************************************************************************************
ISeeYouXP v2.0 Beta 14
ISeeYouXP v1.3.0-v2.0 Beta 14 Copyright - ShadowPuterDude
ISeeYouXP v1.2.9 and earlier Copyright - PhilliePhan
------------------------------------------------------------------------------------
**** PLEASE NOTE THAT MOST (if not ALL) OF THE ITEMS BELOW ARE NOT BADDIES! ****
**** PLEASE CONSULT A KNOWLEDGEABLE PERSON BEFORE TAKING ANY ACTION. ****
************************************************************************************
Windows/Browser/Java Versions:
Microsoft (R) Windows Script Host Verso 5.6
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Microsoft (R) Windows Script Host Verso 5.6
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Microsoft (R) Windows Script Host Verso 5.6
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Scan done at 16:50:12,23, dom 16/11/2008
------------------------------------------------------------------------------------
ISeeYouXP installation folder and files
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
------------------------------------------------------------------------------------
System Environment Variables
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Admin\Dados de aplicativos
CLIENTNAME=Console
CommonProgramFiles=C:\Arquivos de programas\Arquivos comuns
COMPUTERNAME=ADMINISTRADOR
ComSpec=C:\WINDOWS\system32\cmd.exe
errcode=0
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Admin
LOGONSERVER=\\ADMINISTRADOR
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0409
ProgramFiles=C:\Arquivos de programas
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Admin\CONFIG~1\Temp
TMP=C:\DOCUME~1\Admin\CONFIG~1\Temp
USERDOMAIN=ADMINISTRADOR
USERNAME=Admin
USERPROFILE=C:\Documents and Settings\Admin
windir=C:\WINDOWS
------------------------------------------------------------------------------------
Showing any Pocket Killbox backup files
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
------------------------------------------------------------------------------------
Displaying BOOT.INI:
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
------------------------------------------------------------------------------------
Displaying SYSTEM.INI:
; for 16-bit app support
[drivers]
wave=mmdrv.dll
timer=timer.drv
[mci]
[mcidrv32]
VideoVer=425734
hr=11
dr=24
[driver32]
[386enh]
woafont=app850.FON
EGA80WOA.FON=EGA80850.FON
EGA40WOA.FON=EGA40850.FON
CGA80WOA.FON=CGA80850.FON
CGA40WOA.FON=CGA40850.FON
FileSysChange=off
------------------------------------------------------------------------------------
Displaying WIN.INI:
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo
asx=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo
wm=MPEGVideo
wma=MPEGVideo
wmv=MPEGVideo
wmx=MPEGVideo
wpl=MPEGVideo
wvx=MPEGVideo
[annie]
CaptureFile=D:\Documents and Settings\Raul soares\Meus documentos\Meus Videos\-pica pau - pica pau einsten-.avi
VideoDevice2=@device:pnp:\\?\usb#vid_0c45&pid_608f&mi_00#6&355dea8&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\global
AudioDevice2=
FrameRate=667111
UseFrameRate=1
CaptureAudio=0
CaptureCC=0
WantPreview=1
MasterStream=1
UseTimeLimit=0
TimeLimit=0
[MSUCE]
Advanced=1
CodePage=Unicode
Font=Arial
------------------------------------------------------------------------------------
Displaying AUTOEXEC.BAT:
------------------------------------------------------------------------------------
Displaying CONFIG.SYS:
------------------------------------------------------------------------------------
Displaying Running Processes:
PROCESS PID PRIO PATH
smss.exe 576 Normal C:\WINDOWS\System32\smss.exe
csrss.exe 652 Normal C:\WINDOWS\system32\csrss.exe
winlogon.exe 676 High C:\WINDOWS\system32\winlogon.exe
services.exe 720 Normal C:\WINDOWS\system32\services.exe
lsass.exe 732 Normal C:\WINDOWS\system32\lsass.exe
svchost.exe 880 Normal C:\WINDOWS\system32\svchost.exe
svchost.exe 944 Normal C:\WINDOWS\system32\svchost.exe
svchost.exe 980 Normal C:\WINDOWS\System32\svchost.exe
svchost.exe 1028 Normal C:\WINDOWS\system32\svchost.exe
svchost.exe 1144 Normal C:\WINDOWS\system32\svchost.exe
aston.exe 1460 Normal D:\ARQUIV~1\Aston\aston.exe
spoolsv.exe 1496 Normal C:\WINDOWS\system32\spoolsv.exe
svchost.exe 1732 Normal C:\WINDOWS\system32\svchost.exe
wdfmgr.exe 1772 Normal C:\WINDOWS\system32\wdfmgr.exe
ctfmon.exe 772 Normal C:\WINDOWS\system32\ctfmon.exe
