; [FireLion] System SnapShot 1.0
; Scan time at 12/31/2007 8:58:36 PM

[System Information]
Microsoft Windows: XP Professional Service Pack 2 Build 2600 (5.1.2600)
Product Name: Microsoft Windows XP 2600.xpsp_sp2_gdr.070227-2254
Computer Name: PINOCCHINO
Language: Vietnamese
User Name: Pino
Boot Mode: Normal Mode
UpTime: 0 Days 0 Hours 5 Minutes 22 Seconds
CPU: GenuineIntel 1x2143.74 MHz
RAM Total: 512 MB
RAM Free: 169 MB
Windows Folder: C:\WINDOWS\
System32 Folder: C:\WINDOWS\system32\
LocalIP: 192.168.1.33
DNS: 192.168.1.1
Microsoft Internet Explorer: 7.0.5730.11

[MD5 = Running Processes]
bd7fb0957c716f1a60333aee04de2178 = C:\WINDOWS\System32\smss.exe
f12b178b1678d778cfd3ff1fc38c71fb = C:\WINDOWS\system32\csrss.exe
01c3346c241652f43aed8e2149881bfe = C:\WINDOWS\system32\winlogon.exe
c6ce6eec82f187615d1002bb3bb50ed4 = C:\WINDOWS\system32\services.exe
84885f9b82f4d55c6146ebf6065d75d2 = C:\WINDOWS\system32\lsass.exe
8f078ae4ed187aaabc0a305146de6716 = C:\WINDOWS\system32\svchost.exe
8f078ae4ed187aaabc0a305146de6716 = C:\WINDOWS\system32\svchost.exe
8f078ae4ed187aaabc0a305146de6716 = C:\WINDOWS\System32\svchost.exe
8f078ae4ed187aaabc0a305146de6716 = C:\WINDOWS\system32\svchost.exe
8f078ae4ed187aaabc0a305146de6716 = C:\WINDOWS\system32\svchost.exe
a315b77b1afeab2b157d790c423c60c5 = C:\WINDOWS\Explorer.EXE
da81ec57acd4cdc3d4c51cf3d409af9f = C:\WINDOWS\system32\spoolsv.exe
d88499d10981dfb9e5226ed8cf27ab13 = C:\WINDOWS\asuskbservice.exe
921734b3947b4ae7068a587aa1a553f3 = C:\Program Files\FireLion Softwares\FastHelper\ResidentShield.exe
cdb38c46a5a287ffa4c4edbc2db562ec = C:\WINDOWS\system32\nvsvc32.exe
7faa14b56d5797d5aaf9bd55728a5e5c = C:\Program Files\FireLion Softwares\FastHelper\FastHelper.exe
c7048e3dd4d9fa3af7bc2747ef5c433f = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
e2878cc39db71606f2f77186a0fd16de = C:\Program Files\UniKey\UniKeyNT.exe
7bf2d3a10da0149a5b95261bd000c68f = C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
aceb501dc6253d26039cde2fe82a5576 = C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
24232996a38c0b0cf151c2140ae29fc8 = C:\WINDOWS\system32\ctfmon.exe
769615ac4db67ee0db7629d79e5b7849 = C:\WINDOWS\Visualtooltip\VisualToolTip.exe
ff4d73b16ea3a32d34ceb3a7bc3c3773 = C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
f1958fbf86d5c004cf19a5951a9514b7 = C:\WINDOWS\System32\alg.exe
cf45e5f12eba630ba563950b1a64d241 = C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
f3e9065eb617a7e3a832a7976bfa021b = C:\WINDOWS\system32\wuauclt.exe
9f88a377b50f7b26cf90029e1ac3d1a0 = C:\Program Files\Internet Explorer\iexplore.exe
01b4c50fb23888e91d098f2259922477 = D:\Downloads\Compressed\SystemSnapShot.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
FastHelper = "C:\Program Files\FireLion Softwares\FastHelper\FastHelper.exe" /startup

