System folder appears at desktop after power on

ismail SG

Recently, I realised that whenever I on my laptop, it had a system folder opened. C: Windows...something I can't remember...can I do anything to fix this?

Also, I have this virus I detected with symantec antivirus

its called Win32 SillyDC....I can't heal it..instead it can only be quarantined.

Any suggestions on solving the problem?

BrUtUs SG

wat platform u using? vista or xp?

ismail SG

Windows XP...

The folder directory is C:Windows/system

I just realised if I leave the folder there it disappears after a while.

ndmmxiaomayi SG

What have you installed or uninstalled?

ismail SG

There is a WISE Software I deleted from my registry.

Do you want my HijackThis log?

I seen it through and I think the problem can be seen from the log.

Here it is:

Logfile of HijackThis v1.99.1
Scan saved at 4:03:51 PM, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Notebook Hardware Control\nhc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\62226\My Documents\spyware_attack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myrp2.myrp.sg/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F3 - REG:win.ini: load=System
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,System
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Program Files\Notebook Hardware Control\nhc.exe" -quiet
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5-windows-i586.cab
O16 - DPF: {97AFC0D9-660E-4ACE-B025-46FD64AE335A} (EmailImport.EmailImportControl) - http://www.friendster.com/emailimport/ms/emailimport.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.2.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rp.edu.sg
O17 - HKLM\Software\..\Telephony: DomainName = rp.edu.sg
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rp.edu.sg
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: 30023B3C - Unknown owner - C:\WINDOWS\system32\19D251E8.EXE (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Flexlm (lmgrd) - Macrovision Corporation - C:\OrCAD\OrCAD_10.5\IntelliCAD 4\LicenseManager\lmgrd.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

ndmmxiaomayi SG

I see what's causing the system folder to be opened each time Windows is started.

First... disable these programs temporarily as they may interfere with the fixes.

Disable SpywareGuard temporarily

Disable Windows Defender temporarily

____________________________________________________________

Open HijackThis and select Do a system scan only. Tick these boxes:

Click Fix checked. Close HijackThis.
____________________________________________________________

Uninstall either Norton or AVG... don't have 2 antivirus running at the same time...

If Norton can't be uninstalled.... download and save Norton Removal Tool, then run it. After that, restart your computer.
____________________________________________________________

Post back the 2 DSS logs. 1 log per reply please.

ismail SG

Main Text

Deckard's System Scanner v20071014.68
Run by 62226 on 2008-01-04 21:21:31
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
49: 2008-01-04 13:21:40 UTC - RP125 - Deckard's System Scanner Restore Point
48: 2008-01-04 13:17:56 UTC - RP124 - Removed AVG 7.5
47: 2007-12-29 15:53:14 UTC - RP123 - Software Distribution Service 3.0
46: 2007-12-27 04:43:31 UTC - RP122 - Software Distribution Service 3.0
45: 2007-12-20 04:07:37 UTC - RP121 - Software Distribution Service 3.0

-- First Restore Point --
1: 2007-09-21 13:11:50 UTC - RP77 - Software Distribution Service 3.0

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 503 MiB (512 MiB recommended).

-- HijackThis (run as 62226.exe) -----------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-01-04 21:24:23
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint2K\Hidfind.exe
C:\Program Files\Apoint2K\ApntEx.exe
C:\Program Files\Notebook Hardware Control\nhc.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\62226\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myrp2.myrp.sg/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Program Files\Notebook Hardware Control\nhc.exe" -quiet
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_12) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5-windows-i586.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {97AFC0D9-660E-4ACE-B025-46FD64AE335A} (EmailImport.EmailImportControl) - http://www.friendster.com/emailimport/ms/emailimport.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.2.cab
O17 - HKLM\Software\..\Telephony: DomainName = rp.edu.sg
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = rp.edu.sg
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = rp.edu.sg
O18 - Protocol: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msero - {B0D92A71-886B-453B-A649-1B91F93801E7} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\MSERO.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: 30023B3C - Unknown owner - C:\WINDOWS\system32\19D251E8.EXE -k
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: CADopia License Manager - Macrovision Corporation - C:\OrCAD\OrCAD_10.5\IntelliCAD 4\LicenseManager\lmgrd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\altera\71sp1\quartus\bin\jtagserver.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE
O23 - Service: Flexlm (lmgrd) - Macrovision Corporation - C:\OrCAD\OrCAD_10.5\IntelliCAD 4\LicenseManager\lmgrd.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 11819 bytes

