP Data Fax Modem.txt -> [Ver = | Size = 4116 bytes | Modified Date = 24/11/2007 08:06:18 | Attr = ]
ModemLog_Standard 33600 bps Modem.txt -> %SystemRoot%\ModemLog_Standard 33600 bps Modem.txt -> [Ver = | Size = 1836 bytes | Modified Date = 24/11/2007 08:06:18 | Attr = ]
mozy.blk -> %SystemRoot%\mozy.blk -> [Ver = | Size = 4836 bytes | Modified Date = 23/11/2007 08:00:42 | Attr = ]
mozy.flt -> %SystemRoot%\mozy.flt -> [Ver = | Size = 5864 bytes | Modified Date = 23/11/2007 08:00:42 | Attr = ]
msgsocm.log -> %SystemRoot%\msgsocm.log -> [Ver = | Size = 61223 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [Ver = | Size = 335 bytes | Modified Date = 15/11/2007 14:28:44 | Attr = ]
ntdtcsetup.log -> %SystemRoot%\ntdtcsetup.log -> [Ver = | Size = 215853 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
ocgen.log -> %SystemRoot%\ocgen.log -> [Ver = | Size = 616616 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
ocmsn.log -> %SystemRoot%\ocmsn.log -> [Ver = | Size = 47601 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 24/11/2007 21:11:16 | Attr = ]
QTFont.qfn -> %SystemRoot%\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 24/11/2007 08:06:06 | Attr = H ]
Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 24/11/2007 11:50:36 | Attr = ]
SchedLgU.Txt -> %SystemRoot%\SchedLgU.Txt -> [Ver = | Size = 32578 bytes | Modified Date = 24/11/2007 01:52:08 | Attr = ]
setupapi.log -> %SystemRoot%\setupapi.log -> [Ver = | Size = 15915 bytes | Modified Date = 22/11/2007 17:36:22 | Attr = ]
SxsCaPendDel -> %SystemRoot%\SxsCaPendDel -> [Folder | Modified Date = 10/11/2007 09:09:48 | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 19/11/2007 19:31:20 | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 24/11/2007 08:08:56 | Attr = S]
Temp -> %SystemRoot%\Temp -> [Folder | Modified Date = 24/11/2007 21:01:06 | Attr = ]
tsoc.log -> %SystemRoot%\tsoc.log -> [Ver = | Size = 474962 bytes | Modified Date = 14/11/2007 07:50:30 | Attr = ]
updspapi.log -> %SystemRoot%\updspapi.log -> [Ver = | Size = 140882 bytes | Modified Date = 14/11/2007 07:50:12 | Attr = ]
wiadebug.log -> %SystemRoot%\wiadebug.log -> [Ver = | Size = 159 bytes | Modified Date = 24/11/2007 08:06:18 | Attr = ]
wiaservc.log -> %SystemRoot%\wiaservc.log -> [Ver = | Size = 50 bytes | Modified Date = 24/11/2007 08:06:12 | Attr = ]
WindowsUpdate.log -> %SystemRoot%\WindowsUpdate.log -> [Ver = | Size = 1056494 bytes | Modified Date = 24/11/2007 18:59:12 | Attr = ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 10/11/2007 08:54:48 | Attr = ]
wmsetup.log -> %SystemRoot%\wmsetup.log -> [Ver = | Size = 252245 bytes | Modified Date = 21/11/2007 13:37:14 | Attr = ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> [Ver = | Size = 284 bytes | Modified Date = 22/11/2007 23:39:04 | Attr = ]


