[Resolved] Windows Only Runs in Safe Mode; Anti-Malware Apps Inac

Viewer Topic Starter

Post #1June 15, 2009, 1:12 AM UTC last edited June 15, 2009, 1:44 AM UTC

(Windows XP Media Center)

Windows crashes within a couple minutes unless it is in safe mode. AVG Free is unable to update itself. Every anti-malware app I've tried to use (Spybot, Combofix, Malwarebytes, HiJackThis) appear as a processes in the Task Manager but don't produce any windows (ATF Cleaner is the only exception) and thus are un-usuable. Many anti-malware sites appear as though they don't exist in browsers such as Firefox, Chrome and Safari. Just now, I've noticed that it appears to have the fraud System Security program installed. Fortunately, the two Ubuntu 8.04 (32 and 64 bit) partitions appear to be unscathed. Thanks in advanced!

EDIT: I managed to find a way to get HiJackThis running. I managed to access it via a link to the TrendMicro site via the confickerworkinggroup.org site. I right-clicked the link to the executable download and saved it as "x.exe". I'll have a logfile up as soon as I switch computers.

EDIT2: Here's my HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33 PM, on 2009-06-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dan\My Documents\Downloads\x.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gateway.com/g/startpage.html?Ch…TP&M=GT5220
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: precisead search enhancer - {58CC178C-807D-74C8-917C-2D09857BA4DA} - C:\WINDOWS\system32\fqgejysgtcimedz.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [19844684] C:\Documents and Settings\All Users\Application Data\19844684\19844684.exe
O4 - HKLM\..\Run: [99854676] C:\Documents and Settings\All Users\Application Data\99854676\99854676.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Power2GoExpress] NA
O4 - HKCU\..\Run: [StrokeIt] C:\Program Files\Strokeit\strokeit.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Policies\Explorer\Run: [Systems Update] C:\Program Files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\lsasvc.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe
O4 - Startup: Grattitude Journal.txt.lnk = ?
O4 - Startup: Shortcut to Accomplishments2.txt.lnk = ?
O4 - Startup: Shortcut to Vision.bmp.lnk = ?
O4 - Startup: Spyware Doctor.lnk = C:\Program Files\Spyware Doctor\swdoctor.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Subliminal Blaster.lnk = C:\Program Files\Subliminal Blaster 2.0\subliminalblaster.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1160874555187
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161492703805
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://64.21.226.243/activex/AMC.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9096FA48-04D6-4BD6-A638-2027D7FE543E}: NameServer = 85.255.112.63,85.255.112.87
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.63,85.255.112.87
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.63,85.255.112.87
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.63,85.255.112.87
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Groove Games Licensing Service - Groove Games - C:\Program Files\Common Files\Groove Games Shared\Service\ggameslicsvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe

–
End of file - 12066 bytes

CatByte

Post #2June 15, 2009, 6:55 AM UTC

Hi and welcome,

NOTE:

Malware removal is NOT instantaneous.
Most infections require more than one round to properly eradicate.
Absence of symptoms does not always mean the job is complete.
You can be certain that I will advise you when the computer is clean.
Kindly follow my instructions in the order posted.
Please resist the urge to run further scans or fix items on your own without my direction.

Please do the following:

Open HiJackThis
Click on Do a system scan only
Check the boxes next to ONLY the entries listed below (if still present):

O2 - BHO: precisead search enhancer - {58CC178C-807D-74C8-917C-2D09857BA4DA} - C:\WINDOWS\system32\fqgejysgtcimedz.dll
O4 - HKLM\..\Run: [19844684] C:\Documents and Settings\All Users\Application Data\19844684\19844684.exe
O4 - HKLM\..\Run: [99854676] C:\Documents and Settings\All Users\Application Data\99854676\99854676.exe
O4 - HKCU\..\Policies\Explorer\Run: [Systems Update] C:\Program Files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\lsasvc.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9096FA48-04D6-4BD6-A638-2027D7FE543E}: NameServer = 85.255.112.63,85.255.112.87
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.63,85.255.112.87
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.63,85.255.112.87
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.63,85.255.112.87

Close all windows except Hijackthis and click Fix Checked
Click Yes when prompted
Close HijackThis.

