...trojan downloader CR64.... - Printable Version

...trojan downloader CR64.... - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Skype & Technology (/forumdisplay.php?fid=9)
+---- Forum: Tech Talk (/forumdisplay.php?fid=17)
+----- Thread: ...trojan downloader CR64.... (/showthread.php?tid=43461)

...trojan downloader CR64.... by aNILEator on 04-23-2005 at 10:19 AM

Microsoft anti spyware keeps detecting this, yet everytime i say REMOVE it says it has removed it.

But then next start up pop there it is again, and i can't find the location of it in microsoft anti spyware i was expecting a box like

C:\WINDOWS\Monkey monkey blah blah\naughty trojan here.exe

but i can't find it anyehere, i've resorted to just allowing it to run and for it to ignore it, but thats not a great thing to do really so just wondering if anyone knew what the f--k it was and how to get rid of it

RE: ...trojan downloader CR64.... by absorbation on 04-23-2005 at 10:36 AM

Maybe the register key needs to be deleted or the .exe is a hidden file. Search for it and show hidden files

RE: ...trojan downloader CR64.... by Sunshine on 04-23-2005 at 10:43 AM

A quick search on CR64 didn't get me anywhere, no info on the trojan to be found. Could it be the trojan is still in one of the sysrestore files or in memory?

Try a scan in safemode. Additionally you can do a scan with AdAware SE, Spybot S&D or Avert Stinger.

RE: ...trojan downloader CR64.... by aNILEator on 04-23-2005 at 11:52 AM

i doubt the file is called trojan.downloader.CR64 etc

I scanned with all of my other spyware utilities (afterall It's what i do as a little job, cleaning up peoples computers of viruses and spyware with various tools and applications)

None of the others found it i'm just assuming that Microsofts thing is shite :refuck:

I don't see how it could be in system restore as i have it turned off *-)

RE: ...trojan downloader CR64.... by Sunshine on 04-23-2005 at 12:39 PM

Lol, could it be Microsoft AntiSpyware is making things up..i mean if a trojan named like that exists there should be something about it on the web somewhere (unless its really really new)? After all that's been said about that program i seriously doubt if it's any good.

[slightly offtopic]

On Dutch forums i helped someone out who uses it too (her MSNM sounds stopped working..in the end it turned out it was MSN7 Universal Patcherplusplus downloaded from Mastaline causing these problems), it even alerts when the sponsor aint installed. I adviced a clean install of both MSNM and Plus! (with removal of folders before reinstalling).

It said the following Msg Plus! 2 regkeys are infected (old news i know but it's another example of MS Antispyware messing up, updates always install into the same folder..in this case Plus! used some things from an old folder):