firefox.exe 856 Normal C:\Arquivos de programas\Mozilla Firefox\firefox.exe
stinger.exe 1056 Normal C:\Documents and Settings\Admin\Desktop\stinger.exe
cmd.exe 3544 Normal C:\WINDOWS\system32\cmd.exe
ntvdm.exe 4020 Normal C:\WINDOWS\system32\ntvdm.exe
pv.exe 3776 Normal C:\ISeeYouXP\pv.exe
------------------------------------------------------------------------------------
Displaying Windows Services:
Microsoft (R) Windows Script Host Verso 5.6
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
------------------------------------------------------------------------------------
Displaying LOG for Microsoft Windows Malicious Software Removal Tool:
*** Microsoft Windows MRT Log NOT Found! ****
----------------------------------------------------------------------------
Listing HKCU Explorer\Advanced//Hidden and SuperHidden Registry Keys
if Hidden = 0 then Hidden Files and Folders are not shown
if SuperHidden = 1 is the desired default value.
if ShowSuperHidden = 0 then System Files are not shown
if HideFileExt = 1 then File Extension are not shown
We want their values to be (from top to bottom) 1,1,1,0
----------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced
Hidden REG_DWORD 1 (0x1)
SuperHidden REG_DWORD 1 (0x1)
HideFileExt REG_DWORD 0 (0x0)
************************************************************************************
Examining Select Windows Registry Keys
------------------------------------------------------------------------------------
--------------------------------------------------------------------------
Items Found in ZoneMap\Domains:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains
<NO NAME> REG_SZ
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains\msn.com
----------------------------------------------------------------------------
Current User ZoneMap ProtocolDefaults
----------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\protocoldefaults
<NO NAME> REG_SZ
http REG_DWORD 3 (0x3)
https REG_DWORD 3 (0x3)
ftp REG_DWORD 3 (0x3)
file REG_DWORD 3 (0x3)
@ivt REG_DWORD 1 (0x1)
shell REG_DWORD 0 (0x0)
----------------------------------------------------------------------------
Default URL Prefix Keys
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\DefaultPrefix
<NO NAME> REG_SZ http://
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\Prefixes
ftp REG_SZ ftp://
gopher REG_SZ gopher://
home REG_SZ http://
mosaic REG_SZ http://
www REG_SZ http://
--------------------------------------------------------------------------
Startup Items Disabled via MSCONFIG:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk
backup REG_SZ C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
location REG_SZ Common Startup
item REG_SZ Adobe Reader Speed Launch
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Ralink Wireless Utility.lnk
backup REG_SZ C:\WINDOWS\pss\Ralink Wireless Utility.lnkCommon Startup
location REG_SZ Common Startup
command REG_SZ C:\ARQUIV~1\RALINK\Common\RaUI.exe -s
item REG_SZ Ralink Wireless Utility
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item REG_SZ msmsgs
hkey REG_SZ HKCU
command REG_SZ "C:\Arquivos de programas\Messenger\msmsgs.exe" /background
inimapping REG_SZ 0
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer
key REG_SZ SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item REG_SZ TeaTimer
hkey REG_SZ HKCU
inimapping REG_SZ 0
command REG_SZ C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\state
system.ini REG_DWORD 0 (0x0)
win.ini REG_DWORD 0 (0x0)
bootini REG_DWORD 0 (0x0)
services REG_DWORD 0 (0x0)
startup REG_DWORD 2 (0x2)
--------------------------------------------------------------------------
Select AutoRun Registry Keys:
--------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonceex
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce
HKEY_USERS\.default\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce
HKEY_USERS\s-1-5-19\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
HKEY_USERS\s-1-5-20\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
--------------------------------------------------------------------------
WinLogon Notify Registry Key:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain
Asynchronous REG_DWORD 0 (0x0)
Impersonate REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ crypt32.dll
Logoff REG_SZ ChainWlxLogoffEvent
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet