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Yahoo! Pager = "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
UniKey = C:\Program Files\UniKey\UniKeyNT.exe
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
TaskSwitchXP = C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

[Services]
ACPI = system32\DRIVERS\ACPI.sys
aec = system32\drivers\aec.sys
AFD = \SystemRoot\System32\drivers\afd.sys
agp440 = system32\DRIVERS\agp440.sys
ALCXSENS = system32\drivers\ALCXSENS.SYS
ALCXWDM = system32\drivers\ALCXWDM.SYS
Alerter = %SystemRoot%\system32\svchost.exe -k LocalService
ALG = %SystemRoot%\System32\alg.exe
ANVIOCTL = system32\DRIVERS\anvioctl.sys
AppMgmt = %SystemRoot%\system32\svchost.exe -k netsvcs
asuskbnt = system32\DRIVERS\asuskbnt.sys
ASUSKeyboardService = %SystemRoot%\asuskbservice.exe
AsyncMac = system32\DRIVERS\asyncmac.sys
atapi = system32\DRIVERS\atapi.sys
Atmarpc = system32\DRIVERS\atmarpc.sys
AudioSrv = %SystemRoot%\System32\svchost.exe -k netsvcs
audstub = system32\DRIVERS\audstub.sys
AVG Anti-Rootkit = System32\DRIVERS\avgarkt.sys
AvgArCln = System32\DRIVERS\AvgArCln.sys
BITS = %SystemRoot%\system32\svchost.exe -k netsvcs
Browser = %SystemRoot%\system32\svchost.exe -k netsvcs
Cdrom = system32\DRIVERS\cdrom.sys
CiSvc = %SystemRoot%\system32\cisvc.exe
ClipSrv = %SystemRoot%\system32\clipsrv.exe
COMSysApp = C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
CryptSvc = %SystemRoot%\system32\svchost.exe -k netsvcs
DcomLaunch = %SystemRoot%\system32\svchost -k DcomLaunch
Dhcp = %SystemRoot%\system32\svchost.exe -k netsvcs
Disk = system32\DRIVERS\disk.sys
dmadmin = %SystemRoot%\System32\dmadmin.exe /com
dmboot = System32\drivers\dmboot.sys
dmio = System32\drivers\dmio.sys
dmload = System32\drivers\dmload.sys
dmserver = %SystemRoot%\System32\svchost.exe -k netsvcs
DMusic = system32\drivers\DMusic.sys
Dnscache = %SystemRoot%\system32\svchost.exe -k NetworkService
drmkaud = system32\drivers\drmkaud.sys
EIO = \??\C:\WINDOWS\system32\drivers\EIO.sys
ERSvc = %SystemRoot%\System32\svchost.exe -k netsvcs
Eventlog = %SystemRoot%\system32\services.exe
EventSystem = C:\WINDOWS\system32\svchost.exe -k netsvcs
FastHelper = C:\Program Files\FireLion Softwares\FastHelper\ResidentShield.exe
FastUserSwitchingCompatibility = %SystemRoot%\System32\svchost.exe -k netsvcs
FltMgr = system32\DRIVERS\fltMgr.sys
Ftdisk = system32\DRIVERS\ftdisk.sys
gameenum = system32\DRIVERS\gameenum.sys
Gpc = system32\DRIVERS\msgpc.sys
gusvc = "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
helpsvc = %SystemRoot%\System32\svchost.exe -k netsvcs
HidServ = %SystemRoot%\System32\svchost.exe -k netsvcs
HTTP = System32\Drivers\HTTP.sys
HTTPFilter = %SystemRoot%\System32\svchost.exe -k HTTPFilter
i8042prt = system32\DRIVERS\i8042prt.sys
Imapi = system32\DRIVERS\imapi.sys
ImapiService = C:\WINDOWS\system32\imapi.exe
IntelIde = system32\DRIVERS\intelide.sys