NEXT

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

STEP #2

Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Viewer

Post #3June 15, 2009, 10:29 PM UTC

After following all your instructions, web browsers, the task manager (and possibly other applications) stopped working in Windows. Windows has yet to successfully boot in safe mode since. The contents of the log files were retrieved via Ubuntu. DDS instructed me to post the Attach document as an attached zip file, so that is what I have done. Does it matter that I saved the GMER.log instead of GMER.txt? DDS.txt: DDS (Ver_09-05-14.01) - NTFSx86 NETWORK Run by [removed] at 11:11:45.21 on 2009-06-15 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.895.551 [GMT -4:00] AV: AVG 7.5.488 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\All Users\Documents\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ig/gatewayr?hl=en uInternet Connection Wizard,ShellNext = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br;=GTW&Loc;=ENG_US&Sys;=DTP&M;=GT5220 uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie mWinlogon: Taskman=c:\recycler\s-1-5-21-1665231469-7638673822-239320538-6779\svchost.exe BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: Search panel: {4e6cbd29-b55b-5004-0dff-9a823aa738ff} - c:\windows\system32\fqgejysgtcimedz.dll uRun: [Power2GoExpress] NA uRun: [StrokeIt] c:\program files\strokeit\strokeit.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Free Download Manager] c:\program files\free download manager\fdm.exe -autorun uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [Google Update] "c:\documents and settings\dan\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE mRun: [readericon] c:\program files\digital media reader\readericon45G.exe mRun: [CHotkey] zHotkey.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe mRun: [type32] "c:\program files\microsoft intellitype pro\type32.exe" mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe" mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall mRun: [DigidesignMMERefresh] c:\program files\digidesign\drivers\MMERefresh.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe" mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent dRunOnce: [RunNarrator] Narrator.exe StartupFolder: c:\docume~1\dan\startm~1\programs\startup\dropbox.lnk - c:\program files\dropbox\Dropbox.exe StartupFolder: c:\docume~1\dan\startm~1\programs\startup\gratti~1.lnk - c:\documents and settings\dan\my documents\Grattitude Journal.txt StartupFolder: c:\docume~1\dan\startm~1\programs\startup\shortc~2.lnk - c:\documents and settings\dan\my documents\Accomplishments2.txt StartupFolder: c:\docume~1\dan\startm~1\programs\startup\shortc~3.lnk - c:\documents and settings\dan\my documents\Vision.bmp StartupFolder: c:\docume~1\dan\startm~1\programs\startup\spywar~1.lnk - c:\program files\spyware doctor\swdoctor.exe StartupFolder: c:\docume~1\dan\startm~1\programs\startup\spywar~2.lnk - c:\program files\spywareguard\sgmain.exe StartupFolder: c:\docume~1\dan\startm~1\programs\startup\sublim~1.lnk - c:\program files\subliminal blaster 2.0\subliminalblaster.exe uPolicies-explorer: NoViewOnDrive = 0 (0x0) IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - hxxp://support.f-secure.com/ols/fscax.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160874555187 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161492703805 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {D821DC4A-0814-435E-9820-661C543A4679} - hxxp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://64.21.226.243/activex/AMC.cab DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll LSA: Notification Packages = scecli ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\gs4h9sg2.default\ FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - component: c:\documents and settings\dan\application data\mozilla\firefox\profiles\gs4h9sg2.default\extensions\{16f796dd-a279-4548-9b3a-393d1eef31df}\components\imageassistant.dll FF - component: c:\program files\mozilla firefox\components\a5dc6df8-b186-4b59-d1d7-26b3ab12e255.dll FF - component: c:\program files\mozilla firefox\components\fqgejysgtcimedz.dll FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll FF - plugin: c:\documents and settings\dan\local settings\application data\google\update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\mozilla firefox\plugins\npggplugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npJoostPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmusicn.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\picasa2\npPicasa2.