Asynchronous REG_DWORD 0 (0x0)
Impersonate REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ cryptnet.dll
Logoff REG_SZ CryptnetWlxLogoffEvent
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll
DLLName REG_SZ cscdll.dll
Logon REG_SZ WinlogonLogonEvent
Logoff REG_SZ WinlogonLogoffEvent
ScreenSaver REG_SZ WinlogonScreenSaverEvent
Startup REG_SZ WinlogonStartupEvent
Shutdown REG_SZ WinlogonShutdownEvent
StartShell REG_SZ WinlogonStartShellEvent
Impersonate REG_DWORD 0 (0x0)
Asynchronous REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy
Asynchronous REG_DWORD 1 (0x1)
DllName REG_EXPAND_SZ %SystemRoot%\System32\dimsntfy.dll
Startup REG_SZ WlDimsStartup
Shutdown REG_SZ WlDimsShutdown
Logon REG_SZ WlDimsLogon
Logoff REG_SZ WlDimsLogoff
StartShell REG_SZ WlDimsStartShell
Lock REG_SZ WlDimsLock
Unlock REG_SZ WlDimsUnlock
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp
DLLName REG_SZ wlnotify.dll
Logon REG_SZ SCardStartCertProp
Logoff REG_SZ SCardStopCertProp
Lock REG_SZ SCardSuspendCertProp
Unlock REG_SZ SCardResumeCertProp
Enabled REG_DWORD 1 (0x1)
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule
Asynchronous REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ wlnotify.dll
Impersonate REG_DWORD 0 (0x0)
StartShell REG_SZ SchedStartShell
Logoff REG_SZ SchedEventLogOff
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy
Logoff REG_SZ WLEventLogoff
Impersonate REG_DWORD 0 (0x0)
Asynchronous REG_DWORD 1 (0x1)
DllName REG_EXPAND_SZ sclgntfy.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn
DLLName REG_SZ WlNotify.dll
Lock REG_SZ SensLockEvent
Logon REG_SZ SensLogonEvent
Logoff REG_SZ SensLogoffEvent
Safe REG_DWORD 1 (0x1)
MaxWait REG_DWORD 600 (0x258)
StartScreenSaver REG_SZ SensStartScreenSaverEvent
StopScreenSaver REG_SZ SensStopScreenSaverEvent
Startup REG_SZ SensStartupEvent
Shutdown REG_SZ SensShutdownEvent
StartShell REG_SZ SensStartShellEvent
PostShell REG_SZ SensPostShellEvent
Disconnect REG_SZ SensDisconnectEvent
Reconnect REG_SZ SensReconnectEvent
Unlock REG_SZ SensUnlockEvent
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv
Asynchronous REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ wlnotify.dll
Impersonate REG_DWORD 0 (0x0)
Logoff REG_SZ TSEventLogoff
Logon REG_SZ TSEventLogon
PostShell REG_SZ TSEventPostShell
Shutdown REG_SZ TSEventShutdown
StartShell REG_SZ TSEventStartShell
Startup REG_SZ TSEventStartup
MaxWait REG_DWORD 600 (0x258)
Reconnect REG_SZ TSEventReconnect
Disconnect REG_SZ TSEventDisconnect
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon
Logon REG_SZ WLEventLogon
Logoff REG_SZ WLEventLogoff
Startup REG_SZ WLEventStartup
Shutdown REG_SZ WLEventShutdown
StartScreenSaver REG_SZ WLEventStartScreenSaver
StopScreenSaver REG_SZ WLEventStopScreenSaver
Lock REG_SZ WLEventLock
Unlock REG_SZ WLEventUnlock
StartShell REG_SZ WLEventStartShell
PostShell REG_SZ WLEventPostShell
Disconnect REG_SZ WLEventDisconnect
Reconnect REG_SZ WLEventReconnect
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 0 (0x0)
SafeMode REG_DWORD 1 (0x1)
MaxWait REG_DWORD -1 (0xffffffff)
DllName REG_EXPAND_SZ WgaLogon.dll
Event REG_DWORD 0 (0x0)
InstallEvent REG_SZ 1.8.0031.9
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings
<NO NAME> REG_SZ
Data REG_BINARY 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000275a7110db94e5469b3ac456ac7d2ea304000000040000005300000003660000a800000010000000c036f01f361eb6df795bbd074e572d6f0000000004800000a000000010000000ea73b79450911b6ea5cd67bff9342b8e30020000c4bd4bf4771c2272b8e37989b46ba21e7267928fcf6765fda61e8564d375c41a89382faee84e9bb4571ef763ac1c3e4a405717ff90153481871f05b3e390c4d6a917649ebefcf34171b0729c8f8ca048ec282df5a6ce37a823f5534548a74c77f108bb1aa363c9523e5b3e30d0dfdd7e2ceb7cfe841a2b4dc02fdc654388d8f6de3ee6402534464b0bffc7722cd4323e08d4adccfd25013aa273c21845e7e5715af7fe3388a92b329983c32ce47414cdb027b534d280969f1b72a4d07448c1c2583e526558f662ee16387f837500ec639fbaed33d909303a6347ea9e7b71d2972db52b86b002a21f1dde4372bd2e82e4008d099b82265639aea6c1eed5d5877c62f27ee04a30bf20d427b59dd26c159df6f05dcf23f120283fc2e99a24645313040e084a5dd90098884094857759ee39480fd993ec55e73c7f696f35734f73a810cf46cf096221d81603665da08f4b198fe3208d8d3768d9591456527bc3bcf8abcf2c9be8b7ad5f2d11707b7ce9732c70f83d725dc6cf3f2c7118f59188bc4163bf85cf5f55e39f3311e242223a5807c91d78fa858753b3f3040cfcf7594ed7cd888b807056a5b060989a7e3fd02b6f026c67ab0cb6398178e6ba364e6b0dcc9abe39360e27bb3e1693f770f14eb873fdcffd0d81e11d26613a2b9e084c76dfd6ec4b540be0c7600942d67387cb6057ec4dc4adfe281ae063387d50cf67dde4bf9713875984a44b6a6bcdaca0d80d86a15a28347f7be5cb644393f4cbaaf97589c17e64f2381ceafe2e7a60362bf0ee14000000e12379eb0bd627f3ed3b3188882d2485c5edbf0f