Infected registry keys/values detected
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@aO]GoivMtkrYgNqok SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts ContactNotifDefName 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\colornick.dll IsNative 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\colornick.dll Enable 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\colornick.dll ModifTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\msnhandwriting.dll IsNative 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\msspeechformsgplus.dll IsNative 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\msspeechformsgplus.dll Enable 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\Plugins\msspeechformsgplus.dll ModifTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText00 Message /me kletst (!N) met een grote stinkende forel...
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText00 Alias Slap
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@ni_KfmoUjoeiH_KU SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText00 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText01 Message /me geeft een (!FC5)(!FB)lekkere chocoladereep(!FB)(!FC) aan (!FC4)(!N)(!FC)...
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText01 Alias ChocolateBar
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText01 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText02 Message /me komt dichterbij en klampt (!FC39)(!N)(!FC) stevig vast... en geeft een (!FC38)DIKKE, NATTE, PASSIONELE ZOEN (K) (K) (K) .(!FC) (!FB)WOW!!!!!(!FB) Dat was fantastisch! (L)
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText02 Alias BigKiss
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText02 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText03 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText03 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText03 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@ni_KfmoUjoeiH_KU SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText04 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText04 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText04 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText05 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText05 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText05 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText06 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText06 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText06 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText07 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@rqokt+dchgpSnrDeWm SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText07 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText07 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText08 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText08 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText08 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText09 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText09 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText09 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText10 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText10 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@rqokt+dchgpSnrDeWm SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText10 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText11 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText11 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText11 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText12 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText12 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText12 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText13 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText13 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText13 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@XokcoigSogmety!ioWmCmg[ SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText14 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText14 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText14 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText15 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText15 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText15 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText16 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText16 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText16 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText17 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@XokcoigSogmety!ioWmCmg[ SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText17 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText17 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText18 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText18 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText18 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText19 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText19 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText19 AutoSend 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText20 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText20 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@AAAAnsfA/pwAoCgskAfkhAwdAAA SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText20 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText21 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText21 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText21 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText22 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText22 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText22 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText23 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText23 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText23 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@AAAAnsfA/pwAoCgskAfkhAwdAAA SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText24 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText24 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText24 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText25 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText25 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText25 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText26 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText26 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText26 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText27 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@AAAAnsfA/pwAoCgskAfkhAwdAAA CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText27 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText27 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText28 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText28 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText28 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText29 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText29 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText29 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText30 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText30 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@cSeWu|wm/osge1mmd[nvsCjCzpoEjjcIvQaO Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@AAAAnsfA/pwAoCgskAfkhAwdAAA AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText30 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText31 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText31 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText31 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText32 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText32 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText32 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText33 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText33 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText33 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@AAAAnsfA/pwAoCgskAfkhAwdAAA SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText34 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText34 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText34 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText35 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText35 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText35 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText36 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText36 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText36 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText37 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@AAAAnsfA/pwAoCgskAfkhAwdAAA SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText37 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText37 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText38 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText38 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText38 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText39 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText39 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText39 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText40 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText40 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg LastSignin 1113727955
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText40 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText41 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText41 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText41 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText42 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText42 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText42 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText43 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText43 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText43 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText44 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText44 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText44 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText45 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText45 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText45 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText46 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText46 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText46 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText47 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText47 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText47 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText48 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText48 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText48 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText49 Message
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText49 Alias
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences\QuickTexts\QuickText49 AutoSend 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences FirstTimeWizard 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogInUnicode 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences UseAutoAway 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoAwayDelay 30
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoAwayStatus 6
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ExitShortcut 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences FirstLaunch 1113724371
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndX 200
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndY 100
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndWidth 500