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll —- FIREFOX POLICIES —- FF - user.js: google.toolbar.linkdoctor.enabled - false ============= SERVICES / DRIVERS =============== R0 DigiFilter;DigiFilter;c:\windows\system32\drivers\DigiFilt.sys [2007-12-15 16384] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-5-24 130936] R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-6-24 3968] R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2007-10-29 132736] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-3-26 348752] R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-3-26 1095560] R3 MBX2DFU;MBX2DFU;c:\windows\system32\drivers\mbx2dfu.sys [2007-12-15 15488] S1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2007-6-24 821728] S1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2007-6-24 4224] S1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2007-6-24 27776] S1 IfsDrives;IfsDrives;c:\windows\system32\drivers\IfsDrives.sys [2007-10-29 4608] S2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avg7\avgamsvr.exe [2007-6-24 353280] S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avg7\avgupsvc.exe [2007-6-24 49664] S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avg7\avgemc.exe [2007-6-24 353280] S2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2007-6-24 4960] S2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-2-14 24652] S2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2007-4-15 6016] S3 dalwdmservice;dal service;c:\windows\system32\drivers\Dalwdm.sys [2007-12-15 105472] S3 ForteUSB;AUDIOVOX USB Driver Service;c:\windows\system32\drivers\ForteUSB.sys [2008-11-2 10658] S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-6-27 29744] S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2007-6-27 42376] S3 IkSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2007-6-27 66952] S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2007-6-27 81288] S3 MBX2MIDK;Digidesign Mbox 2 Midi Driver;c:\windows\system32\drivers\mbx2midk.sys [2007-12-15 15232] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-21 18688] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-21 8320] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-18 23680] S3 ultradfg;ultradfg;c:\windows\system32\drivers\ultradfg.sys [2007-12-22 23552] ============== File Associations =============== regfile="regedit.exe" "%1" =============== Created Last 30 ================ 2009-06-15 11:11 –d-h— c:\windows\PIF 2009-06-14 20:28 –d—– c:\docume~1\alluse~1\applic~1\99854676 2009-06-14 20:28 –d—– c:\docume~1\alluse~1\applic~1\19844684 2009-06-14 19:51 –d—– C:\ComboFix 2009-06-13 12:23 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-13 12:23 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-06-13 12:23 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-06-13 12:23 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-06-12 15:00 -cd—– c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-06-09 07:08 –d—– c:\program files\common files\Microsoft Update Engine 2009-06-09 07:08 –d—– c:\program files\DVDConv 2009-06-09 07:07 108,336 a——- c:\windows\system32\mswinsck.ocx 2009-06-09 07:07 –d—– c:\program files\common files\WinNT 32 2009-06-08 22:02 –d—– c:\program files\coolpro 2009-06-08 22:02 –d—– c:\program files\coolpro2 2009-06-08 21:42 58,713 a——- c:\windows\system32\fqgejysgtcimedz.dll-uninst.exe 2009-06-08 21:42 85,733 a——- c:\windows\system32\d953190e-9c36-857e-401f-cbfed790d9f4.exe 2009-06-08 21:41 48,273 a——- c:\windows\system32\zfyazrmoyjjrsz.exe 2009-06-08 20:41 –d—– c:\program files\Audacity 1.3 Beta (Unicode) 2009-06-03 21:44 –d—– c:\program files\TabIt 2009-05-24 04:48 159,600 a——- c:\windows\system32\drivers\pctgntdi.sys 2009-05-24 04:47 130,936 a——- c:\windows\system32\drivers\PCTCore.sys 2009-05-24 04:47 73,840 a——- c:\windows\system32\drivers\PCTAppEvent.sys 2009-05-24 04:47 64,392 a——- c:\windows\system32\drivers\pctplsg.sys 2009-05-24 04:47 –d—– c:\program files\common files\PC Tools ==================== Find3M ==================== 2009-06-13 12:16 73,596 a—h— c:\windows\system32\mlfcache.dat 2009-05-05 04:04 480,256 a——- c:\windows\system32\uqksxaypqngzrz.dll 2009-04-25 22:27 410,984 a——- c:\windows\system32\deploytk.dll 2009-04-18 20:21 0 a—h— c:\windows\system32\drivers\Msft_Kernel_motport_01005.Wdf 2009-04-18 20:21 0 a—h— c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2009-04-18 20:20 0 a—h— c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2009-04-18 20:20 0 a—h— c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2009-04-10 05:58 711,680 a——- c:\windows\system32\nsa34.dll 2009-03-31 22:12 86,811 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2007-04-16 16:53 6,600,704 ac—— c:\program files\NETGEAR WG311T Wireless Adapter.msi 2007-04-16 16:53 4,107 ac—— c:\program files\0x0409.ini 2006-07-05 05:33 472,000 ac—— c:\windows\inf\wg311t\WG311T13.sys 2006-04-25 17:30 35,232 ac—— c:\windows\inf\wg311t\ME_INST.EXE 2006-04-25 17:30 26,112 ac—— c:\windows\inf\wg311t\install.exe 2006-05-03 06:06 163,328 a–shr– c:\windows\system32\flvDX.dll 2007-02-21 07:47 31,232 a–shr– c:\windows\system32\msfDX.dll ============= FINISH: 11:13:53.42 ===============