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon
DLLName REG_SZ wlnotify.dll
Logon REG_SZ RegisterTicketExpiredNotificationEvent
Logoff REG_SZ UnregisterTicketExpiredNotificationEvent
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 1 (0x1)
--------------------------------------------------------------------------
Shared Task Scheduler Registry Items:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler
{438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Pr-carregador Browseui
{8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Daemon de cache de categorias de componente
--------------------------------------------------------------------------
Scheduled Tasks:
--------------------------------------------------------------------------
O volume na unidade C no tem nome.
O nmero de srie do volume 109F-D523
Pasta de C:\WINDOWS\tasks
15/11/2008 15:55 <DIR> .
15/11/2008 15:55 <DIR> ..
28/10/2001 10:07 65 desktop.ini
16/11/2008 13:44 328 GlaryInitialize.job
16/11/2008 13:44 6 SA.DAT
3 arquivo(s) 399 bytes
Total de arquivos na lista:
3 arquivo(s) 399 bytes
2 pasta(s) 9.359.753.216 bytes disponveis
HR C:\WINDOWS\tasks\desktop.ini
A C:\WINDOWS\tasks\GlaryInitialize.job
A H C:\WINDOWS\tasks\SA.DAT
----------------------------------------------------------------------------
ShellExecuteHooks Registry Keys
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
----------------------------------------------------------------------------
ShellServiceObjectDelayLoad Registry Keys
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
PostBootReminder REG_SZ {7849596a-48ea-486e-8937-a2a3009f31a9}
CDBurn REG_SZ {fbeb8a05-beee-4442-804e-409d6c4515e9}
WebCheck REG_SZ {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
SysTray REG_SZ {35CEC8A3-2BE6-11D2-8773-92E220524153}
----------------------------------------------------------------------------
ModuleUsage Registry Keys:
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
----------------------------------------------------------------------------
BHO Registry Keys:
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}
<NO NAME> REG_SZ
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}
--------------------------------------------------------------------------
Select Policy Keys:
--------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer
LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0)
NoBandCustomize REG_DWORD 0 (0x0)
NoMovingBands REG_DWORD 0 (0x0)
NoCloseDragDropBands REG_DWORD 0 (0x0)
NoSetTaskbar REG_DWORD 0 (0x0)
NoToolbarsOnTaskbar REG_DWORD 0 (0x0)
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system
HideLegacyLogonScripts REG_DWORD 0 (0x0)
HideLogoffScripts REG_DWORD 0 (0x0)
HideStartupScripts REG_DWORD 0 (0x0)
RunLogonScriptSync REG_DWORD 1 (0x1)
RunStartupScriptSync REG_DWORD 0 (0x0)
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\Shell
HKEY_CURRENT_USER\software\policies\microsoft\internet explorer
HKEY_CURRENT_USER\software\policies\microsoft\internet explorer\Control Panel
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer
LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0)
NoResolveSearch REG_DWORD 1 (0x1)
NoDriveTypeAutoRun REG_DWORD 227 (0xe3)
NoDrives REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
DisableRegistryTools REG_DWORD 0 (0x0)
HideLegacyLogonScripts REG_DWORD 0 (0x0)
HideLogoffScripts REG_DWORD 0 (0x0)
RunLogonScriptSync REG_DWORD 1 (0x1)
RunStartupScriptSync REG_DWORD 0 (0x0)
HideStartupScripts REG_DWORD 0 (0x0)
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\Explorer
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system
************************************************************************************
Checking File System for suspicious Files
--------------------------------------------------------------------------
Items in the Root Directory:
--------------------------------------------------------------------------
Locating all files created in C:\
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Locating all Backup files on C:
--------------------------------------------------------------------------
Locating all *.BAK* files