-- HijackThis Fixed Entries (C:\DOCUME~1\62226\MYDOCU~1\SPYWAR~1\backups\) -----

backup-20060330-151755-234 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
backup-20060330-151755-288 O4 - HKLM\..\RunServices: [System Services] ajuvugw.exe
backup-20060330-151755-517 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
backup-20060330-151756-985 O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
backup-20060417-173453-191 O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpBF0A.tmp
backup-20060417-173453-828 O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll (file missing)
backup-20060417-173453-962 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
backup-20060418-171135-503 O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
backup-20060418-171135-773 R3 - URLSearchHook: ???¡é?¨²¨º? - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
backup-20060418-171136-562 O9 - Extra button: E bazar - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
backup-20060418-171136-861 O9 - Extra button: Yahoo 1G mail - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
backup-20060418-171137-406 O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
backup-20060418-171137-415 O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
backup-20060418-171137-830 O9 - Extra button: Yahoo Assistant - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
backup-20060418-171138-379 O9 - Extra 'Tools' menuitem: Repair Browser - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
backup-20060418-171138-537 O9 - Extra 'Tools' menuitem: Clean Internet access record - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
backup-20060418-171138-782 O11 - Options group: [!CNS] Chinese keywords
backup-20060418-171138-802 O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
backup-20060418-171155-195 O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\downlo~1\CnsHook.dll
backup-20060419-130056-925 O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\50086\LOCALS~1\Temp\IXP000.TMP\"
backup-20060421-104836-435 R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
backup-20060421-104836-838 F2 - REG:system.ini: UserInit=D:\WINDOWS\System32\userinit.exe,D:\WINDOWS\ .exe
backup-20060421-104836-957 R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
backup-20060421-104836-984 O2 - BHO: MICROQIL2 - {832C0563-0820-4fef-83D8-418261DBC233} - D:\WINDOWS\System32\RAdminl.dll
backup-20060421-104837-140 O8 - Extra context menu item: Mail to a Friend... - http://client.alexa.com/holiday/script/actions/mailto.htm
backup-20060421-104837-282 O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINDOWS\system32\SHDOCVW.DLL
backup-20060421-104837-291 O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
backup-20060421-104837-451 O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
backup-20060421-104837-470 O8 - Extra context menu item: °Ù¶È-ËÑË÷ÐÂÎÅ - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM
backup-20060421-104837-521 O8 - Extra context menu item: Get Alexa Data - http://client.alexa.com/holiday/script/actions/sitedata.htm
backup-20060421-104837-526 O8 - Extra context menu item: Write a Review... - http://client.alexa.com/holiday/script/actions/review.htm
backup-20060421-104837-634 O8 - Extra context menu item: °Ù¶È-ËÑË÷Í¼Æ¬ - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM
backup-20060421-104837-705 O8 - Extra context menu item: See Related Links - http://client.alexa.com/holiday/script/actions/related.htm
backup-20060421-104837-769 O8 - Extra context menu item: °Ù¶È-ËÑË÷MP3 - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM
backup-20060421-104837-819 O2 - BHO: IEHlprObj Class - {C5E5DB7E-46B1-47E6-8447-2E517F269925} - D:\Program Files\Xplus\GETIE.dll (file missing)
backup-20060421-104837-926 O8 - Extra context menu item: °Ù¶È-ËÑË÷¸è´Ê - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM
backup-20060421-104838-211 O9 - Extra button: ?a¡¤???2¨º¨º¨®?¦Ì3?¨¢¡Â3??¨²??1??¡ä - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
backup-20060421-104838-260 O8 - Extra context menu item: °Ù¶È-ËÑË÷Ìù°É - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM
backup-20060421-104838-488 O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
backup-20060421-104838-730 O9 - Extra 'Tools' menuitem: 2£¤¡ã?¦Ì?¨º¨® - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
backup-20060421-104838-845 O8 - Extra context menu item: °Ù¶È-ËÑË÷ÍøÒ³ - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM
backup-20060421-104838-902 O8 - Extra context menu item: °Ù¶È-´ÊµäËÑË÷ - res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM
backup-20060421-104839-431 O9 - Extra 'Tools' menuitem: &TuoTu - {D5C1CCC2-811B-4bf2-BF22-0D3B89600F5B} - D:\Program Files\Tuotu\TuoTuApp.exe (file missing)
backup-20060421-104839-453 O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
backup-20060421-104839-616 O9 - Extra button: ¨ª?¨ª????? - {D5C1CCC2-811B-4bf2-BF22-0D3B89600F5B} - D:\Program Files\Tuotu\TuoTuApp.exe (file missing)
backup-20060421-104839-928 O9 - Extra button: ¨°¡Á¨¨¡è1o?? - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-205?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
backup-20060421-104840-513 O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
backup-20060421-104840-530 O9 - Extra 'Tools' menuitem: ¨°¡Á¨¨¡è1o?? - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-205?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
backup-20060421-104841-574 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
backup-20060421-175854-152 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175855-143 R3 - Default URLSearchHook is missing
backup-20060421-175855-178 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175855-353 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175855-397 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175855-446 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
backup-20060421-175855-461 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175855-472 O2 - BHO: (no name) - {146AFEBB-7120-BBED-61F3-F22CEAF0E120} - (no file)
backup-20060421-175855-528 O2 - BHO: (no name) - {146C42AD-EBB6-43E5-C5BA-DB26064A7470} - (no file)
backup-20060421-175855-586 O2 - BHO: (no name) - {0DD6DF67-E153-DF83-F668-96227EBA767C} - (no file)
backup-20060421-175855-645 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175855-949 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\iyggt.dll/sp.html#88449%resultposition.net
backup-20060421-175856-103 O2 - BHO: (no name) - {32E10B63-FD1C-4D58-2AAD-8A5DBE1E8703} - (no file)
backup-20060421-175856-151 O2 - BHO: (no name) - {38AF1BB4-5940-C5E2-435F-08770DE172AB} - (no file)
backup-20060421-175856-183 O2 - BHO: (no name) - {26F575B7-9B11-33C4-6228-2D6E05400276} - (no file)
backup-20060421-175856-187 O2 - BHO: (no name) - {6D9E2D31-EB57-F24B-9B0F-61D4FA3DB1F4} - (no file)
backup-20060421-175856-213 O2 - BHO: (no name) - {4E0B27B5-3F3E-8DF7-94F9-D02FD285D78D} - (no file)
backup-20060421-175856-282 O2 - BHO: (no name) - {1DE0838B-81C7-4619-D695-75ED11D630B6} - (no file)
backup-20060421-175856-391 O2 - BHO: (no name) - {286D46CC-47AD-B067-BCF2-A81A4597B5C5} - (no file)
backup-20060421-175856-458 O2 - BHO: (no name) - {36D56CF5-CF23-1488-CD96-F9DBE243522B} - (no file)
backup-20060421-175856-610 O2 - BHO: (no name) - {6A9A98A4-1733-141A-04B1-536A43E5A00C} - (no file)
backup-20060421-175856-696 O2 - BHO: (no name) - {757AA4A7-F824-258A-4257-5B822794FA60} - (no file)
backup-20060421-175857-192 O2 - BHO: (no name) - {80010426-C366-9F5D-EAF5-3372D821F450} - (no file)
backup-20060421-175857-256 O2 - BHO: (no name) - {8D7A8954-4170-2440-15FE-F1BE6735EBA6} - (no file)
backup-20060421-175857-303 O2 - BHO: (no name) - {905E9880-1145-1A4A-DCBB-499FB8DBD544} - (no file)
backup-20060421-175857-402 O2 - BHO: (no name) - {9A680459-4010-FA2E-EC15-175ADE2D5377} - (no file)
backup-20060421-175857-417 O2 - BHO: Class - {C7D9E145-52DB-B4D5-50F2-B854335AD4B1} - C:\WINDOWS\crcc32.dll
backup-20060421-175857-441 O2 - BHO: (no name) - {B1D1D324-FC8B-3721-9BF6-C3F37D8175F7} - (no file)
backup-20060421-175857-531 O2 - BHO: (no name) - {A5016BFA-AF2F-38FC-EB59-79C9ECE9256B} - (no file)
backup-20060421-175857-686 O2 - BHO: (no name) - {7FF827C3-DF9E-38DE-6A6A-C21E847B30E4} - (no file)
backup-20060421-175857-843 O2 - BHO: (no name) - {A037FEC1-2C7D-FBA6-99CC-9CE33BBFC88E} - (no file)
backup-20060421-175857-993 O2 - BHO: (no name) - {9E10B616-D6A4-32D5-95E7-6F227792C942} - (no file)
backup-20060421-175858-148 O2 - BHO: (no name) - {CEDD5709-5058-410D-7FA2-8B13FFF31739} - (no file)
backup-20060421-175858-286 O2 - BHO: (no name) - {F0E43199-5174-F601-B6ED-5BE690BB4830} - (no file)
backup-20060421-175858-330 O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
backup-20060421-175858-344 O4 - HKCU\..\RunServices: [System Services] qszztxb.exe
backup-20060421-175858-416 O4 - HKLM\..\Run: [iphk32.exe] C:\WINDOWS\system32\iphk32.exe
backup-20060421-175858-772 O2 - BHO: (no name) - {D87A0FBB-86E1-A961-D4CD-331BD3168F91} - (no file)
backup-20060421-175858-956 O2 - BHO: (no name) - {D10F1ADA-BFED-15DC-A6D4-3F52D6F5F30B} - (no file)
backup-20060421-175900-488 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
backup-20060421-175900-492 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
backup-20060421-175932-201 O2 - BHO: (no name) - {4E0B27B5-3F3E-8DF7-94F9-D02FD285D78D} - (no file)
backup-20060421-175932-270 O2 - BHO: (no name) - {0DD6DF67-E153-DF83-F668-96227EBA767C} - (no file)
backup-20060421-175932-291 O2 - BHO: (no name) - {26F575B7-9B11-33C4-6228-2D6E05400276} - (no file)
backup-20060421-175932-436 O2 - BHO: (no name) - {38AF1BB4-5940-C5E2-435F-08770DE172AB} - (no file)
backup-20060421-175932-607 O2 - BHO: (no name) - {32E10B63-FD1C-4D58-2AAD-8A5DBE1E8703} - (no file)
backup-20060421-175932-666 O2 - BHO: (no name) - {1DE0838B-81C7-4619-D695-75ED11D630B6} - (no file)
backup-20060421-175932-693 O2 - BHO: (no name) - {146AFEBB-7120-BBED-61F3-F22CEAF0E120} - (no file)
backup-20060421-175932-885 O2 - BHO: (no name) - {286D46CC-47AD-B067-BCF2-A81A4597B5C5} - (no file)
backup-20060421-175932-928 O2 - BHO: (no name) - {146C42AD-EBB6-43E5-C5BA-DB26064A7470} - (no file)
backup-20060421-175932-945 O2 - BHO: (no name) - {36D56CF5-CF23-1488-CD96-F9DBE243522B} - (no file)
backup-20060421-175933-147 O2 - BHO: (no name) - {8D7A8954-4170-2440-15FE-F1BE6735EBA6} - (no file)
backup-20060421-175933-298 O2 - BHO: (no name) - {6D9E2D31-EB57-F24B-9B0F-61D4FA3DB1F4} - (no file)
backup-20060421-175933-422 O2 - BHO: (no name) - {6A9A98A4-1733-141A-04B1-536A43E5A00C} - (no file)
backup-20060421-175933-480 O2 - BHO: (no name) - {80010426-C366-9F5D-EAF5-3372D821F450} - (no file)
backup-20060421-175933-613 O2 - BHO: (no name) - {905E9880-1145-1A4A-DCBB-499FB8DBD544} - (no file)
backup-20060421-175933-639 O2 - BHO: (no name) - {9E10B616-D6A4-32D5-95E7-6F227792C942} - (no file)
backup-20060421-175933-720 O2 - BHO: (no name) - {9A680459-4010-FA2E-EC15-175ADE2D5377} - (no file)
backup-20060421-175933-754 O2 - BHO: (no name) - {A037FEC1-2C7D-FBA6-99CC-9CE33BBFC88E} - (no file)
backup-20060421-175933-845 O2 - BHO: (no name) - {7FF827C3-DF9E-38DE-6A6A-C21E847B30E4} - (no file)
backup-20060421-175933-847 O2 - BHO: (no name) - {757AA4A7-F824-258A-4257-5B822794FA60} - (no file)
backup-20060421-175934-204 O2 - BHO: (no name) - {CEDD5709-5058-410D-7FA2-8B13FFF31739} - (no file)
backup-20060421-175934-305 O2 - BHO: (no name) - {D87A0FBB-86E1-A961-D4CD-331BD3168F91} - (no file)
backup-20060421-175934-373 O2 - BHO: (no name) - {C7D9E145-52DB-B4D5-50F2-B854335AD4B1} - (no file)
backup-20060421-175934-432 O2 - BHO: (no name) - {D10F1ADA-BFED-15DC-A6D4-3F52D6F5F30B} - (no file)
backup-20060421-175934-484 O2 - BHO: (no name) - {A5016BFA-AF2F-38FC-EB59-79C9ECE9256B} - (no file)
backup-20060421-175934-659 O2 - BHO: (no name) - {B1D1D324-FC8B-3721-9BF6-C3F37D8175F7} - (no file)
backup-20060421-175934-686 O2 - BHO: (no name) - {F0E43199-5174-F601-B6ED-5BE690BB4830} - (no file)
backup-20060424-115747-367 O2 - BHO: (no name) - {edbf1bc8-39ab-48eb-a0a9-c75078eb7c8e} - (no file)
backup-20060424-115747-905 O20 - Winlogon Notify: windeu32 - C:\WINDOWS\SYSTEM32\windeu32.dll
backup-20060424-115748-580 O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
backup-20060425-181221-290 O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
backup-20060425-181221-654 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.xxxjlpyqtjzvvsow.com/x5tsitB66cOhvgkR3/G0Sl2nKlqppwPK4kcCTJZGNX_cZ96eVat4iCkqb5W85v1U.html
backup-20060425-181222-138 O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
backup-20060425-181222-985 O3 - Toolbar: °Ù¶È³¬¼¶ËÑ°Ô - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
backup-20060425-181223-336 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
backup-20060425-181223-795 O8 - Extra context menu item: °Ù¶È--ÍøÒ³ËÑË÷ - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUSEARCH.HTM
backup-20060529-181620-414 O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
backup-20060529-181622-438 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
backup-20060529-181623-630 O2 - BHO: (no name) - {07E661F0-7736-4F5F-B688-D40DCF76982A} - C:\WINDOWS\system32\Cgpu.dll
backup-20060529-181624-313 O2 - BHO: (no name) - {2110556A-D1F6-4179-8AE8-17E1F6667EAB} - C:\WINDOWS\system32\Gwkjkb.dll
backup-20060529-181625-831 O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
backup-20060529-181626-757 O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
backup-20060529-181628-391 O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
backup-20060529-181630-369 O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
backup-20060529-181631-510 O3 - Toolbar: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
backup-20060529-181631-605 O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
backup-20060529-181632-535 O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
backup-20060529-181632-593 O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
backup-20060529-181633-737 O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
backup-20060529-181634-237 O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
backup-20060529-181635-106 O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
backup-20060529-181636-135 O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
backup-20060529-181637-169 O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
backup-20060529-181638-877 O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
backup-20060529-181638-892 O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
backup-20060529-181639-936 O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
backup-20060529-181640-983 O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
backup-20060529-181641-151 O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
backup-20060529-181642-781 O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
backup-20060529-181643-241 O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe
backup-20060529-181643-991 O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
backup-20060529-181644-675 O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
backup-20060529-181645-390 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
backup-20060529-181645-391 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
backup-20060529-181646-242 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
backup-20060529-181647-847 O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
backup-20080104-210617-256 O23 - Service: 30023B3C - Unknown owner - C:\WINDOWS\system32\19D251E8.EXE (file missing)
backup-20080104-210617-479 F3 - REG:win.ini: load=System
backup-20080104-210617-707 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
backup-20080104-210617-927 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,System