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndHeight 170
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ToastPopupSizeW6 181
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ToastPopupSizeH6 129
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ToastPopupPos6 606
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ToastPopupResX 800
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ToastPopupBorder6 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogDirectory D:\Chatlogs
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AllowDocking 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ContactListPlusIcon 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences MessengerTransp 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences BoostMsgSizeLimit 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ResetCharFormatDefault 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences IMNameShort 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences InstantMessagesPlusIcon 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoAcceptDefault 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoAcceptReq 65535
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences IMNameShortMax 15
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences IMTransp 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences QuickTextEnableShortcut 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences PersonalizedAwayFormat 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences PersonalizedAwayColor 11171920
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences PersoAwayNameMax 60
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@DGMYmr1qpnpogkdDdksvwcphfz1StpeejWmg SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences PersoAwayMsgDelay 180
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences UsePersoAwayNameMax 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences UseAutoPersoAway 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences EnableLogging 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogAutoBreak 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogTimestamp 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogNameShort 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogContactActivities 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogNameShortMax 12
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences PlaySoundWhileBusy 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@cSeWu|wm/osge1mmd[nvsCjCzpoEjjcIvQaO
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] LastSignin 1113732413
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences EnableSoundCmd 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoDownloadSounds 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoShowNewSounds 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences AutoPlaySounds 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SoundsByColumn 5
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences UseContactSounds 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences NotificationSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences NotificationWhenBusy 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences ContactNotifDefOffline 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences NotificationSoundEnabled 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] LastChat 1113731698
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences NotifWhenContactSignsOn 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences UseContactNames 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences CustomNameChatReal 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences CustomNameFormatInChat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences QuickIconAddOrigin 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogFile D:\Chatlogs
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogToFile 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogToWindow 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences UseSystemLog 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndMaxLineCount 500
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences EventTransp 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data AllowSendStats 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@!EIQu|wa/osOe1owp]AgzGahomwMscqYqok Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@!EIQu|wa/osOe1owp]AgzGahomwMscqYqok
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive LastArchiveTime 1113727323
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@^IQansfO/pw]oCfzbGfpmMvubqYqo LastSignin 1113729753
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@^IQansfO/pw]oCfzbGfpmMvubqYqo LastChat 1113728555
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndX 200
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndY 100
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndWidth 500
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences SystemLogWndHeight 170
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences FirstTimeWizard 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences LogDirectory C:\Documents and Settings\Tien Verhoeven\Mijn documenten\Mijn gesprekgeschiedenis
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Preferences FirstLaunch 1113728189
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 LanguageFile Lang_Nederlands.ini
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 DefaultConfiguration <useraccount>
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 SoftwareState 1113724585
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MsgPlus.Encrypted
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MsgPlus.Encrypted\DefaultIcon D:\Program Files\MessengerPlus! 3\Resources\MsgPlusRes.dll,-2781
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MsgPlus.Encrypted\shell\open\command "D:\Program Files\MessengerPlus! 3\MsgPlus.exe" /LOG:%1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] CustomName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MsgPlus.Encrypted Encrypted Log File
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 BinDir D:\Program Files\MessengerPlus! 3
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 LocalizationDir D:\Program Files\MessengerPlus! 3\Resources
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 PluginDir D:\Program Files\MessengerPlus! 3\Plugins
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 FileNameDll MsgPlusH.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 FileNameExe MsgPlus.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 FileNameLoader MsgPlusLoader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 SoftwareBuild 3130
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 DefLanguageFile Lang_Nederlands.ini
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] AutoAttachTag 1
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 InstallTime 1113724227
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 DispHookError 1
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 ForceGlobalHook 0
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 HookMode 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@eWmgnsf[/nmCcpuskEA{pInlicwQaO] SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@g[CEnsfI/nmQcpuskaA44O7boem]GMY SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@g[CEnsfI/nmQcpuskaA44O7boem]GMY SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@HO]Gu|wM/gfY0wfr|qluDouqbq|kpqpc0iSeW Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@g[CEnsfI/nmQcpuskaA44O7boem]GMY CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@g[CEnsfI/nmQcpuskaA44O7boem]GMY AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@g[CEnsfI/nmQcpuskaA44O7boem]GMY SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@g[CEnsfI/nmQcpuskaA44O7boem]GMY SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@h]GMmr1Ypqhqcqb{Couwskjqfvxcu0vSeWm SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@h]GMmr1Ypqhqcqb{Couwskjqfvxcu0vSeWm SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@h]GMmr1Ypqhqcqb{Couwskjqfvxcu0vSeWm CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@h]GMmr1Ypqhqcqb{Couwskjqfvxcu0vSeWm AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@h]GMmr1Ypqhqcqb{Couwskjqfvxcu0vSeWm SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@h]GMmr1Ypqhqcqb{Couwskjqfvxcu0vSeWm SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@HO]Gu|wM/gfY0wfr|qluDouqbq|kpqpc0iSeW
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa LastSignin 1113728670
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa LastChat 1113728638
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@JSeWff1mugrg{ntDv[ocqC{rpp1EgIQa SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@KUi_mr1KugrUvhiDdiukw_cfbpKUi SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@KUi_mr1KugrUvhiDdiukw_cfbpKUi SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@kcSeu|wW/osme1owpgAxw[wqjxCEI Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@KUi_mr1KugrUvhiDdiukw_cfbpKUi CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@KUi_mr1KugrUvhiDdiukw_cfbpKUi AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@KUi_mr1KugrUvhiDdiukw_cfbpKUi SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@KUi_mr1KugrUvhiDdiukw_cfbpKUi SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G LastSignin 1113728207
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G LastChat 1113728559
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive\@kcSeu|wW/osme1owpgAxw[wqjxCEI FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@mg[CnsfE/pwIoCwwxQokxaO]G SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G LastSignin 1113731284
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@pmg[nsfC/pwEoConlIupiQndwrdakO]G SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@SeWmnsfg/nm[cpuskCA98EphlrrIwqvQaO] SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Archive LastArchiveTime 1113724585
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@SeWmnsfg/nm[cpuskCA98EphlrrIwqvQaO] SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@SeWmnsfg/nm[cpuskCA98EphlrrIwqvQaO] CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@SeWmnsfg/nm[cpuskCA98EphlrrIwqvQaO] AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@SeWmnsfg/nm[cpuskCA98EphlrrIwqvQaO] SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@SeWmnsfg/nm[cpuskCA98EphlrrIwqvQaO] SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@]GMYnsfq/nmocpuskkAuockuerhSicoeplixdWlmg[ SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@]GMYnsfq/nmocpuskkAuockuerhSicoeplixdWlmg[ SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@]GMYnsfq/nmocpuskkAuockuerhSicoeplixdWlmg[ CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@]GMYnsfq/nmocpuskkAuockuerhSicoeplixdWlmg[ AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@]GMYnsfq/nmocpuskkAuockuerhSicoeplixdWlmg[ SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\*-*@aO]GoivMtkrYgNqok SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@]GMYnsfq/nmocpuskkAuockuerhSicoeplixdWlmg[ SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@`MYqmr1oiumkyCtvhccnmSy1ieWm SigninSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@`MYqmr1oiumkyCtvhccnmSy1ieWm SignoutSound
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@`MYqmr1oiumkyCtvhccnmSy1ieWm CustomName
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@`MYqmr1oiumkyCtvhccnmSy1ieWm AutoAttachTag 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@`MYqmr1oiumkyCtvhccnmSy1ieWm SpecialFormat 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\@`MYqmr1oiumkyCtvhccnmSy1ieWm SpecialColor 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\CtcDetach DisplayEmail 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts\CtcDetach HideParam 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\<useraccount>\Contacts ContactNotifDefOffline 0