Viewer

Post #4June 15, 2009, 10:33 PM UTC

GMER.log (part 1):

GMER 1.0.15.14972 - http://www.gmer.net

Rootkit scan 2009-06-15 16:31:04

Windows 5.1.2600 Service Pack 2

—- System - GMER 1.0.15 —-

Code 839BD306 ZwEnumerateKey

Code 839BD2CE ZwFlushInstructionCache

Code 83EBB54D IofCallDriver

Code 839C22C5 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!IofCallDriver 804E13A7 5 Bytes JMP 83EBB552

.text ntoskrnl.exe!IofCompleteRequest 804E17BD 5 Bytes JMP 839C22CA

PAGE ntoskrnl.exe!ZwEnumerateKey 80578EE4 5 Bytes JMP 839BD30A

PAGE ntoskrnl.exe!ZwFlushInstructionCache 805873DB 5 Bytes JMP 839BD2D2

.text ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 003B000A

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\csrss.exe[452] KERNEL32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 01200001

.text C:\WINDOWS\system32\csrss.exe[452] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\csrss.exe[452] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\WINDOWS\system32\winlogon.exe[476] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 0067000A

.text C:\WINDOWS\system32\winlogon.exe[476] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00F70001

.text C:\WINDOWS\system32\winlogon.exe[476] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\winlogon.exe[476] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\WINDOWS\system32\services.exe[524] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 0065000A

.text C:\WINDOWS\system32\services.exe[524] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 014F0001

.text C:\WINDOWS\system32\services.exe[524] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\services.exe[524] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\WINDOWS\system32\lsass.exe[536] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 0067000A

.text C:\WINDOWS\system32\lsass.exe[536] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00DA0001

.text C:\WINDOWS\system32\lsass.exe[536] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\lsass.exe[536] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\WINDOWS\system32\svchost.exe[688] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00FF0001

.text C:\WINDOWS\system32\svchost.exe[688] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\svchost.exe[688] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\WINDOWS\system32\svchost.exe[796] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00FC0001

.text C:\WINDOWS\system32\svchost.exe[796] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\svchost.exe[796] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\Documents and Settings\Dan\Desktop\gmer.exe[824] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 003B000A

.text C:\WINDOWS\system32\svchost.exe[896] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 01F90001

.text C:\WINDOWS\system32\svchost.exe[896] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\svchost.exe[896] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\WINDOWS\system32\svchost.exe[984] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 008C0001

.text C:\WINDOWS\system32\svchost.exe[984] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\WINDOWS\system32\svchost.exe[984] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[1324] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 0081000A

.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[1324] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 015D0001

.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[1324] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0A0F5A

.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[1324] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F040F5A

.text C:\Program Files\Spyware Doctor\pctsSvc.exe[1356] kernel32.dll!CreateThread + 1A 7C810661 4 Bytes CALL 0044AD11 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs DigiFilt.sys (Digidesign Filter Driver/Digidesign, A Division of Avid Technology, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice \FileSystem\Fastfat \Fat DigiFilt.sys (Digidesign Filter Driver/Digidesign, A Division of Avid Technology, Inc.)