-- File Associations -----------------------------------------------------------

[COLOR=red].scr - Icad.load.scr - shell\open\command - Notepad.exe %1[/COLOR]

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.5.3.0) - c:\windows\system32\drivers\aegisp.sys
R2 AlteraByteBlaster (Altera ByteBlaster) - c:\windows\system32\drivers\pgdhdlc.sys
R2 BtnHnd - c:\program files\fujitsu\btnhnd\btnhnd.sys
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys
R2 SBKUPNT - c:\windows\system32\drivers\sbkupnt.sys
R3 nhcDriverDevice (Notebook Hardware Control Driver) - c:\windows\system32\drivers\nhcdriver.sys
R4 Avg7RsW (AVG7 Wrap Driver) - c:\windows\system32\drivers\avg7rsw.sys (file missing)

S2 MCUSBICD2 (Microchip MPLAB ICD 2 Firmware Client Driver (ICD2W2K.SYS)) - c:\windows\system32\drivers\icd2w2k.sys
S3 Ad-Watch Connect Filter (Ad-Watch Connect Kernel Filter) - c:\windows\system32\drivers\nsdriver.sys
S3 idisw2km - c:\windows\system32\drivers\idisw2km.sys (file missing)
S3 kbstuff (SMS Virtual Keyboard) - c:\windows\system32\drivers\kbstuff5.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe"
R2 O2Flash (O2Micro Flash Memory) - c:\windows\system32\o2flash.exe
R2 RegSrvc (Intel(R) PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe

S2 lmgrd (Flexlm) - "c:\orcad\orcad_10.5\intellicad 4\licensemanager\lmgrd.exe"
S4 30023B3C - c:\windows\system32\19d251e8.exe -k (file missing)
S4 CADopia License Manager - c:\orcad\orcad_10.5\intell~1\licensemanager\lmgrd.exe
S4 JTAGServer (Altera JTAG Server) - c:\altera\71sp1\quartus\bin\jtagserver.exe

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-01-04 21:11:59 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job

-- Files created between 2007-12-04 and 2008-01-04 -----------------------------

2008-01-02 01:21:35 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-02 01:21:32 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-10 14:11:29 0 d--hs---- C:\Recycled
2007-12-05 20:26:37 0 dr-h----- C:\Documents and Settings\62226\Recent

-- Find3M Report ---------------------------------------------------------------

2008-01-04 21:10:03 0 d-------- C:\Program Files\Symantec AntiVirus
2008-01-03 02:09:22 0 d-------- C:\Program Files\Warcraft III
2008-01-01 16:55:58 0 d-------- C:\Program Files\a-squared Free
2007-12-27 12:45:23 0 d-------- C:\Program Files\Microsoft Games
2007-12-11 19:25:02 0 d-------- C:\Program Files\Valve
2007-12-03 11:04:00 0 d-------- C:\Documents and Settings\62226\Application Data\Sun
2007-12-03 11:03:16 0 d-------- C:\Program Files\Java
2007-12-03 11:01:12 0 d-------- C:\Program Files\Common Files
2007-12-03 11:01:12 0 d-------- C:\Program Files\Common Files\Java
2007-11-22 13:07:54 0 d-------- C:\Program Files\QuickTime
2007-11-15 09:56:51 0 d-------- C:\Documents and Settings\62226\Application Data\Sports Interactive
2007-11-15 09:46:52 0 d-------- C:\Program Files\Sports Interactive
2007-11-14 21:31:01 0 d-------- C:\Program Files\SpywareGuard
2007-11-14 21:08:27 0 d-------- C:\Documents and Settings\62226\Application Data\WinRAR
2007-11-04 12:57:06 0 d-------- C:\Program Files\Lavasoft
2007-11-04 12:54:44 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [04/05/2006 02:33 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [06/08/2005 11:39 AM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [06/08/2005 11:43 AM]
"AGRSMMSG"="AGRSMMSG.exe" [08/24/2005 04:24 PM C:\WINDOWS\AGRSMMSG.exe]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [03/14/2007 07:49 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 07:20 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [06/29/2007 06:24 AM]
"NotebookHardwareControl"="C:\Program Files\Notebook Hardware Control\nhc.exe" [05/04/2007 08:33 AM]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [01/07/2005 05:07 PM C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [09/04/2007 03:44 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [09/04/2007 03:44 PM C:\WINDOWS\Alcmtr.exe]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [08/02/2006 12:38 AM]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [08/02/2006 12:32 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe" [05/02/2007 04:15 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe"
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\62226\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [8/29/2003 7:05:35 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [02/05/2007 03:39 PM 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-839522115-1801674531-725345543-21362\Scripts\Logon\0\0]
"Script"=script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-839522115-1801674531-725345543-21362\Scripts\Logon\1\0]
"Script"=advclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-839522115-1801674531-725345543-30353\Scripts\Logon\0\0]
"Script"=advclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-839522115-1801674531-725345543-30353\Scripts\Logon\1\0]
"Script"=rpstorage.bat