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Locating all copies of Internet Explorer on C:
--------------------------------------------------------------------------
Locating all copies of Internet Explorer
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Locating all copies of beep.sy_ on C:
--------------------------------------------------------------------------
Locating all copies of Internet Explorer
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Locating all copies of beep.sys on C:
--------------------------------------------------------------------------
Locating all copies of Internet Explorer
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Locating all copies of Windows Explorer on C:
--------------------------------------------------------------------------
Locating all copies of Windows Explorer
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Items in Document and Settings:
--------------------------------------------------------------------------
Listing contents of C:\Documents and Settings
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Desktop Items:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\Admin\Desktop within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Documents and Settings\All Users\Desktop\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Start Menu Items:
--------------------------------------------------------------------------
Locating all files created inC:\Documents and Settings\Admin\Start Menu within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Documents and Settings\Admin\Start Menu\Programs\Startup within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Documents and Settings\All Users\Start Menu within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Application Data Items:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\Admin\Application Data\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Documents and Settings\Admin\Local Settings\Application Data\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Documents and Settings\All Users\Application Data\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\Documents and Settings\Admin\Local Settings\TEMP:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\Admin\Local Settings\TEMP within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Items in Templates Folder:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\Admin\Templates
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Items in Program Files:
--------------------------------------------------------------------------
Locating all files created in C:\Arquivos de programas\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Arquivos de programas\Arquivos comuns\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
Locating all files created in C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
Items in the Windows Directory:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\Downloaded Program Files:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\Downloaded Program Files\ within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries:
--------------------------------------------------------------------------
Locating all files in C:\WINDOWS\PCHealth\HelpCtr\Binaries
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\system:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\system32:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32 within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\system32\com:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\com within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\system32\components:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\components within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\system32\drivers:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\drivers within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\system32\drivers\etc:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\drivers\etc within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
--------------------------------------------------------------------------
C:\WINDOWS\TEMP:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\TEMP within the last 90 days.
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
************************************************************************************
Checking for .COM files to Delete. They will only print if deleted!
