Remote Registry Report

Hive </mnt/sda3/Windows/System32/config/software>
Login counts data not found in SAM
list_users: Cannot find usernames in registry! (is this a SAM-hive?)
(...)\Microsoft\Windows NT\CurrentVersion> Value <ProductName> of type REG_SZ, data length 64 [0x40]
Windows Vista (TM) Home Premium
(...)\Microsoft\Windows NT\CurrentVersion> Value <CSDVersion> of type REG_SZ, data length 30 [0x1e]
Service Pack 2
(...)\Microsoft\Windows NT\CurrentVersion> Value <SystemRoot> of type REG_SZ, data length 22 [0x16]
C:\Windows
(...)\Microsoft\Windows NT\CurrentVersion\Windows> Value <AppInit_DLLs> of type REG_SZ, data length 82 [0x52]
C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
(...)\Windows NT\CurrentVersion\Winlogon> Value <Shell> of type REG_SZ, data length 26 [0x1a]
explorer.exe
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 68 [0x44]
C:\Windows\system32\userinit.exe,
(...)\Windows NT\CurrentVersion\Winlogon> Node has 1 subkeys and 18 values
  <GPExtensions>
  size     type            value name             [value if type DWORD]
     4  REG_SZ            <ReportBootOk>
    26  REG_SZ            <Shell>
    68  REG_SZ            <Userinit>
    88  REG_SZ            <VmApplet>
     4  REG_DWORD         <AutoRestartShell>         1 [0x1]
     2  REG_SZ            <LegalNoticeCaption>
     2  REG_SZ            <LegalNoticeText>
     4  REG_SZ            <PowerdownAfterShutdown>
     4  REG_SZ            <ShutdownWithoutLogon>
     6  REG_SZ            <cachedlogonscount>
     4  REG_DWORD         <forceunlocklogon>         0 [0x0]
     4  REG_DWORD         <passwordexpirywarning>   14 [0xe]
    12  REG_SZ            <Background>
     6  REG_SZ            <DebugServerCommand>
     4  REG_SZ            <WinStationsDisabled>
     4  REG_DWORD         <DisableCAD>               1 [0x1]
     4  REG_SZ            <scremoveoption>
     4  REG_DWORD         <ShutdownFlags>           39 [0x27]
(...)\Windows\CurrentVersion\Policies\System> Node has 1 subkeys and 16 values
  <UIPI>
     4  REG_DWORD         <ConsentPromptBehaviorAdmin> 2 [0x2]
     4  REG_DWORD         <ConsentPromptBehaviorUser> 1 [0x1]
     4  REG_DWORD         <EnableInstallerDetection> 1 [0x1]
     4  REG_DWORD         <EnableLUA>                1 [0x1]
     4  REG_DWORD         <EnableSecureUIAPaths>     1 [0x1]
     4  REG_DWORD         <EnableVirtualization>     1 [0x1]
     4  REG_DWORD         <PromptOnSecureDesktop>    1 [0x1]
     4  REG_DWORD         <ValidateAdminCodeSignatures> 0  [0x0]
     4  REG_DWORD         <dontdisplaylastusername>  0 [0x0]
     2  REG_SZ            <legalnoticecaption>
     6  REG_SZ            <legalnoticetext>
     4  REG_DWORD         <scforceoption>            0 [0x0]
     4  REG_DWORD         <shutdownwithoutlogon>     1 [0x1]
     4  REG_DWORD         <undockwithoutlogon>       1 [0x1]
     4  REG_DWORD         <FilterAdministratorToken> 0 [0x0]
     4  REG_DWORD         <EnableUIADesktopToggle>   0 [0x0]
 

Hive </mnt/sda2/Windows/System32/config/SOFTWARE>
\Microsoft\Windows NT\CurrentVersion> Value <ProductName> of type REG_SZ, data length 124 [0x7c]
Windows (TM) Code Name "Longhorn" Preinstallation Environment
\Microsoft\Windows NT\CurrentVersion> cat_vk: No such value <CSDVersion>
\Microsoft\Windows NT\CurrentVersion> Value <SystemRoot> of type REG_SZ, data length 22 [0x16]
C:\Windows
\Microsoft\Windows NT\CurrentVersion\Windows> Value <AppInit_DLLs> of type REG_SZ, data length 2 [0x2]
(...)\Windows NT\CurrentVersion\Winlogon> Value <Shell> of type REG_SZ, data length 50 [0x32]
cmd.exe /k start cmd.exe
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 68 [0x44]
C:\Windows\system32\userinit.exe,
(...)\Windows NT\CurrentVersion\Winlogon> Node has 1 subkeys and 16 values
  <GPExtensions>
  size     type            value name             [value if type DWORD]
    50  REG_SZ            <Shell>
    68  REG_SZ            <Userinit>
    88  REG_SZ            <VmApplet>
     4  REG_SZ            <ReportBootOk>
     4  REG_DWORD         <AutoRestartShell>         1 [0x1]
     2  REG_SZ            <LegalNoticeCaption>
     2  REG_SZ            <LegalNoticeText>
     4  REG_SZ            <PowerdownAfterShutdown>
     4  REG_SZ            <ShutdownWithoutLogon>
     6  REG_SZ            <cachedlogonscount>
     4  REG_DWORD         <forceunlocklogon>         0 [0x0]
     4  REG_DWORD         <passwordexpirywarning>   14 [0xe]
    12  REG_SZ            <Background>
     6  REG_SZ            <DebugServerCommand>
     4  REG_SZ            <WinStationsDisabled>
     4  REG_DWORD         <ShutdownFlags>           43 [0x2b]
(...)\Windows\CurrentVersion\Policies\System> Node has 1 subkeys and 2 values
  <UIPI>
     4  REG_DWORD         <EnableMIC>                0 [0x0]
     4  REG_DWORD         <EnableUIPI>               0 [0x0]
 

Hive </mnt/sda3/ProgramData/ntuser.dat>
> Node has 1 subkeys and 0 values
  <Software>
 

Hive </mnt/sda3/Users/Heidi/ntuser.dat>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 15 values
  size     type            value name             [value if type DWORD]
   102  REG_SZ            <DellSupport>
    56  REG_SZ            <ehTray.exe>
   152  REG_SZ            <googletalk>
   152  REG_SZ            <DellSupportCenter>
   112  REG_SZ            <SpybotSD TeaTimer>
   126  REG_SZ            <Search Protection>
   148  REG_SZ            <swg>
   124  REG_SZ            <Messenger (Yahoo!)>
   148  REG_SZ            <HLBackupScheduler>
   102  REG_SZ            <WMPNSCFG>
   130  REG_SZ            <Spino>
    86  REG_SZ            <Steam>
   124  REG_SZ            <MobileDocuments>
   120  REG_SZ            <Skype>
    64  REG_SZ            <xBuRdeRWhJWa.exe>
 

Hive </mnt/sda3/Users/Public/ntuser.dat>
> Node has 1 subkeys and 0 values
  <SOFTWARE>
 

Hive </mnt/sda3/Users/TEMP/NTUSER.DAT>
(...)\Microsoft\Windows\CurrentVersion\Run> Node has 0 subkeys and 3 values
  size     type            value name             [value if type DWORD]
   108  REG_SZ            <Sidebar>
    88  REG_SZ            <WindowsWelcomeCenter>
   102  REG_SZ            <DellSupport>
(...)\Windows\CurrentVersion\Policies\Explorer> Node has 0 subkeys and 1 values
     4  REG_DWORD         <NoDriveTypeAutoRun>     145 [0x91]