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^62226^Start Menu^Programs^Startup^UTAgent 4.0.lnk]
path=C:\Documents and Settings\62226\Start Menu\Programs\Startup\UTAgent 4.0.lnk
backup=C:\WINDOWS\pss\UTAgent 4.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UTAgent 4.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\UTAgent 4.0.lnk
backup=C:\WINDOWS\pss\UTAgent 4.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk
backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATSwpNav]
"C:\Program Files\Fingerprint Sensor\ATSwpNav" -run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DispSwitchLauncher]
C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndicatorUtility]
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LoadBtnHnd]
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LoadFujitsuQuickTouch]
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
"C:\Program Files\Unlocker\UnlockerAssistant.exe" -H

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"idsvc"=3 (0x3)
"CADopia License Manager"=2 (0x2)
"WSearch"=2 (0x2)
"usnjsvc"=3 (0x3)
"MSSQL$SQLEXPRESS"=2 (0x2)
"a2free"=2 (0x2)
"JTAGServer"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{367e8212-9639-11dc-b5b0-0013cec744d4}]
Auto\command- F:\auto.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61f2539d-6fb7-11dc-b578-0013cec744d4}]
Auto\command- F:\auto.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fd613c3-3ab5-11dc-b51a-0013cec744d4}]
Auto\command- Cn911.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8012b73f-3591-11dc-b511-0013cec744d4}]
AutoRun\command- hcutxox.exe
explore\Command- hcutxox.exe
open\Command- hcutxox.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f8513b3-72da-11dc-b57d-0013cec744d4}]
AutoRun\command- F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f8513b4-72da-11dc-b57d-0013cec744d4}]
AutoRun\command- G:\
explore\Command- G:\RECYCLED\INFO.exe
open\Command- G:\RECYCLED\INFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{986f3a10-a139-11dc-b5c8-0013cec744d4}]
Auto\command- auto.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e28a6d16-9bb9-11dc-b5bd-0013cec744d4}]
Auto\command- auto.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

-- End of Deckard's System Scanner: finished at 2008-01-04 21:25:41 ------------

ismail SG

extra.txt (Part 1)

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel(R) Pentium(R) M processor 1.73GHz
Percentage of Memory in Use: 64%
Physical Memory (total/avail): 502.05 MiB / 179.45 MiB
Pagefile Memory (total/avail): 1226.72 MiB / 740.3 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1919.61 MiB

C: is Fixed (NTFS) - 46.64 GiB total, 16.08 GiB free.
D: is Fixed (NTFS) - 27.88 GiB total, 26.02 GiB free.
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - TOSHIBA MK8025GAS - 74.53 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 46.64 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 27.88 GiB - D:

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.