Locating .COM files in the C:\WINDOWS\System32 folder
No foi possvel executar C:\ISEEYOUXP\LOCATE.COM
************************************************************************************
Miscellaneous Malware Detections:
------------------------------------------------------------------------------------
**** Delfin Media {31EE3286-D785-4E3F-95FC-51D00FDABC01} NOT FOUND by this tool! ****
**** SmitFraud {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! ****
**** SpywareStrike {C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D} NOT FOUND by this tool! ****
**** SpywareStrike {C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C} NOT FOUND by this tool! ****
**** SpywareStrike {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} NOT FOUND by this tool! ****
**** SpyAxe {A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! ****
**** SpyFalcon {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! ****
**** SpyFalcon {C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D} NOT FOUND by this tool! ****
**** SpyFalcon {CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E} NOT FOUND by this tool! ****
**** SpyFalcon {35a88e51-b53d-43e9-b8a7-75d4c31b4676} NOT FOUND by this tool! ****
**** SpyFalcon {64ba30a2-811a-4597-b0af-d551128be340} NOT FOUND by this tool! ****
**** SpyFalcon {89aef01d-d237-49c7-84dc-4e1904c1fd31} NOT FOUND by this tool! ****
**** SpyFalcon {e04408db-4812-4478-8d4d-e46edcffd3b6} NOT FOUND by this tool! ****
**** SpyFalcon {336ec37f-54bf-4f13-8237-03f64fa591e7} NOT FOUND by this tool! ****
**** SpyFalcon {5bc82bdb-bc03-4671-9a78-3ef2b68449de} NOT FOUND by this tool! ****
**** SpyFalcon {24c60b9b-26b5-4201-9f7a-fb9219356ae9} NOT FOUND by this tool! ****
**** SpyFalcon {a0c51615-738a-4542-801a-5af61614e182} NOT FOUND by this tool! ****
**** SpyFalcon {70fbd528-2d3c-4a00-9b8c-bbf441e534be} NOT FOUND by this tool! ****
**** SpyFalcon {a566f298-05a6-4b3d-b672-da7c27316430} NOT FOUND by this tool! ****
**** SpyFalcon {f5947202-e9cb-4a72-88e7-22f2cbd2b124} NOT FOUND by this tool! ****
**** SpyFalcon {5aaf6542-f4ba-4df4-873d-4902ecbe794c} NOT FOUND by this tool! ****
**** SpyFalcon {3e4155b8-5a4a-4e95-83b2-ab032da9acbc} NOT FOUND by this tool! ****
**** SpyFalcon {9952355f-fefb-4764-bcd7-a993d03dd7e2} NOT FOUND by this tool! ****
**** SpyFalcon {55059d4f-a1ac-4837-ae07-4859101f598d} NOT FOUND by this tool! ****
**** SpyFalcon {c3786a8d-6426-4c29-a23f-f36e47b31e0c} NOT FOUND by this tool! ****
**** SpyLocked {25b7d2fd-4f71-46d1-801a-7de323e4ec82} NOT FOUND by this tool! ****
**** SpyLocked {4233AC08-A2C4-4742-A0B4-83719613D62C} NOT FOUND by this tool! ****
**** SpyLocked {716002DB-288C-4BF0-80CD-A467E78D8B55} NOT FOUND by this tool! ****
**** SpyLocked {735E980D-45D2-4777-AF82-9923D3C8D3AE} NOT FOUND by this tool! ****
**** SpyLocked {B23DC537-3E13-44C7-BF67-D8405EB377F7} NOT FOUND by this tool! ****
**** SpyLocked {B292EC9F-A074-4115-8342-1F459702D8D2} NOT FOUND by this tool! ****
**** SpyLocked {CECA6F2B-247B-4ECE-9B7A-D0135C8036FC} NOT FOUND by this tool! ****
**** SpyLocked {DA3B49F6-8C54-4429-A275-21A86DCCA413} NOT FOUND by this tool! ****
**** SpyLocked {EDE8BED5-92CF-4482-8F51-A01CD9B3EA37} NOT FOUND by this tool! ****
**** SpyLocked {FA4FBF53-C766-4622-8011-A87A805EEBF0} NOT FOUND by this tool! ****
**** SpywareLocked {0E4E5110-A772-4C4A-A7DC-137FE10ABD6E} NOT FOUND by this tool! ****
**** SpywareLocked {07A582E8-BAE3-457D-9D29-2048DE45A369} NOT FOUND by this tool! ****
**** SpywareLocked {3BAA1AD8-EE49-4772-BF0B-F55083E0F7AA} NOT FOUND by this tool! ****
**** SpywareLocked {9D6FAC42-A7BE-4702-87EF-75D8DC14249E} NOT FOUND by this tool! ****
**** SpywareLocked {ABEF791F-947E-4CDF-83C3-E72A240AFB67} NOT FOUND by this tool! ****
**** SpywareLocked {BD0FC212-0A36-4232-83CC-2063FB9282E0} NOT FOUND by this tool! ****