—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [688] 0x10000000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys (*** hidden *** ) [SYSTEM] MSIVXserv.sys <– ROOTKIT !!!

Service C:\WINDOWS\system32\drivers\SKYNETebprsaqr.sys (*** hidden *** ) [SYSTEM] SKYNETrbyubvqc <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@start 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@type 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@imagepath \systemroot\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@group file system

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules@MSIVXserv \\?\globalroot\systemroot\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules@MSIVXl \\?\globalroot\systemroot\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules@MSIVXclk \\?\globalroot\systemroot\system32\MSIVXgvvnymsxekyqlskbpirddreruhdottws.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc@start 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc@type 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc@group file system

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc@imagepath \systemroot\system32\drivers\SKYNETebprsaqr.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main@aid 10037

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main@sid 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main@cmddelay 7200

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main\delete

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main\injector

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main\injector@* SKYNETwsp.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\main\tasks

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\modules

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\drivers\SKYNETebprsaqr.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETbxiqjdoo.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETsyxwxqfl.dat

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETvcbdiyij.dll

Reg HKLM\SYSTEM\CurrentControlSet\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETvnexrlvx.dat

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@start 1

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@type 1

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@imagepath \systemroot\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@group file system

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules@MSIVXserv \\?\globalroot\systemroot\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules@MSIVXl \\?\globalroot\systemroot\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll

Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules@MSIVXclk \\?\globalroot\systemroot\system32\MSIVXgvvnymsxekyqlskbpirddreruhdottws.dll

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc@start 1

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc@type 1

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc@group file system

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc@imagepath \systemroot\system32\drivers\SKYNETebprsaqr.sys

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main@aid 10037

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main@sid 0

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main@cmddelay 7200

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main\delete

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main\injector

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main\injector@* SKYNETwsp.dll

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\main\tasks

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\modules

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\drivers\SKYNETebprsaqr.sys

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETbxiqjdoo.dll

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETsyxwxqfl.dat

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETvcbdiyij.dll

Reg HKLM\SYSTEM\ControlSet003\Services\SKYNETrbyubvqc\[removed] \systemroot\system32\SKYNETvnexrlvx.dat

Reg HKLM\SOFTWARE\Classes\.adg@ Live 7.0.2 Document

Reg HKLM\SOFTWARE\Classes\.adg\DefaultIcon

Reg HKLM\SOFTWARE\Classes\.adg\DefaultIcon@ C:\Program Files\Ableton\Live 7.0.2\Resources\Icons\rack.ico,0

Reg HKLM\SOFTWARE\Classes\.adv@ Live 7.0.2 Document

Reg HKLM\SOFTWARE\Classes\.adv\DefaultIcon

Reg HKLM\SOFTWARE\Classes\.adv\DefaultIcon@ C:\Program Files\Ableton\Live 7.0.2\Resources\Icons\preset.ico,0

Reg HKLM\SOFTWARE\Classes\.alc@ Live 7.0.2 Document

Reg HKLM\SOFTWARE\Classes\.alc\DefaultIcon

Reg HKLM\SOFTWARE\Classes\.alc\DefaultIcon@ C:\Program Files\Ableton\Live 7.0.2\Resources\Icons\alc.ico,0