intelppm = system32\DRIVERS\intelppm.sys
Ip6Fw = system32\DRIVERS\Ip6Fw.sys
IpFilterDriver = system32\DRIVERS\ipfltdrv.sys
IpInIp = system32\DRIVERS\ipinip.sys
IpNat = system32\DRIVERS\ipnat.sys
IPSec = system32\DRIVERS\ipsec.sys
IRENUM = system32\DRIVERS\irenum.sys
isapnp = system32\DRIVERS\isapnp.sys
Kbdclass = system32\DRIVERS\kbdclass.sys
kmixer = system32\drivers\kmixer.sys
lanmanserver = %SystemRoot%\system32\svchost.exe -k netsvcs
lanmanworkstation = %SystemRoot%\system32\svchost.exe -k netsvcs
LmHosts = %SystemRoot%\system32\svchost.exe -k LocalService
Messenger = %SystemRoot%\system32\svchost.exe -k netsvcs
mnmsrvc = C:\WINDOWS\system32\mnmsrvc.exe
Mouclass = system32\DRIVERS\mouclass.sys
MRxDAV = system32\DRIVERS\mrxdav.sys
MRxSmb = system32\DRIVERS\mrxsmb.sys
MSDTC = C:\WINDOWS\system32\msdtc.exe
MSIServer = C:\WINDOWS\system32\msiexec.exe /V
MSKSSRV = system32\drivers\MSKSSRV.sys
MSPCLOCK = system32\drivers\MSPCLOCK.sys
MSPQM = system32\drivers\MSPQM.sys
mssmbios = system32\DRIVERS\mssmbios.sys
NdisTapi = system32\DRIVERS\ndistapi.sys
Ndisuio = system32\DRIVERS\ndisuio.sys
NdisWan = system32\DRIVERS\ndiswan.sys
NetBIOS = system32\DRIVERS\netbios.sys
NetBT = system32\DRIVERS\netbt.sys
NetDDE = %SystemRoot%\system32\netdde.exe
NetDDEdsdm = %SystemRoot%\system32\netdde.exe
Netlogon = %SystemRoot%\system32\lsass.exe
Netman = %SystemRoot%\System32\svchost.exe -k netsvcs
Nla = %SystemRoot%\system32\svchost.exe -k netsvcs
NMIndexingService = "C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe"
NtLmSsp = %SystemRoot%\system32\lsass.exe
NtmsSvc = %SystemRoot%\system32\svchost.exe -k netsvcs
nv = system32\DRIVERS\nv4_mini.sys
NVSvc = %SystemRoot%\system32\nvsvc32.exe
NwlnkFlt = system32\DRIVERS\nwlnkflt.sys
NwlnkFwd = system32\DRIVERS\nwlnkfwd.sys
Parport = system32\DRIVERS\parport.sys
PCI = system32\DRIVERS\pci.sys
PCIIde = system32\DRIVERS\pciide.sys
PlugPlay = %SystemRoot%\system32\services.exe
PolicyAgent = %SystemRoot%\system32\lsass.exe
PptpMiniport = system32\DRIVERS\raspptp.sys
ProtectedStorage = %SystemRoot%\system32\lsass.exe
PSched = system32\DRIVERS\psched.sys
Ptilink = system32\DRIVERS\ptilink.sys
RasAcd = system32\DRIVERS\rasacd.sys
RasAuto = %SystemRoot%\system32\svchost.exe -k netsvcs
Rasl2tp = system32\DRIVERS\rasl2tp.sys
RasMan = %SystemRoot%\system32\svchost.exe -k netsvcs
RasPppoe = system32\DRIVERS\raspppoe.sys
Raspti = system32\DRIVERS\raspti.sys
Rdbss = system32\DRIVERS\rdbss.sys
RDPCDD = System32\DRIVERS\RDPCDD.sys
rdpdr = system32\DRIVERS\rdpdr.sys
RDSessMgr = C:\WINDOWS\system32\sessmgr.exe
redbook = system32\DRIVERS\redbook.sys
RemoteAccess = %SystemRoot%\system32\svchost.exe -k netsvcs
RemoteRegistry = %SystemRoot%\system32\svchost.exe -k LocalService
RpcLocator = %SystemRoot%\system32\locator.exe
RpcSs = %SystemRoot%\system32\svchost -k rpcss
RSVP = %SystemRoot%\system32\rsvp.exe
SamSs = %SystemRoot%\system32\lsass.exe