**** SpywareLocked {B0DED443-5E68-4001-A81B-0A0001621AB8} NOT FOUND by this tool! ****
**** SpywareLocked {F38B1B2B-4976-46DD-9FE5-60FDE72F0B4D} NOT FOUND by this tool! ****
**** SpywareQuake {0c7416f0-dd23-420f-97f5-aae352ea2bf1} NOT FOUND by this tool! ****
**** SpywareQuake {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} NOT FOUND by this tool! ****
**** SpywareQuake {AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E} NOT FOUND by this tool! ****
**** SpywareQuake {CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A} NOT FOUND by this tool! ****
**** SpywareQuake {EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E} NOT FOUND by this tool! ****
**** SpywareQuake {e5b1e382-817e-4b74-8a96-ec78751e6acf} NOT FOUND by this tool! ****
**** SpywareQuake {a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb} NOT FOUND by this tool! ****
**** SpywareQuake {cbb430e6-5b1b-474a-9d7e-160d4fe74bea} NOT FOUND by this tool! ****
**** SpywareQuake {62eb0924-19d2-4226-b4b9-8ad1f70904c1} NOT FOUND by this tool! ****
**** SpywareQuake {6c69e319-0d03-47da-997a-36586cbc53b3} NOT FOUND by this tool! ****
**** SpywareQuake {aea3d2df-2b2c-4d7b-81a0-d975c6dc088e} NOT FOUND by this tool! ****
**** SpywareSheriff {1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E} NOT FOUND by this tool! ****
**** VirusBurster {9d635a36-6b3c-4146-8625-f3aaf507bbf8} NOT FOUND by this tool! ****
**** TrustCleaner {24E27EA9-FCF3-444F-BD80-20543BA5D946} NOT FOUND by this tool! ****
**** Troj/Small-ER {4F141CBA-1457-6CCA-03A7-7AA21B61EA0F} NOT FOUND by this tool! ****
**** Troj/Spabot-E {429F4BB8-7BF7-4152-8011-3C6F9EB7E892} NOT FOUND by this tool! ****
**** Troj/Dloader-OF {203B1C4D9-BC71-8916-38AD-9DEA5D213614} NOT FOUND by this tool! ****
**** Troj/Crafted-A {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! ****
**** Troj/Agent-FG {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} NOT FOUND by this tool! ****
**** TX 4 BrowserAd adware {8e99f990-b75a-4568-b3c8-24cbc8cbbfc1} NOT FOUND by this tool! ****
**** Trojan-Proxy.Win32.Small {87A3E824-A726-4CF4-8A66-6314B11BDA0C} NOT FOUND by this tool! ****
**** Trojan-Downloader.Win32.Delf.ks {786C369D-409A-456f-A13C-971EADA850C6} NOT FOUND by this tool! ****
**** W32/Almanahe.a Worm NOT FOUND by this tool! ****
**** msctl32.dll SpamBot NOT FOUND by this tool! ****
**** KeyLogger NOT FOUND by this tool! ****
--------------------------------------------------------------------------
CHECKING FOR BOT-TYPE WORMS:
--------------------------------------------------------------------------
**** W32/Sdbot Worm NOT FOUND by this tool! ****
--------------------------------------------------------------------------
CHECKING FOR KNOWN ROOTKIT STEALTHING AGENTS:
--------------------------------------------------------------------------
**** i386p.* Stealthing Agent NOT FOUND by this tool! ****
**** ErrorSafe erssdd.* Stealthing Agent NOT FOUND by this tool! ****
**** VUNDO DP.* Stealthing Agent NOT FOUND by this tool! ****
**** Troj/NTRootK-BP main.* Stealthing Agent NOT FOUND by this tool! ****
**** W32/Almanahe.sys RioDrvrs.* Stealthing Agent NOT FOUND by this tool! ****
**** W32/Almanahe.sys DKIS6.* Stealthing Agent NOT FOUND by this tool! ****
--------------------------------------------------------------------------
CHECKING FOR VISIBLE ROOTKIT-TYPE REGISTRY KEYS:
--------------------------------------------------------------------------