AV: Symantec AntiVirus Corporate Edition v10.1.6.6000 (Symantec Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\OrCAD\\OrCAD_10.5\\setconfig.exe"="C:\\OrCAD\\OrCAD_10.5\\setconfig.exe:*:Enabled:setconfig (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\updates.exe"="C:\\OrCAD\\OrCAD_10.5\\updates.exe:*:Enabled:updates (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\icad.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\icad.exe:*:Enabled:icad (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\cadopia.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\cadopia.exe:*:Enabled:cadopia (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\installs.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\installs.exe:*:Enabled:installs (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmdown.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmdown.exe:*:Enabled:lmdown (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmgrd.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmgrd.exe:*:Enabled:lmgrd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmhostid.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmhostid.exe:*:Enabled:lmhostid (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmtools.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmtools.exe:*:Enabled:lmtools (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmutil.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmutil.exe:*:Enabled:lmutil (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsdoc.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsdoc.exe:*:Enabled:cdsdoc (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsinfo.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsinfo.exe:*:Enabled:cdsinfo (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsmps.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsmps.exe:*:Enabled:cdsmps (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsMsgServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsMsgServer.exe:*:Enabled:cdsMsgServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsNameServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsNameServer.exe:*:Enabled:cdsNameServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRemshClient.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRemshClient.exe:*:Enabled:cdsRemshClient (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRunHidden.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRunHidden.exe:*:Enabled:cdsRunHidden (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsUnzip.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsUnzip.exe:*:Enabled:cdsUnzip (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdswhich.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdswhich.exe:*:Enabled:cdswhich (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsZip.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsZip.exe:*:Enabled:cdsZip (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cds_root.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cds_root.exe:*:Enabled:cds_root (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsAdminTool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsAdminTool.exe:*:Enabled:clsAdminTool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsbd.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsbd.exe:*:Enabled:clsbd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clu.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clu.exe:*:Enabled:clu (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\dregprint.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\dregprint.exe:*:Enabled:dregprint (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\mpsinfo.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\mpsinfo.exe:*:Enabled:mpsinfo (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmp.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmp.exe:*:Enabled:nmp (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmppath.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmppath.exe:*:Enabled:nmppath (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\obServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\obServer.exe:*:Enabled Surprised bServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\switchversion.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\switchversion.exe:*:Enabled:switchversion (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\van.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\van.exe:*:Enabled:van (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\versionviewer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\versionviewer.exe:*:Enabled:versionviewer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\capture.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\capture.exe:*:Enabled:capture (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\comp16.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\comp16.exe:*:Enabled:comp16 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pcadi.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pcadi.exe:*:Enabled:pcadi (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pspiceexplorersrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pspiceexplorersrvr.exe:*:Enabled:pspiceexplorersrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pstswp.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pstswp.exe:*:Enabled:pstswp (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\regsvr32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\regsvr32.exe:*:Enabled:regsvr32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\sch2cap.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\sch2cap.exe:*:Enabled:sch2cap (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\SETBROWS.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\SETBROWS.EXE:*:Enabled:SETBROWS (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\tutorial\\CAPTUTOR.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\tutorial\\CAPTUTOR.EXE:*:Enabled:CAPTUTOR (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\cdsdocIndexer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\cdsdocIndexer.exe:*:Enabled:cdsdocIndexer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\obServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\obServer.exe:*:Enabled Surprised bServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\mkdefcfg.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\mkdefcfg.exe:*:Enabled:mkdefcfg (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\versiontool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\versiontool.exe:*:Enabled:versiontool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\javaws-1_2_0_02-windows-i586-i.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\javaws-1_2_0_02-windows-i586-i.exe:*:Enabled:javaws-1_2_0_02-windows-i586-i (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\java.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\java.exe:*:Enabled:java (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\javaw.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\javaw.exe:*:Enabled:javaw (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\jpicpl32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\jpicpl32.exe:*:Enabled:jpicpl32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\keytool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\keytool.exe:*:Enabled:keytool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\kinit.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\kinit.exe:*:Enabled:kinit (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\klist.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\klist.exe:*:Enabled:klist (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\ktab.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\ktab.exe:*:Enabled:ktab (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\orbd.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\orbd.exe:*:Enabled Surprised rbd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\policytool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\policytool.exe:*:Enabled:policytool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmid.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmid.exe:*:Enabled:rmid (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmiregistry.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmiregistry.exe:*:Enabled:rmiregistry (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\servertool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\servertool.exe:*:Enabled:servertool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\tnameserv.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\tnameserv.exe:*:Enabled:tnameserv (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\fvupdateutil.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\fvupdateutil.exe:*:Enabled:fvupdateutil (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcad.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcad.exe:*:Enabled:gcad (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcam.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcam.exe:*:Enabled:gcam (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcdin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcdin.exe:*:Enabled:gcdin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\idfin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\idfin.exe:*:Enabled:idfin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\ipc356.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\ipc356.exe:*:Enabled:ipc356 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\layout.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\layout.exe:*:Enabled:layout (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\libcat.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\libcat.exe:*:Enabled:libcat (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\lsession.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\lsession.exe:*:Enabled:lsession (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\max2hyp.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\max2hyp.exe:*:Enabled:max2hyp (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascb.exe:*:Enabled:maxascb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascx.exe:*:Enabled:maxascx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxdxf.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxdxf.exe:*:Enabled:maxdxf (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxeco.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxeco.exe:*:Enabled:maxeco (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxfnetx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxfnetx.exe:*:Enabled:maxfnetx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminb.exe:*:Enabled:maxminb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminw.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminw.exe:*:Enabled:maxminw (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminx.exe:*:Enabled:maxminx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxorcad.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxorcad.exe:*:Enabled:maxorcad (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxp99x.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxp99x.exe:*:Enabled:maxp99x (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadb.exe:*:Enabled:maxpadb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadx.exe:*:Enabled:maxpadx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadb.exe:*:Enabled:maxpcadb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadx.exe:*:Enabled:maxpcadx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotb.exe:*:Enabled:maxprotb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotx.exe:*:Enabled:maxprotx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrb.exe:*:Enabled:maxstrb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrx.exe:*:Enabled:maxstrx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangb.exe:*:Enabled:maxtangb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangx.exe:*:Enabled:maxtangx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\mfceco.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\mfceco.exe:*:Enabled:mfceco (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\orcadodb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\orcadodb.exe:*:Enabled Surprised rcadodb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padb.exe:*:Enabled:padb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padx.exe:*:Enabled:padx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadb.exe:*:Enabled:pcadb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadx.exe:*:Enabled:pcadx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcb2max.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcb2max.exe:*:Enabled:pcb2max (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\prcat.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\prcat.exe:*:Enabled:prcat (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protb.exe:*:Enabled:protb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protx.exe:*:Enabled:protx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\searchTool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\searchTool.exe:*:Enabled:searchTool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\setbrows.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\setbrows.exe:*:Enabled:setbrows (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\specin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\specin.exe:*:Enabled:specin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strb.exe:*:Enabled:strb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strx.exe:*:Enabled:strx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangb.exe:*:Enabled:tangb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangx.exe:*:Enabled:tangx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\to386.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\to386.exe:*:Enabled:to386 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\toidf.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\toidf.exe:*:Enabled:toidf (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tomax.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tomax.exe:*:Enabled:tomax (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tospec.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tospec.exe:*:Enabled:tospec (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\update90.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\update90.exe:*:Enabled:update90 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\F2G.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\F2G.EXE:*:Enabled:F2G (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\G2F.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\G2F.EXE:*:Enabled:G2F (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\custaped.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\custaped.exe:*:Enabled:custaped (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GERBLINE.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GERBLINE.EXE:*:Enabled:GERBLINE (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\Gerbtool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\Gerbtool.exe:*:Enabled:Gerbtool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GT2VIEW.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GT2VIEW.EXE:*:Enabled:GT2VIEW (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\System\\FixTbar.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\System\\FixTbar.exe:*:Enabled:FixTbar (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\samples\\demo\\reset.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\samples\\demo\\reset.exe:*:Enabled:reset (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\batch32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\batch32.exe:*:Enabled:batch32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\sroute.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\sroute.exe:*:Enabled:sroute (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tutorial\\laytutor.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tutorial\\laytutor.exe:*:Enabled:laytutor (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\vcadd\\vcadd32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\vcadd\\vcadd32.exe:*:Enabled:vcadd32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\appmgr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\appmgr.exe:*:Enabled:appmgr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\IndiceFileGeneration.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\IndiceFileGeneration.exe:*:Enabled:IndiceFileGeneration (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\lxcwin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\lxcwin.exe:*:Enabled:lxcwin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\Magneticdesigner.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\Magneticdesigner.exe:*:Enabled:Magneticdesigner (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\modeled.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\modeled.exe:*:Enabled:modeled (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\MrkSrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\MrkSrvr.exe:*:Enabled:MrkSrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\msgview.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\msgview.exe:*:Enabled:msgview (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\PDesign.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\PDesign.exe:*:Enabled Razz Design (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psched.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psched.exe:*:Enabled:psched (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspice.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspice.exe:*:Enabled:pspice (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspiceexplorersrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspiceexplorersrvr.exe:*:Enabled:pspiceexplorersrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psp_cmd.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psp_cmd.exe:*:Enabled:psp_cmd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\regsvr32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\regsvr32.exe:*:Enabled:regsvr32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simmgr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simmgr.exe:*:Enabled:simmgr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simsrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simsrvr.exe:*:Enabled:simsrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\stmed.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\stmed.exe:*:Enabled:stmed (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\bin\\cdsdocIndexer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\bin\\cdsdocIndexer.exe:*:Enabled:cdsdocIndexer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\merge.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\merge.exe:*:Enabled:merge (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\mkvdk.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\mkvdk.exe:*:Enabled:mkvdk (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\search.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\search.exe:*:Enabled:search (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\setup.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\setup.exe:*:Enabled:setup (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\v_uninst.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\v_uninst.exe:*:Enabled:v_uninst (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\callback.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\callback.exe:*:Enabled:callback (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\filter.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\filter.exe:*:Enabled:filter (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmlini.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmlini.exe:*:Enabled:htmlini (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmserv.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmserv.exe:*:Enabled:htmserv (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\index.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\index.exe:*:Enabled:index (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jstree.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jstree.exe:*:Enabled:jstree (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jvtree.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jvtree.exe:*:Enabled:jvtree (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\kvoop.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\kvoop.exe:*:Enabled:kvoop (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\regsvr32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\regsvr32.exe:*:Enabled:regsvr32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\summary.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\summary.exe:*:Enabled:summary (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\viewers\\amovie.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\viewers\\amovie.exe:*:Enabled:amovie (Release OrCAD 10.5)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Microsoft Office Communicator\\communicator.exe"="C:\\Program Files\\Microsoft Office Communicator\\communicator.exe:*:Enabled:Microsoft Office Communicator 2005"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Documents and Settings\\62226\\Application Data\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\62226\\Application Data\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRES.EXE"="C:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRES.EXE:*:Enabled:Age of Empires"
"C:\\Program Files\\FM 2007\\fm.exe"="C:\\Program Files\\FM 2007\\fm.exe:*:Enabled:Football Manager 2007"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office Communicator\\communicator.exe"="C:\\Program Files\\Microsoft Office Communicator\\communicator.exe:*:Enabled:Microsoft Office Communicator 2005"
"C:\\Program Files\\CA\\eTrust Antivirus\\InoRpc.exe"="C:\\Program Files\\CA\\eTrust Antivirus\\InoRpc.exe:*:Enabled:eTrust Antivirus - RPC Server"
"C:\\Program Files\\CA\\eTrust Antivirus\\InocIT.exe"="C:\\Program Files\\CA\\eTrust Antivirus\\InocIT.exe:*:Enabled:eTrust Antivirus - Local Scanner"