----------



## carrie_uk (Jul 7, 2004)

MP Scheduled Scan.job -> %SystemRoot%\tasks\MP Scheduled Scan.job -> [Ver = | Size = 330 bytes | Modified Date = 24/11/2007 08:08:56 | Attr = H ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 24/11/2007 08:05:56 | Attr = H ]
awrdscdc.ax -> %System32%\awrdscdc.ax -> Audible, Inc. [Ver = 5, 1, 0, 1 | Size = 755320 bytes | Modified Date = 03/11/2007 08:55:38 | Attr = ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 24/11/2007 08:08:34 | Attr = ]
CmdLineExt03.dll -> %System32%\CmdLineExt03.dll -> [Ver = | Size = 43520 bytes | Modified Date = 28/10/2007 18:11:16 | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 14/11/2007 08:31:54 | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 22/11/2007 17:36:20 | Attr = ]
DRVSTORE -> %System32%\DRVSTORE -> [Folder | Modified Date = 19/11/2007 17:09:32 | Attr = ]
FxsTmp -> %System32%\FxsTmp -> [Folder | Modified Date = 24/11/2007 21:07:02 | Attr = ]
jupdate-1.6.0_03-b05.log -> %System32%\jupdate-1.6.0_03-b05.log -> [Ver = | Size = 5387 bytes | Modified Date = 19/11/2007 19:31:20 | Attr = ]
MRT.exe -> %System32%\MRT.exe -> Microsoft Corporation [Ver = 1.35.2294.0 | Size = 18238072 bytes | Modified Date = 02/11/2007 07:12:58 | Attr = ]
nvapps.xml -> %System32%\nvapps.xml -> [Ver = | Size = 88566 bytes | Modified Date = 24/11/2007 08:06:02 | Attr = ]
perfc009.dat -> %System32%\perfc009.dat -> [Ver = | Size = 80112 bytes | Modified Date = 28/10/2007 05:38:06 | Attr = ]
perfh009.dat -> %System32%\perfh009.dat -> [Ver = | Size = 446958 bytes | Modified Date = 28/10/2007 05:38:06 | Attr = ]
PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 536072 bytes | Modified Date = 28/10/2007 05:38:02 | Attr = ]
QuickTime.qts -> %System32%\QuickTime.qts -> Apple Inc. [Ver = 7.3 | Size = 49152 bytes | Modified Date = 14/11/2007 23:43:22 | Attr = ]
QuickTimeVR.qtx -> %System32%\QuickTimeVR.qtx -> Apple Inc. [Ver = 7.3 | Size = 65536 bytes | Modified Date = 14/11/2007 23:43:22 | Attr = ]
Restore -> %System32%\Restore -> [Folder | Modified Date = 24/11/2007 09:54:48 | Attr = ]
shell32.dll -> %System32%\shell32.dll -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 2206 bytes | Modified Date = 24/11/2007 08:07:12 | Attr = ]
xpsp3res.dll -> %System32%\xpsp3res.dll -> Microsoft Corporation [Ver = 5.1.2600.3243 (xpsp_sp2_qfe.071029-1244) | Size = 350720 bytes | Modified Date = 29/10/2007 10:04:04 | Attr = ]