SCardSvr = %SystemRoot%\System32\SCardSvr.exe
Schedule = %SystemRoot%\System32\svchost.exe -k netsvcs
Secdrv = system32\DRIVERS\secdrv.sys
seclogon = %SystemRoot%\System32\svchost.exe -k netsvcs
SENS = %SystemRoot%\system32\svchost.exe -k netsvcs
serenum = system32\DRIVERS\serenum.sys
Serial = system32\DRIVERS\serial.sys
SharedAccess = %SystemRoot%\system32\svchost.exe -k netsvcs
ShellHWDetection = %SystemRoot%\System32\svchost.exe -k netsvcs
splitter = system32\drivers\splitter.sys
Spooler = %SystemRoot%\system32\spoolsv.exe
sptd = System32\Drivers\sptd.sys
sr = \SystemRoot\system32\DRIVERS\sr.sys
srservice = %SystemRoot%\system32\svchost.exe -k netsvcs
Srv = system32\DRIVERS\srv.sys
SSDPSRV = %SystemRoot%\system32\svchost.exe -k LocalService
stisvc = %SystemRoot%\system32\svchost.exe -k imgsvc
swenum = system32\DRIVERS\swenum.sys
swmidi = system32\drivers\swmidi.sys
SwPrv = C:\WINDOWS\system32\dllhost.exe /Processid:{21D0DA2D-B97D-49CD-B800-1B6F78181ECD}
sysaudio = system32\drivers\sysaudio.sys
SysmonLog = %SystemRoot%\system32\smlogsvc.exe
TapiSrv = %SystemRoot%\System32\svchost.exe -k netsvcs
Tcpip = system32\DRIVERS\tcpip.sys
TermDD = system32\DRIVERS\termdd.sys
TermService = %SystemRoot%\System32\svchost -k DComLaunch
Themes = %SystemRoot%\System32\svchost.exe -k netsvcs
TlntSvr = C:\WINDOWS\system32\tlntsvr.exe
TrkWks = %SystemRoot%\system32\svchost.exe -k netsvcs
UnlockerDriver5 = \??\C:\Program Files\Unlocker\UnlockerDriver5.sys
Update = system32\DRIVERS\update.sys
upnphost = %SystemRoot%\system32\svchost.exe -k LocalService
UPS = %SystemRoot%\System32\ups.exe
usbehci = system32\DRIVERS\usbehci.sys
usbhub = system32\DRIVERS\usbhub.sys
usbstor = system32\DRIVERS\USBSTOR.SYS
usbuhci = system32\DRIVERS\usbuhci.sys
VgaSave = \SystemRoot\System32\drivers\vga.sys
VSS = %SystemRoot%\System32\vssvc.exe
vulfnths = \SystemRoot\System32\Drivers\vulfnth.sys
vulfntrs = \SystemRoot\System32\Drivers\vulfntr.sys
W32Time = %SystemRoot%\System32\svchost.exe -k netsvcs
Wanarp = system32\DRIVERS\wanarp.sys
wdmaud = system32\drivers\wdmaud.sys
WebClient = %SystemRoot%\system32\svchost.exe -k LocalService
winmgmt = %systemroot%\system32\svchost.exe -k netsvcs
WinMTBus = system32\DRIVERS\WinMTBus.sys
WmdmPmSN = %SystemRoot%\System32\svchost.exe -k netsvcs
Wmi = %SystemRoot%\System32\svchost.exe -k netsvcs
WmiApSrv = C:\WINDOWS\system32\wbem\wmiapsrv.exe
WMPNetworkSvc = "C:\Program Files\Windows Media Player\WMPNetwk.exe"
WS2IFSL = \SystemRoot\System32\drivers\ws2ifsl.sys
wscsvc = %SystemRoot%\System32\svchost.exe -k netsvcs
wuauserv = %systemroot%\system32\svchost.exe -k netsvcs
WudfPf = system32\DRIVERS\WudfPf.sys
WudfRd = system32\DRIVERS\wudfrd.sys
WudfSvc = %SystemRoot%\system32\svchost.exe -k WudfServiceGroup
WZCSVC = %SystemRoot%\System32\svchost.exe -k netsvcs
xmlprov = %SystemRoot%\System32\svchost.exe -k netsvcs
yukonwxp = system32\DRIVERS\yukonwxp.sys