"C:\\Program Files\\CA\\eTrust Antivirus\\Realmon.exe"="C:\\Program Files\\CA\\eTrust Antivirus\\Realmon.exe:*:Enabled:eTrust Antivirus - Realtime monitor"
"C:\\OrCAD\\OrCAD_10.5\\setconfig.exe"="C:\\OrCAD\\OrCAD_10.5\\setconfig.exe:*:Enabled:setconfig (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\updates.exe"="C:\\OrCAD\\OrCAD_10.5\\updates.exe:*:Enabled:updates (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\icad.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\icad.exe:*:Enabled:icad (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\cadopia.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\cadopia.exe:*:Enabled:cadopia (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\installs.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\installs.exe:*:Enabled:installs (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmdown.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmdown.exe:*:Enabled:lmdown (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmgrd.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmgrd.exe:*:Enabled:lmgrd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmhostid.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmhostid.exe:*:Enabled:lmhostid (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmtools.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmtools.exe:*:Enabled:lmtools (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmutil.exe"="C:\\OrCAD\\OrCAD_10.5\\IntelliCAD 4\\LicenseManager\\lmutil.exe:*:Enabled:lmutil (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsdoc.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsdoc.exe:*:Enabled:cdsdoc (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsinfo.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsinfo.exe:*:Enabled:cdsinfo (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsmps.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsmps.exe:*:Enabled:cdsmps (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsMsgServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsMsgServer.exe:*:Enabled:cdsMsgServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsNameServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsNameServer.exe:*:Enabled:cdsNameServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRemshClient.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRemshClient.exe:*:Enabled:cdsRemshClient (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRunHidden.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsRunHidden.exe:*:Enabled:cdsRunHidden (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsUnzip.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsUnzip.exe:*:Enabled:cdsUnzip (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdswhich.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdswhich.exe:*:Enabled:cdswhich (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsZip.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cdsZip.exe:*:Enabled:cdsZip (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cds_root.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\cds_root.exe:*:Enabled:cds_root (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsAdminTool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsAdminTool.exe:*:Enabled:clsAdminTool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsbd.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clsbd.exe:*:Enabled:clsbd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clu.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\clu.exe:*:Enabled:clu (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\dregprint.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\dregprint.exe:*:Enabled:dregprint (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\mpsinfo.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\mpsinfo.exe:*:Enabled:mpsinfo (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmp.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmp.exe:*:Enabled:nmp (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmppath.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\nmppath.exe:*:Enabled:nmppath (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\obServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\obServer.exe:*:Enabled Surprised bServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\switchversion.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\switchversion.exe:*:Enabled:switchversion (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\van.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\van.exe:*:Enabled:van (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\versionviewer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\bin\\versionviewer.exe:*:Enabled:versionviewer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\capture.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\capture.exe:*:Enabled:capture (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\comp16.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\comp16.exe:*:Enabled:comp16 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pcadi.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pcadi.exe:*:Enabled:pcadi (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pspiceexplorersrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pspiceexplorersrvr.exe:*:Enabled:pspiceexplorersrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pstswp.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\pstswp.exe:*:Enabled:pstswp (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\regsvr32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\regsvr32.exe:*:Enabled:regsvr32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\sch2cap.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\sch2cap.exe:*:Enabled:sch2cap (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\SETBROWS.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\SETBROWS.EXE:*:Enabled:SETBROWS (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\tutorial\\CAPTUTOR.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\capture\\tutorial\\CAPTUTOR.EXE:*:Enabled:CAPTUTOR (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\cdsdocIndexer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\cdsdocIndexer.exe:*:Enabled:cdsdocIndexer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\obServer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\cdsdoc\\bin\\obServer.exe:*:Enabled Surprised bServer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\mkdefcfg.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\mkdefcfg.exe:*:Enabled:mkdefcfg (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\versiontool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\fet\\bin\\versiontool.exe:*:Enabled:versiontool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\javaws-1_2_0_02-windows-i586-i.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\javaws-1_2_0_02-windows-i586-i.exe:*:Enabled:javaws-1_2_0_02-windows-i586-i (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\java.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\java.exe:*:Enabled:java (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\javaw.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\javaw.exe:*:Enabled:javaw (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\jpicpl32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\jpicpl32.exe:*:Enabled:jpicpl32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\keytool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\keytool.exe:*:Enabled:keytool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\kinit.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\kinit.exe:*:Enabled:kinit (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\klist.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\klist.exe:*:Enabled:klist (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\ktab.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\ktab.exe:*:Enabled:ktab (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\orbd.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\orbd.exe:*:Enabled Surprised rbd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\policytool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\policytool.exe:*:Enabled:policytool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmid.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmid.exe:*:Enabled:rmid (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmiregistry.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\rmiregistry.exe:*:Enabled:rmiregistry (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\servertool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\servertool.exe:*:Enabled:servertool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\tnameserv.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\jre\\bin\\tnameserv.exe:*:Enabled:tnameserv (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\fvupdateutil.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\fvupdateutil.exe:*:Enabled:fvupdateutil (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcad.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcad.exe:*:Enabled:gcad (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcam.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcam.exe:*:Enabled:gcam (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcdin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gcdin.exe:*:Enabled:gcdin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\idfin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\idfin.exe:*:Enabled:idfin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\ipc356.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\ipc356.exe:*:Enabled:ipc356 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\layout.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\layout.exe:*:Enabled:layout (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\libcat.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\libcat.exe:*:Enabled:libcat (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\lsession.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\lsession.exe:*:Enabled:lsession (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\max2hyp.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\max2hyp.exe:*:Enabled:max2hyp (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascb.exe:*:Enabled:maxascb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxascx.exe:*:Enabled:maxascx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxdxf.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxdxf.exe:*:Enabled:maxdxf (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxeco.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxeco.exe:*:Enabled:maxeco (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxfnetx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxfnetx.exe:*:Enabled:maxfnetx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminb.exe:*:Enabled:maxminb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminw.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminw.exe:*:Enabled:maxminw (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxminx.exe:*:Enabled:maxminx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxorcad.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxorcad.exe:*:Enabled:maxorcad (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxp99x.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxp99x.exe:*:Enabled:maxp99x (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadb.exe:*:Enabled:maxpadb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpadx.exe:*:Enabled:maxpadx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadb.exe:*:Enabled:maxpcadb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxpcadx.exe:*:Enabled:maxpcadx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotb.exe:*:Enabled:maxprotb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxprotx.exe:*:Enabled:maxprotx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrb.exe:*:Enabled:maxstrb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxstrx.exe:*:Enabled:maxstrx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangb.exe:*:Enabled:maxtangb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\maxtangx.exe:*:Enabled:maxtangx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\mfceco.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\mfceco.exe:*:Enabled:mfceco (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\orcadodb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\orcadodb.exe:*:Enabled Surprised rcadodb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padb.exe:*:Enabled:padb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\padx.exe:*:Enabled:padx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadb.exe:*:Enabled:pcadb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcadx.exe:*:Enabled:pcadx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcb2max.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\pcb2max.exe:*:Enabled:pcb2max (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\prcat.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\prcat.exe:*:Enabled:prcat (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protb.exe:*:Enabled:protb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\protx.exe:*:Enabled:protx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\searchTool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\searchTool.exe:*:Enabled:searchTool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\setbrows.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\setbrows.exe:*:Enabled:setbrows (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\specin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\specin.exe:*:Enabled:specin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strb.exe:*:Enabled:strb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\strx.exe:*:Enabled:strx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangb.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangb.exe:*:Enabled:tangb (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangx.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tangx.exe:*:Enabled:tangx (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\to386.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\to386.exe:*:Enabled:to386 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\toidf.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\toidf.exe:*:Enabled:toidf (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tomax.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tomax.exe:*:Enabled:tomax (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tospec.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tospec.exe:*:Enabled:tospec (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\update90.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\update90.exe:*:Enabled:update90 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\F2G.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\F2G.EXE:*:Enabled:F2G (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\G2F.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Fonts\\G2F.EXE:*:Enabled:G2F (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\custaped.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\custaped.exe:*:Enabled:custaped (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GERBLINE.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GERBLINE.EXE:*:Enabled:GERBLINE (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\Gerbtool.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\Gerbtool.exe:*:Enabled:Gerbtool (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GT2VIEW.EXE"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\Program\\GT2VIEW.EXE:*:Enabled:GT2VIEW (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\System\\FixTbar.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\gtool\\System\\FixTbar.exe:*:Enabled:FixTbar (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\samples\\demo\\reset.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\samples\\demo\\reset.exe:*:Enabled:reset (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\batch32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\batch32.exe:*:Enabled:batch32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\sroute.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\sroute\\sroute.exe:*:Enabled:sroute (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tutorial\\laytutor.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\tutorial\\laytutor.exe:*:Enabled:laytutor (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\vcadd\\vcadd32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\layout\\vcadd\\vcadd32.exe:*:Enabled:vcadd32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\appmgr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\appmgr.exe:*:Enabled:appmgr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\IndiceFileGeneration.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\IndiceFileGeneration.exe:*:Enabled:IndiceFileGeneration (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\lxcwin.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\lxcwin.exe:*:Enabled:lxcwin (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\Magneticdesigner.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\Magneticdesigner.exe:*:Enabled:Magneticdesigner (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\modeled.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\modeled.exe:*:Enabled:modeled (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\MrkSrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\MrkSrvr.exe:*:Enabled:MrkSrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\msgview.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\msgview.exe:*:Enabled:msgview (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\PDesign.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\PDesign.exe:*:Enabled Razz Design (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psched.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psched.exe:*:Enabled:psched (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspice.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspice.exe:*:Enabled:pspice (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspiceexplorersrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\pspiceexplorersrvr.exe:*:Enabled:pspiceexplorersrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psp_cmd.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\psp_cmd.exe:*:Enabled:psp_cmd (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\regsvr32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\regsvr32.exe:*:Enabled:regsvr32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simmgr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simmgr.exe:*:Enabled:simmgr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simsrvr.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\simsrvr.exe:*:Enabled:simsrvr (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\stmed.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\pspice\\stmed.exe:*:Enabled:stmed (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\bin\\cdsdocIndexer.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\bin\\cdsdocIndexer.exe:*:Enabled:cdsdocIndexer (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\merge.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\merge.exe:*:Enabled:merge (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\mkvdk.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\mkvdk.exe:*:Enabled:mkvdk (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\search.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\search.exe:*:Enabled:search (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\setup.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\setup.exe:*:Enabled:setup (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\v_uninst.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\bin\\v_uninst.exe:*:Enabled:v_uninst (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\callback.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\callback.exe:*:Enabled:callback (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\filter.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\filter.exe:*:Enabled:filter (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmlini.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmlini.exe:*:Enabled:htmlini (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmserv.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\htmserv.exe:*:Enabled:htmserv (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\index.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\index.exe:*:Enabled:index (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jstree.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jstree.exe:*:Enabled:jstree (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jvtree.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\jvtree.exe:*:Enabled:jvtree (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\kvoop.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\kvoop.exe:*:Enabled:kvoop (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\regsvr32.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\regsvr32.exe:*:Enabled:regsvr32 (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\summary.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\summary.exe:*:Enabled:summary (Release OrCAD 10.5)"
"C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\viewers\\amovie.exe"="C:\\OrCAD\\OrCAD_10.5\\tools\\verity\\_nti40\\filters\\viewers\\amovie.exe:*:Enabled:amovie (Release OrCAD 10.5)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Documents and Settings\\62226\\Application Data\\SopCast\\adv\\SopAdver.exe"="C:\\Documents and Settings\\62226\\Application Data\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\FM 2007\\fm.exe"="C:\\Program Files\\FM 2007\\fm.exe:*:Enabled:Football Manager 2007"
"C:\\Program Files\\Festo\\FST4.10\\FST.exe"="C:\\Program Files\\Festo\\FST4.10\\FST.exe:*:Enabled:Festo Software Tools - Programming Tool"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Valve\\hlds.exe"="C:\\Program Files\\Valve\\hlds.exe:*:Enabled:hlds"
"C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"