shell32.dll -> %System32%\dllcache\shell32.dll -> Microsoft Corporation [Ver = 6.00.2900.3241 (xpsp_sp2_qfe.071025-1245) | Size = 8460288 bytes | Modified Date = 26/10/2007 03:34:02 | Attr = ]
usbaapl.sys -> %System32%\drivers\usbaapl.sys -> Apple, Inc. [Ver = 1, 25, 0, 0 | Size = 30464 bytes | Modified Date = 31/10/2007 14:09:14 | Attr = ]
AOL -> %AllUsersAppData%\AOL -> [Folder | Modified Date = 15/11/2007 14:29:48 | Attr = ]
AOL Downloads -> %AllUsersAppData%\AOL Downloads -> [Folder | Modified Date = 15/11/2007 14:28:44 | Attr = ]
AOL OCP -> %AllUsersAppData%\AOL OCP -> [Folder | Modified Date = 15/11/2007 14:29:54 | Attr = ]
LauncherAccess.dt -> %AllUsersAppData%\LauncherAccess.dt -> [Ver = | Size = 0 bytes | Modified Date = 21/11/2007 17:24:16 | Attr = ]
SUPERAntiSpyware.com -> %AllUsersAppData%\SUPERAntiSpyware.com -> [Folder | Modified Date = 19/11/2007 19:39:00 | Attr = ]
TEMP -> %AllUsersAppData%\TEMP -> [Folder | Modified Date = 09/11/2007 22:05:04 | Attr = ]
@Alternate Data Stream - 384 bytes -> %AllUsersAppData%\TEMP:05EE1EEF -> 
Viewpoint -> %AllUsersAppData%\Viewpoint -> [Folder | Modified Date = 15/11/2007 14:29:34 | Attr = ]
acccore -> %UserAppData%\acccore -> [Folder | Modified Date = 15/11/2007 14:30:32 | Attr = ]
HouseCall 6.6 -> %UserAppData%\HouseCall 6.6 -> [Folder | Modified Date = 18/11/2007 14:06:24 | Attr = ]
Lavasoft -> %UserAppData%\Lavasoft -> [Folder | Modified Date = 15/11/2007 15:47:26 | Attr = ]
Mozilla -> %UserAppData%\Mozilla -> [Folder | Modified Date = 15/11/2007 14:28:44 | Attr = ]
RipIt4Me -> %UserAppData%\RipIt4Me -> [Folder | Modified Date = 03/11/2007 13:53:42 | Attr = ]
Skype -> %UserAppData%\Skype -> [Folder | Modified Date = 24/11/2007 21:00:32 | Attr = ]
SUPERAntiSpyware.com -> %UserAppData%\SUPERAntiSpyware.com -> [Folder | Modified Date = 20/11/2007 19:01:18 | Attr = ]
teamspeak2 -> %UserAppData%\teamspeak2 -> [Folder | Modified Date = 23/11/2007 16:24:48 | Attr = ]
WinRAR -> %UserAppData%\WinRAR -> [Folder | Modified Date = 01/11/2007 11:57:52 | Attr = ]
Adobe -> %LocalAppData%\Adobe -> [Folder | Modified Date = 11/11/2007 08:15:12 | Attr = ]
AOL OCP -> %LocalAppData%\AOL OCP -> [Folder | Modified Date = 15/11/2007 14:29:38 | Attr = ]
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> %LocalAppData%\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [Ver = | Size = 126976 bytes | Modified Date = 19/11/2007 18:46:38 | Attr = ]