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Search Page = http://www.google.com
Start Page = about:blank

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell = explorer.exe
Userinit = C:\Windows\system32\userinit.exe,
VmApplet = rundll32 shell32,Control_RunDLL "sysdm.cpl"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
StartupPrograms = rdpclip
CfgDll = RDPCFGEX.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} = shell32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
{438755C2-A8BA-11D1-B96B-00A0C90312E1} = %SystemRoot%\system32\browseui.dll
{8C7461EF-2B13-11d2-BE35-3078302C2030} = %SystemRoot%\system32\browseui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects]
{0055C089-8582-441B-A0BF-17B458C2A3A8} = C:\Program Files\Internet Download Manager\IDMIECC.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} = c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} = C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} = C:\WINDOWS\system32\ieframe.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
{0561EC90-CE54-4f0c-9C55-E226110A740C} = 
{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll
{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll
{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll
{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
BootExecute = autocheck autochk *

HKEY_CURRENT_USER\Control Panel\Desktop
SCRNSAVE.EXE = %SYSTEMROOT%\system32\Fedora.scr

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
crypt32chain = crypt32.dll
cryptnet = cryptnet.dll
cscdll = cscdll.dll
ScCertProp = wlnotify.dll
Schedule = wlnotify.dll
sclgntfy = sclgntfy.dll
SensLogn = WlNotify.dll
termsrv = wlnotify.dll
wlballoon = wlnotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries]
000000000001 = C:\WINDOWS\system32\idmmbc.dll
000000000002 = C:\WINDOWS\system32\idmmbc.dll
000000000003 = C:\WINDOWS\system32\idmmbc.dll
000000000004 = C:\WINDOWS\system32\idmmbc.dll
000000000005 = C:\WINDOWS\system32\idmmbc.dll
000000000006 = C:\WINDOWS\system32\mswsock.dll
000000000007 = C:\WINDOWS\system32\mswsock.dll
000000000008 = C:\WINDOWS\system32\mswsock.dll
000000000009 = C:\WINDOWS\system32\rsvpsp.dll
000000000010 = C:\WINDOWS\system32\rsvpsp.dll
000000000011 = C:\WINDOWS\system32\idmmbc.dll
000000000012 = C:\WINDOWS\system32\mswsock.dll
000000000013 = C:\WINDOWS\system32\mswsock.dll
000000000014 = C:\WINDOWS\system32\mswsock.dll
000000000015 = C:\WINDOWS\system32\mswsock.dll
000000000016 = C:\WINDOWS\system32\mswsock.dll
000000000017 = C:\WINDOWS\system32\mswsock.dll

[Hosts]
127.0.0.1       localhost

[AutoRun]
open=RUNAUT~1\autorun.pif
shell\1=´̣¿ª(&O)
shell\1\Command=RUNAUT~1\autorun.pif
shell\2\=ä¯ÀÀ(&B)
shell\2\Command=RUNAUT~1\autorun.pif
shellexecute=RUNAUT~1\autorun.pif