ismail SG

extra.txt (Part 2)

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\62226\Application Data
CDSROOT=C:\OrCAD\OrCAD_10.5
[email protected]
CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=RP62226Z
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\62226
LM_LICENSE_FILE=C:\OrCAD\OrCAD_10.5\IntelliCAD 4\\cadopia.dat
LOGONSERVER=\\RPDC1
MCC_INCLUDE=C:\Program Files\Microchip\MCC18\h;
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\Microchip\MCC18\mpasm;C:\Program Files\Microchip\MCC18\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\Program Files\Microsoft SQL Server\90\Tools\binn\;C:\OrCAD\OrCAD_10.5\tools\PSpice\Library;C:\OrCAD\OrCAD_10.5\tools\Capture;C:\OrCAD\OrCAD_10.5\tools\bin;C:\OrCAD\OrCAD_10.5\tools\fet\bin;c:\altera\71sp1\quartus\bin;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microchip\MCC18\mpasm;C:\Program Files\Microchip\MCC18\bin;
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 13 Stepping 8, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0d08
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
QUARTUS_ROOTDIR=c:\altera\71sp1\quartus
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\62226\LOCALS~1\Temp
TMP=C:\DOCUME~1\62226\LOCALS~1\Temp
USERDNSDOMAIN=RP.EDU.SG
USERDOMAIN=RP
USERNAME=62226
USERPROFILE=C:\Documents and Settings\62226
VS80COMNTOOLS=C:\Program Files\Microsoft Visual Studio 8\Common7\Tools\
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

rpuser [I](admin)[/I]
Administrator [I](admin)[/I]
darren_soh [I](admin)[/I]
62226 [I](admin)[/I]