Ughh, long list but who knows it'll come inhand one day...
[/slightly offtopic]

RE: ...trojan downloader CR64.... by Chris4 on 04-23-2005 at 02:21 PM

It is called Microsoft Antispyware BETA so it probely will go wrong at times. When I search with it, it doesn't say all them files are infected.

RE: ...trojan downloader CR64.... by lizard.boy on 04-23-2005 at 03:22 PM

Lemme correct the preceding post.

quote:
Originally posted by chris4
It is called Microsoft Antispyware BETA so it probely will go wrong at times. When I search with it, it doesn't say all them files are infected.

anyway. if you cant tell a significant difference in system speed and your other antivirus and spy/ad/malware sweepers dont detect anything wrong i'd say just leave it.

RE: ...trojan downloader CR64.... by DJeX on 04-23-2005 at 04:58 PM

Ok well it looks like you have one of the more annoying pieces of trojan spyware out there. I've had troubles with this one too. The trick is to unplug your internet while doing the scan or go into safe mode and scan. Also use multiple spyware scanners. I recommend using PestPatrol, Spy Hunter, and AdAware SE. Scan with all those and it should come clean.

What this spyware does is once you start to remove it, the trojan detects that it’s being removed and then right away installs a backup of its self from the Windows directory under temp. Also sometimes the trojan will have 2 processes open at a time. So when you remove one process then other trojan process kicks in and does the same either downloads a new copy off the net or reinstalls a backup.

RE: ...trojan downloader CR64.... by aNILEator on 04-23-2005 at 07:59 PM

how comes you know about it? yet, its not documented on the internet from sunshines brilliant research

EDIT:

I dunno why people keep telling me to use multiple scanners I already have 8 different programs to do this and i'm hardly a n00b or anything :dodgy:

I think MS AS is the worst one anyway.

EDIT 2:

No dodgy processes seem to be running either

RE: ...trojan downloader CR64.... by DJeX on 04-23-2005 at 08:38 PM

quote:
Originally posted by Fukafly
how comes you know about it? yet, its not documented on the internet from sunshines brilliant research

EDIT:

I dunno why people keep telling me to use multiple scanners I already have 8 different programs to do this and i'm hardly a n00b or anything

I think MS AS is the worst one anyway.

EDIT 2:

No dodgy processes seem to be running either

I know so much because I have my own computer repair business and I deal with tones of spyware.

We tell you to use multiple scanners because each scanner finds and does different things. Using a mixture of scanners will help clean your computer completely.

You may miss the processes because they name themselves as windows programs like for example: iexplore.exe
Check for double process; ignore the multiple svchost.exe if you have Win Xp.

RE: ...trojan downloader CR64.... by aNILEator on 04-23-2005 at 09:46 PM

No double processes apart from svchost only slightly dodgy sounding thing i saw was E_S10IC2.exe but when i scaned for this i found it was my Epson Printer stuff

RE: ...trojan downloader CR64.... by DJeX on 04-23-2005 at 10:04 PM

Interesting. So what exactly happens when this Trojan comes back?

RE: ...trojan downloader CR64.... by aNILEator on 04-23-2005 at 10:50 PM

Just the MS AS red pop up and it says its high rated and B-A-D etc

But as i say none of the other virus/spyware scanners find a trace of this mysterious (if indeed in existence?) trojan

RE: ...trojan downloader CR64.... by DJeX on 04-23-2005 at 11:54 PM

Ahh i c, I'm thinking it no longer is in your computer or it was never a Trojan but a program in your computer that MS AS has mistaken as spyware or Trojan. Sometimes it will mistake program that download content form the internet on there own or connects to another computer with out you clicking any thing. The program is probably harmless but MS AS thinks its a Trojan because of it's actions and what it does.

RE: ...trojan downloader CR64.... by aNILEator on 04-24-2005 at 02:37 PM

I remember that it blocked itself once, that was a darn stupid thing for it to do.

Anyway i manually went regediting and deleted some keys it doesn't appear to show it now