**** Rustock.B trojan, PE386 rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, huy32 rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, lzx32 rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, msguard rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, xpdt.sy_ rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, xpdt.sys rootkit NOT FOUND by this tool! ****
**** CmdService adware NOT FOUND by this tool! ****
**** Network_Monitor adware NOT FOUND by this tool! ****
**** Trojan.Peacomm NOT FOUND by this tool! ****
**** Trojan.Peacomm windev NOT FOUND by this tool! ****
**** AVPE Haxdoor NOT FOUND by this tool! ****
**** MEMLOW Haxdoor NOT FOUND by this tool! ****
**** VDMT Haxdoor NOT FOUND by this tool! ****
**** YCSVGA Haxdoor NOT FOUND by this tool! ****
**** PPTP Haxdoor FOUND by this tool! ****
CAREFULL HERE THIS WILL ALSO FIND WinLanMiniport
DisplayName REG_SZ Miniporta de rede remota (PPTP)
Description REG_SZ Miniporta de rede remota (PPTP)
DisplayName REG_SZ Miniporta de rede remota (PPTP)
Description REG_SZ Miniporta de rede remota (PPTP)
DisplayName REG_SZ Miniporta de rede remota (PPTP)
Description REG_SZ Miniporta de rede remota (PPTP)
**** DVB Haxdoor NOT FOUND by this tool! ****
**** YVBB Haxdoor NOT FOUND by this tool! ****
**** YVPP Haxdoor NOT FOUND by this tool! ****
**** NKGFS Haxdoor NOT FOUND by this tool! ****
**** XMSK Haxdoor NOT FOUND by this tool! ****
**** AVPX Haxdoor NOT FOUND by this tool! ****
**** MMXF Haxdoor NOT FOUND by this tool! ****
**** DP1112 Vundo Rootkit NOT FOUND by this tool! ****
**** SYSBUS32 Rootkit Driver NOT FOUND by this tool! ****
**** I386P Rootkit Driver NOT FOUND by this tool! ****
**** ERSSDD Rootkit NOT FOUND by this tool! ****
**** GencTurK RootKit NOT FOUND by this tool! ****
**** Troj/NTRootK-BP RootKit NOT FOUND by this tool! ****
**** W32/Almanahe.sys NOT FOUND by this tool! ****
************************************************************************************
Dumping HKLM Uninstall Programs list
DisplayName REG_SZ Adobe Flash Player ActiveX
DisplayName REG_SZ Adobe Flash Player Plugin
DisplayName REG_SZ Arquivo do WinRAR
DisplayName REG_SZ Assistente de Conexo do Windows Live
DisplayName REG_SZ Aston.1.9.2
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB923789)
DisplayName REG_SZ Canon iP1200
DisplayName REG_SZ CCleaner (remove only)
DisplayName REG_SZ Choice Guard
DisplayName REG_SZ Clean Virus MSN
DisplayName REG_SZ D'Accord Afinador 3.0
DisplayName REG_SZ D'Accord Dicionrio
DisplayName REG_SZ D'Accord Violo Player 2.0
DisplayName REG_SZ Eusing Free Registry Cleaner
DisplayName REG_SZ Glary Utilities 2.5.1
DisplayName REG_SZ K-Lite Mega Codec Pack 3.9.5
DisplayName REG_SZ Malwarebytes' Anti-Malware
DisplayName REG_SZ Messenger Plus! Live
DisplayName REG_SZ Microsoft .NET Framework 2.0
DisplayName REG_SZ Microsoft .NET Framework 2.0
DisplayName REG_SZ Microsoft Application Error Reporting
DisplayName REG_SZ Microsoft Office Professional Edio 2003
DisplayName REG_SZ Mozilla Firefox (2.0.0.18)
DisplayName REG_SZ MSXML 4.0 SP2 (KB936181)
DisplayName REG_SZ MSXML 4.0 SP2 (KB954430)
DisplayName REG_SZ Nero 7 Micro 7.9.6.0
DisplayName REG_SZ neroxml
DisplayName REG_SZ Platform
DisplayName REG_SZ Ralink Wireless LAN
DisplayName REG_SZ Realtek AC'97 Audio
DisplayName REG_SZ Security Update para o produto Microsoft .NET Framework 2.0 (KB928365)
DisplayName REG_SZ Spybot - Search & Destroy
DisplayName REG_SZ USB PC Camera (SN9C103)
DisplayName REG_SZ VCRedistSetup
DisplayName REG_SZ VIA Gerenciador de dispositivo de plataforma
DisplayName REG_SZ WebFldrs XP
DisplayName REG_SZ Windows Genuine Advantage Notifications (KB905474)
DisplayName REG_SZ Windows Live installer
DisplayName REG_SZ Windows Live Messenger
DisplayName REG_SZ Windows Media Format Runtime
DisplayName REG_SZ Windows Media Player 10
ParentDisplayName REG_SZ Microsoft .NET Framework 2.0
ParentDisplayName REG_SZ Windows Updates
ParentDisplayName REG_SZ Windows Updates
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Software Updates
#####################################################################################################
-- All DONE! :)
~ ShadowPuterDude ~