-- Add/Remove Programs ---------------------------------------------------------

--> \IsUninst.exe -f"C:\OrCAD\OrCAD_10.5\IntelliCAD 4\\Uninst.isu"
--> C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
a-squared Free 3.0 --> "C:\Program Files\a-squared Free\unins000.exe"
Ad-Aware 2007 --> MsiExec.exe /X{E31C348B-63A9-4CBF-8D7F-D932ABB63244}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003}
Agere Systems HDA Modem --> agrsmdel
ALPS Touch Pad Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}\setup.exe" UNINSTALL
Apple Software Update --> MsiExec.exe /I{A260B422-70E1-41E2-957D-F76FA21266D5}
Belarc Advisor 7.2 --> C:\PROGRA~1\Belarc\Advisor\Uninstall.exe C:\PROGRA~1\Belarc\Advisor\INSTALL.LOG
CADopia IntelliCAD 4 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{BB4B8FCF-44B4-4957-B92F-5F5A631AF629}
CDBurnerXP Pro 3 --> MsiExec.exe /I{896D642C-7125-44F0-AC49-A23ABF82209C}
Compatibility Pack for the 2007 Office system --> MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
CompuApps SwissKnife V3 --> C:\WINDOWS\ISUNINST.EXE -fC:\SWISNIFE\SKUninst.ISU -cC:\SWISNIFE\SKUNINST.DLL
Counter-Strike 1.6 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}\Setup.exe" -l0x9
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter --> C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
EasyCleaner --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F5346614-B7C4-4E94-826A-E2363155233D}\setup.exe" -l0x9 -removeonly
Fingerprint Sensor Minimum Install --> MsiExec.exe /I{4FFD7BBB-A688-4728-B6E7-5C8C102991F8}
Football Manager 2008 Gold Demo --> "C:\Program Files\Sports Interactive\Football Manager 2008 Gold Demo\Uninstall_Football Manager 2008 Gold Demo\Uninstall Football Manager 2008 Gold Demo.exe"
FST 4.10 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{05C99361-CD80-49AF-A3BD-72FF464C78CB}\setup.exe"
Fujitsu Display Manager --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{3703B471-08F1-40F6-9DBF-DACFE74DBFCC}
Fujitsu Hotkey Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{675F445D-0944-48DC-962E-DE2E9707AE8E}\setup.exe"
Hamachi 1.0.2.3 --> C:\Program Files\Hamachi\uninstall.exe
High Definition Audio Driver Package - KB835221 --> C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 1.99.1 --> C:\Documents and Settings\62226\My Documents\spyware_attack\HijackThis.exe /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Intel(R) Graphics Media Accelerator Driver for Mobile --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2792 PCI\VEN_8086&DEV_2592
Intel(R) PROSet/Wireless Software --> C:\WINDOWS\Installer\iProInst.exe
J2SE Runtime Environment 5.0 Update 12 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120}
JLC's Internet TV --> "C:\Program Files\JLC's Software\Internet TV\Uninstall.exe"
Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
LifeBook Application Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F403DD9-5A80-46DC-AAEC-9C743121E8B8}\setup.exe"
LiveUpdate 3.1 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
mCore --> MsiExec.exe /I{E81667C6-2856-46D6-ABEA-6A2F42166779}
mDriver --> MsiExec.exe /I{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}
mDrWiFi --> MsiExec.exe /I{90CC4231-94AC-45CD-991A-0253BFAC0650}
mHelp --> MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft Age of Empires Gold --> "C:\Program Files\Microsoft Games\Age of Empires\UNINSTAL.EXE" /runtemp
Microsoft Age of Empires II --> "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTAL.EXE" /runtemp /uninstall
Microsoft Age of Empires II: The Conquerors Expansion --> "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTALX.EXE" /runtemp /addremove
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Device Emulator version 1.0 - ENU --> MsiExec.exe /X{78B75C6D-E53C-424C-BF83-4B63BD4A6682}
Microsoft Document Explorer 2005 --> C:\Program Files\Common Files\Microsoft Shared\Help 8\Microsoft Document Explorer 2005\install.exe
Microsoft Document Explorer 2005 --> MsiExec.exe /X{44D4AF75-6870-41F5-9181-662EA05507E1}
Microsoft Encarta Reference Library 2005 --> MsiExec.exe /I{054100C0-64A6-4248-A026-9745C1E9E159}
Microsoft Office Communicator 2005 --> MsiExec.exe /X{BE5AD430-9E0C-4243-AB3F-593835869855}
Microsoft Office FrontPage 2003 --> MsiExec.exe /I{90170409-6000-11D3-8CFE-0150048383C9}
Microsoft Office OneNote 2003 --> MsiExec.exe /I{90A10409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server 2005 --> "c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS) --> MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
Microsoft SQL Server 2005 Mobile [ENU] Developer Tools --> MsiExec.exe /X{1389C6A4-4965-4AEC-9175-08B54A10FA48}
Microsoft SQL Server 2005 Tools Express Edition --> MsiExec.exe /I{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}
Microsoft SQL Server Native Client --> MsiExec.exe /I{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}
Microsoft SQL Server Setup Support Files (English) --> MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
Microsoft SQL Server VSS Writer --> MsiExec.exe /I{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}
Microsoft Text-to-Speech Engine 4.0 (English) --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msTTSf22.inf, Uninstall
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual J# .NET Redistributable Package 1.1 --> MsiExec.exe /X{1A655D51-1423-48A3-B748-8F5A0BE294C8}
Microsoft Visual J# 2.0 Redistributable Package --> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft Visual J# 2.0 Redistributable Package\install.exe
Microsoft Visual Studio 2005 Professional Edition - ENU --> C:\Program Files\Microsoft Visual Studio 8\Microsoft Visual Studio 2005 Professional Edition - ENU\setup.exe
mIWA --> MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mLogView --> MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse --> MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Mozilla Firefox (2.0.0.4) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
mPfMgr --> MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz --> MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
MPLAB C18 v3.12 Student Edition --> C:\PROGRA~1\MICROC~1\MCC18\UNWISE.EXE C:\PROGRA~1\MICROC~1\MCC18\install.log
MPLAB Tools v7.60 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{C7F724D5-E65E-4F08-9836-13D85961F1C7}
mProSafe --> MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSDN Library for Visual Studio 2005 --> msiexec /i {23959E96-A80F-4172-A655-210E9BB7BFBE}
MSDN Library for Visual Studio 2005 --> MsiExec.exe /X{23959E96-A80F-4172-A655-210E9BB7BFBE}
MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
mWlsSafe --> MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML --> MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig --> MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023}
nLite 1.3.5 --> "C:\Program Files\nLite\unins000.exe"
Notebook Hardware Control 2.0 Pre-Release-06 --> C:\Program Files\Notebook Hardware Control\uninst.exe
O2Micro Flash Memory Card Windows Driver --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{3BB2AA79-6623-48F4-B288-0CE1C88D40D6} /l1033
PC Inspector smart recovery --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C9A87D86-FDFD-418B-BF96-EF09320973B3}\Setup.exe" -l0x9
PerformanceTest v6.1 --> "C:\Program Files\PerformanceTest\unins000.exe"
Quartus II 7.1sp1 Web Edition --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E0E77FF6-B30D-4A75-B0DA-B5FD74A69D92}\setup.exe" -l0x9 -removeonly
QuickTime --> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Release OrCAD 10.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24D0A76F-34E1-43F7-B972-0608518CD2A7}\setup.exe" -l0x9 Uninstall
Shockwave --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
SopCore 1.1.1 --> C:\Program Files\SopCast\uninst.exe
Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SpywareGuard v2.2 --> "C:\Program Files\SpywareGuard\unins000.exe"
Symantec AntiVirus --> MsiExec.exe /I{50E125D1-88E5-48CE-80AE-98EC9698E639}
SyncBack --> "C:\Program Files\2BrightSparks\SyncBack\unins000.exe"
Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
Unlocker 1.8.5 --> C:\Program Files\Unlocker\uninst.exe
UTClient --> MsiExec.exe /I{0342769B-E5A6-443E-99E7-64E87944EB94}
VideoLAN VLC media player 0.8.6c --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Communication Foundation --> MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Defender --> MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Desktop Search 3.01 --> "C:\WINDOWS\$NtUninstallKB917013$\spuninst\spuninst.exe"
Windows Driver Package - Intel (NETw4x32) net (04/27/2007 11.1.0.100) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\netw4x32_54BC9A4CDAD45F7642AB13880E7DCA269C0D9872\netw4x32.inf
Windows Driver Package - Intel (w29n51) net (02/08/2007 9.0.4.33) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\w29n51_3219C3E9682004CC6857361A4203A8986CCEB210\w29n51.inf
Windows Driver Package - Intel net (04/27/2007 11.1.0.100) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\netw4k32_FBA3E4F614DF518FF71D2D45241FED64D86F4274\netw4k32.inf
Windows Driver Package - Intel net (04/27/2007 11.1.0.100) --> C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u C:\WINDOWS\system32\DRVSTORE\netw4x64_C416A3ACB8C9AD10C315CC9B73B7B5A714B69D67\netw4x64.inf
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger --> MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Rights Management Client --> MsiExec.exe /X{3192A00C-7336-48C6-8BD7-54B9CFA6F7C1}
Windows Rights Management Client Backwards Compatibility --> MsiExec.exe /X{EC905264-BCFE-423B-9C42-C3A106266790}
Windows Workflow Foundation --> MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
XML Paper Specification Shared Components Pack 1.0 -->
XP Codec Pack --> C:\Program Files\XP Codec Pack\Uninstall.exe

-- Application Event Log -------------------------------------------------------

Event Record #/Type17563 / Error
Event Submitted/Written: 01/04/2008 09:24:57 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: with error: The data is invalid.

Event Record #/Type17561 / Error
Event Submitted/Written: 01/04/2008 09:13:23 PM
Event ID/Source: 1000 / UserInit
Event Description:
Could not execute the following script rpstorage.bat. The system cannot find the file specified.
.

Event Record #/Type17560 / Error
Event Submitted/Written: 01/04/2008 09:13:23 PM
Event ID/Source: 1000 / UserInit
Event Description:
Could not execute the following script advclient.bat. The system cannot find the file specified.
.

Event Record #/Type17559 / Error
Event Submitted/Written: 01/04/2008 09:12:49 PM
Event ID/Source: 1054 / Userenv
Event Description:
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Event Record #/Type17558 / Error
Event Submitted/Written: 01/04/2008 09:10:29 PM
Event ID/Source: 15 / AutoEnrollment
Event Description:
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted.
Enrollment will not be performed.

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type25922 / Error
Event Submitted/Written: 01/04/2008 09:10:21 PM
Event ID/Source: 10020 / DCOM
Event Description:
The machine wide Default Launch and Activation security descriptor is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Event Record #/Type25921 / Error
Event Submitted/Written: 01/04/2008 09:10:21 PM
Event ID/Source: 10020 / DCOM
Event Description:
The machine wide Default Launch and Activation security descriptor is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Event Record #/Type25911 / Error
Event Submitted/Written: 01/04/2008 09:09:45 PM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The Flexlm service terminated unexpectedly. It has done this 1 time(s).

Event Record #/Type25909 / Error
Event Submitted/Written: 01/04/2008 09:09:42 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Microchip MPLAB ICD 2 Firmware Client Driver (ICD2W2K.SYS) service failed to start due to the following error:
%%1058

Event Record #/Type25908 / Error
Event Submitted/Written: 01/04/2008 09:09:41 PM
Event ID/Source: 10020 / DCOM
Event Description:
The machine wide Default Launch and Activation security descriptor is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

-- End of Deckard's System Scanner: finished at 2008-01-04 21:25:41 ------------

ndmmxiaomayi SG

Next...

Copy and paste the following in blue into Notepad:

sc del 30023B3C
pause

Click on File > Save As....

In the File Name box, copy and paste in del.bat

In the Save As Type box, select All Files from the drop-down list.

Click Save.

Double click on del.bat to run it. Command Prompt will open and close quickly; this is normal.

ismail SG

I've done that already. Is there anything else that needs to be done.

I just press enter twice after I double-click on del.bat. It shows a command prompt screen.

Just curious, why do I need to do so many steps?

dualplex SG

this is the manual but the best way to ensure that the malware is cleared off totally… dont trust anti-virus programs…

ismail SG

I appreciate the assistance given and I find it very useful for troubleshooting next time.

Thank You. Very Happy

ndmmxiaomayi SG

Only 2 ma...

Because you have a thumb drive virus.

Did the command went by smoothly?

ismail SG

Yeah..it went smoothly. This virus is circulating around RP as you know.