Google -> %LocalAppData%\Google -> [Folder | Modified Date = 16/11/2007 18:47:36 | Attr = ]
IconCache.db -> %LocalAppData%\IconCache.db -> [Ver = | Size = 2105380 bytes | Modified Date = 08/11/2007 23:36:00 | Attr = H ]
Yahoo -> %LocalAppData%\Yahoo -> [Folder | Modified Date = 10/11/2007 09:14:56 | Attr = ]
PCLECHAL.INI -> %AllUsersDocuments%\PCLECHAL.INI -> [Ver = | Size = 349 bytes | Modified Date = 09/11/2007 22:16:28 | Attr = ]
My Pictures -> %UserDocuments%\My Pictures -> [Folder | Modified Date = 16/11/2007 18:47:38 | Attr = R ]
My Sharing Folders.lnk -> %UserDocuments%\My Sharing Folders.lnk -> [Ver = | Size = 582 bytes | Modified Date = 23/11/2007 22:30:48 | Attr = ]
PB_Uploader.log -> %UserDocuments%\PB_Uploader.log -> [Ver = | Size = 27051170 bytes | Modified Date = 09/11/2007 15:25:22 | Attr = ]
iTunes.lnk -> %AllUsersDesktop%\iTunes.lnk -> [Ver = | Size = 2117 bytes | Modified Date = 19/11/2007 18:54:56 | Attr = ]
abbreviations.doc -> %UserDesktop%\abbreviations.doc -> [Ver = | Size = 92672 bytes | Modified Date = 09/11/2007 08:16:56 | Attr = ]
ATF-Cleaner.exe -> %UserDesktop%\ATF-Cleaner.exe -> Atribune.org [Ver = 3.00.0002 | Size = 50688 bytes | Modified Date = 19/11/2007 19:33:24 | Attr = ]
@Alternate Data Stream - 26 bytes -> %UserDesktop%\ATF-Cleaner.exe:Zone.Identifier -> 
Thumbs.db -> %UserDesktop%\Thumbs.db -> [Ver = | Size = 153088 bytes | Modified Date = 09/11/2007 14:01:10 | Attr = HS]
@Alternate Data Stream - 0 bytes -> %UserDesktop%\Thumbs.db:encryptable -> 
WinPFind3u -> %UserDesktop%\WinPFind3u -> [Folder | Modified Date = 24/11/2007 21:11:06 | Attr = ]
winpfind3u.exe -> %UserDesktop%\winpfind3u.exe -> [Ver = | Size = 404656 bytes | Modified Date = 23/11/2007 20:46:54 | Attr = ]
@Alternate Data Stream - 26 bytes -> %UserDesktop%\winpfind3u.exe:Zone.Identifier -> 
AOL -> %CommonProgramFiles%\AOL -> [Folder | Modified Date = 15/11/2007 14:28:52 | Attr = ]
Java -> %CommonProgramFiles%\Java -> [Folder | Modified Date = 19/11/2007 19:30:40 | Attr = ]
Microsoft Shared -> %CommonProgramFiles%\Microsoft Shared -> [Folder | Modified Date = 15/11/2007 14:37:06 | Attr = ]
Symantec Shared -> %CommonProgramFiles%\Symantec Shared -> [Folder | Modified Date = 04/11/2007 07:38:40 | Attr = ]
Wise Installation Wizard -> %CommonProgramFiles%\Wise Installation Wizard -> [Folder | Modified Date = 20/11/2007 19:01:18 | Attr = ]

