 ""
 ,   .  .   .  .  ,    .  . 

Regshot 1.8.2
:
 :2008/3/4 06:45:08  ,  2008/3/4 06:45:55

----------------------------------
 :6
----------------------------------
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\hiv
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hiv
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hiv\OpenWithList
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\6
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\Bags\482
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\Bags\482\Shell

----------------------------------
 :2
----------------------------------
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\MTTT: 88 01 00 00 72 5A 2D 46 C3 7D C8 01 00 00 00 00
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\Common\Assistant\CurrAsstState: 0x00000026

----------------------------------
 :9
----------------------------------
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\j: 72 00 65 00 67 00 73 00 68 00 6F 00 74 00 2E 00 65 00 78 00 65 00 00 00 43 00 3A 00 5C 00 54 00 45 00 4D 00 50 00 00 00
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\hiv\a: "C:\TEMP\1 snimok.hiv"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\hiv\MRUList: "a"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hiv\OpenWithList\a: "regshot.exe"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hiv\OpenWithList\MRUList: "a"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\6: 34 00 31 00 00 00 00 00 6E 37 6F 57 10 00 54 45 4D 50 00 00 20 00 03 00 04 00 EF BE 6E 37 6D 57 64 38 CB 31 14 00 00 00 54 00 45 00 4D 00 50 00 00 00 14 00 00 00
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\6\NodeSlot: 0x000001E2
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\6\MRUListEx: FF FF FF FF
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\Bags\482\Shell\FolderType: "Documents"

----------------------------------
 :13
----------------------------------
HKLM\SOFTWARE\Microsoft\Jet\4.0\Engines\SandBoxMode: 0x00000003
HKLM\SOFTWARE\Microsoft\Jet\4.0\Engines\SandBoxMode: 0x00000002
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9140110900063D11C8EF10054038389C\Usage\ProductFiles: 0x3864001F
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9140110900063D11C8EF10054038389C\Usage\ProductFiles: 0x38640020
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9140110900063D11C8EF10054038389C\Usage\ProductNonBootFiles: 0x38640018
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9140110900063D11C8EF10054038389C\Usage\ProductNonBootFiles: 0x3864001A
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\MTTF: 0x0000268E
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\MTTF: 0x000026BD
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\MTTA: 0x0000268E
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\MTTA: 0x000026BD
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\Security\Level: 0x00000002
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Office\11.0\Access\Security\Level: 0x00000001
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\MRUList: "fiaghebdc"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU\MRUList: "jfiaghebdc"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\MRUList: "adicjebfgh"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\MRUList: "hadicjebfg"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\h: "C:\TEMP\1 snimok.hiv"
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\MRUListEx: 00 00 00 00 10 00 00 00 01 00 00 00 02 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 0F 00 00 00 03 00 00 00 04 00 00 00 0E 00 00 00 0C 00 00 00 0D 00 00 00 0B 00 00 00 0A 00 00 00 09 00 00 00 08 00 00 00 FF FF FF FF
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\MRUListEx: 00 00 00 00 05 00 00 00 10 00 00 00 01 00 00 00 02 00 00 00 06 00 00 00 07 00 00 00 0F 00 00 00 03 00 00 00 04 00 00 00 0E 00 00 00 0C 00 00 00 0D 00 00 00 0B 00 00 00 0A 00 00 00 09 00 00 00 08 00 00 00 FF FF FF FF
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\MRUListEx: 02 00 00 00 00 00 00 00 05 00 00 00 01 00 00 00 04 00 00 00 03 00 00 00 FF FF FF FF
HKU\S-1-5-21-790525478-920026266-725345543-1008\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0\1\MRUListEx: 06 00 00 00 02 00 00 00 00 00 00 00 05 00 00 00 01 00 00 00 04 00 00 00 03 00 00 00 FF FF FF FF
HKU\S-1-5-21-790525478-920026266-725345543-1008\SessionInformation\ProgramCount: 0x00000003
HKU\S-1-5-21-790525478-920026266-725345543-1008\SessionInformation\ProgramCount: 0x00000002

----------------------------------
 :30
----------------------------------