[File String Scan - All]
aspack , -> %System32%\d3dx9_25.dll -> Microsoft Corporation [Ver = 9.06.168.0000 | Size = 2337488 bytes | Modified Date = 18/03/2005 16:19:58 | Attr = ]
aspack , -> %System32%\d3dx9_30.dll -> Microsoft Corporation [Ver = 9.12.589.0000 | Size = 2388176 bytes | Modified Date = 31/03/2006 12:40:58 | Attr = ]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
PEC2 , PECompact2 , -> %System32%\DivX.dll -> DivX, Inc. [Ver = 6.6.1.4 | Size = 740442 bytes | Modified Date = 26/07/2007 02:50:22 | Attr = ]
Thawte Consulting , USERTRUST , -> %System32%\initpki.dll -> Microsoft Corporation [Ver = 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 147456 bytes | Modified Date = 04/08/2004 07:56:42 | Attr = ]
aspack , -> %System32%\jesterss.dll -> [Ver = | Size = 23552 bytes | Modified Date = 03/07/2003 14:48:02 | Attr = ]
PTech , -> %System32%\LegitCheckControl.dll -> Microsoft Corporation [Ver = 1.7.0018.5 | Size = 1476992 bytes | Modified Date = 15/03/2007 18:19:28 | Attr = ]
PECompact2 , aspack , -> %System32%\MRT.exe -> Microsoft Corporation [Ver = 1.35.2294.0 | Size = 18238072 bytes | Modified Date = 02/11/2007 07:12:58 | Attr = ]
WSUD , -> %System32%\ntbackup.exe -> Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 1135616 bytes | Modified Date = 18/08/2001 06:36:52 | Attr = ]
aspack , -> %System32%\ntdll.dll -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 708096 bytes | Modified Date = 04/08/2004 07:56:36 | Attr = ]
WSUD , -> %System32%\nusrmgr.cpl -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 257024 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
Umonitor , -> %System32%\rasdlg.dll -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 657920 bytes | Modified Date = 04/08/2004 07:56:44 | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 29/08/2002 12:00:00 | Attr = ]
PTech , -> %System32%\WgaTray.exe -> Microsoft Corporation [Ver = 1.7.0018.5 | Size = 336768 bytes | Modified Date = 15/03/2007 18:17:08 | Attr = ]
PEC2 , WSUD , -> %System32%\wmploc.dll -> Microsoft Corporation [Ver = 11.0.5721.5145 (WMP_11.061018-2006) | Size = 8231936 bytes | Modified Date = 18/10/2006 21:47:20 | Attr = ]
aspack , -> %System32%\dllcache\ntdll.dll -> Microsoft Corporation [Ver = 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Size = 708096 bytes | Modified Date = 04/08/2004 07:56:36 | Attr = ]
WSUD , -> %System32%\dllcache\nusrmgr.cpl -> Microsoft Corporation [Ver = 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Size = 257024 bytes | Modified Date = 04/08/2004 07:56:58 | Attr = ]
PTech , -> %System32%\dllcache\WgaTray.exe -> Microsoft Corporation [Ver = 1.7.0018.5 | Size = 336768 bytes | Modified Date = 15/03/2007 18:17:08 | Attr = ]
PEC2 , WSUD , -> %System32%\dllcache\wmploc.dll -> Microsoft Corporation [Ver = 11.0.5721.5145 (WMP_11.061018-2006) | Size = 8231936 bytes | Modified Date = 18/10/2006 21:47:20 | Attr = ]
aspack , -> %System32%\drivers\Css-Dvp.sys -> Authentium, Inc. [Ver = 4.94.107.403 | Size = 839880 bytes | Modified Date = 04/04/2007 16:15:02 | Attr = ]
PTech , -> %System32%\drivers\mtlstrm.sys -> Smart Link [Ver = 3.80.01MC15 | Size = 1309184 bytes | Modified Date = 04/08/2004 05:41:38 | Attr = ]
@Alternate Data Stream - 384 bytes -> %AllUsersAppData%\TEMP:05EE1EEF -> 
@Alternate Data Stream - 26 bytes -> %UserDesktop%\ATF-Cleaner.exe:Zone.Identifier -> 
UPX! , UPX0 , -> %UserDesktop%\ATF-Cleaner.exe -> Atribune.org [Ver = 3.00.0002 | Size = 50688 bytes | Modified Date = 19/11/2007 19:33:24 | Attr = ]
@Alternate Data Stream - 0 bytes -> %UserDesktop%\Thumbs.db:encryptable -> 
@Alternate Data Stream - 26 bytes -> %UserDesktop%\WiiDrumsInstall.zip:Zone.Identifier -> 
@Alternate Data Stream - 26 bytes -> %UserDesktop%\winpfind3u.exe:Zone.Identifier ->

< End of report >


----------



## cybertech (Apr 16, 2002)

The *P2P programs* you have installed expose you to risks because of the nature of the P2P file sharing process. File sharing/P2P programs rely on members giving and gaining unrestricted access to computers across the P2P network. This practice can make you vulnerable to data and identity theft. It also exposes you to very malicious worms and trojans. You change those risky default settings to a safer configuration but the act of downloading files from an anonymous source greatly increases your exposure to infection.

*I suggest you go to add/remove programs and remove all P2P programs!*


----------



## cybertech (Apr 16, 2002)

Ewido version 4 is now obsolete. If you purchased Ewido, you can get a free upgrade to AVG Antispyware version 7.5. Otherwise, un-install ewido version 4.

Please *download* the *OTMoveIt by OldTimer*.

 *Save* it to your *desktop*.
 Please double-click *OTMoveIt.exe* to run it.
*Copy the file paths below to the clipboard* by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose copy):



> *c:\windows\System32\jesterss.dll*



 Return to OTMoveIt, right click on the *"Paste List of Files/Folders to be moved"* window and choose *Paste*.
Click the red *Moveit!* button.
Close *OTMoveIt*
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose *Yes.*


----------