Reg HKLM\SOFTWARE\Classes\.alp@ Live 7.0.2 Document

Reg HKLM\SOFTWARE\Classes\.alp\DefaultIcon

Reg HKLM\SOFTWARE\Classes\.alp\DefaultIcon@ C:\Program Files\Ableton\Live 7.0.2\Resources\Icons\pack.ico,0

Reg HKLM\SOFTWARE\Classes\.alp\Shell

Reg HKLM\SOFTWARE\Classes\.alp\Shell\open

Reg HKLM\SOFTWARE\Classes\.alp\Shell\open\command

Reg HKLM\SOFTWARE\Classes\.alp\Shell\open\command@ C:\Program Files\Ableton\Live 7.0.2\Program\Live 7.0.2.bin "%1"

Reg HKLM\SOFTWARE\Classes\.als@ Live 7.0.2 Document

Reg HKLM\SOFTWARE\Classes\.als\DefaultIcon

Reg HKLM\SOFTWARE\Classes\.als\DefaultIcon@ C:\Program Files\Ableton\Live 7.0.2\Resources\Icons\set.ico,0

Reg HKLM\SOFTWARE\Classes\.als\Shell

Reg HKLM\SOFTWARE\Classes\.als\Shell\open

Reg HKLM\SOFTWARE\Classes\.als\Shell\open\command

Reg HKLM\SOFTWARE\Classes\.als\Shell\open\command@ C:\Program Files\Ableton\Live 7.0.2\Program\Live 7.0.2.bin "%1"

Reg HKLM\SOFTWARE\Classes\.amo@ amofile

Reg HKLM\SOFTWARE\Classes\.amo@Content Type application/x-aim+amo

Reg HKLM\SOFTWARE\Classes\.amo@ContentType application/x-amo

Reg HKLM\SOFTWARE\Classes\.APL@ MediaMonkey.APLFile

Reg HKLM\SOFTWARE\Classes\.asd@ Live 7.0.2 Document

Reg HKLM\SOFTWARE\Classes\.asd\DefaultIcon

Reg HKLM\SOFTWARE\Classes\.asd\DefaultIcon@ C:\Program Files\Ableton\Live 7.0.2\Resources\Icons\asd.ico,0

Reg HKLM\SOFTWARE\Classes\.AudioCD\PersistentHandler

Reg HKLM\SOFTWARE\Classes\.AudioCD\PersistentHandler@ {098f2470-bae0-11cd-b579-08002b30bfeb}

Reg HKLM\SOFTWARE\Classes\.AUP@ Audacity.Project

Reg HKLM\SOFTWARE\Classes\.cin@ CrystalPluginFile

Reg HKLM\SOFTWARE\Classes\.CTT@ MessengerContactList

Reg HKLM\SOFTWARE\Classes\.daa@ PowerISO

Reg HKLM\SOFTWARE\Classes\.dvd\PersistentHandler

Reg HKLM\SOFTWARE\Classes\.dvd\PersistentHandler@ {098f2470-bae0-11cd-b579-08002b30bfeb}

Reg HKLM\SOFTWARE\Classes\.FLA@ MediaMonkey.FLAFile

Reg HKLM\SOFTWARE\Classes\.Folder\PersistentHandler

Reg HKLM\SOFTWARE\Classes\.Folder\PersistentHandler@ {098f2470-bae0-11cd-b579-08002b30bfeb}

Reg HKLM\SOFTWARE\Classes\.kristal@ KristalProjectFile

Reg HKLM\SOFTWARE\Classes\.mgt@ MusicnotesGuitar.File

Reg HKLM\SOFTWARE\Classes\.mgt@Content Type application/x-musicnotes

Reg HKLM\SOFTWARE\Classes\.mmip@ MediaMonkey.MMIPFile

Reg HKLM\SOFTWARE\Classes\.MP+@ MediaMonkey.MP+File

Reg HKLM\SOFTWARE\Classes\.MPC@ MediaMonkey.MPCFile

Reg HKLM\SOFTWARE\Classes\.MPP@ MediaMonkey.MPPFile

Reg HKLM\SOFTWARE\Classes\.mtd@ Music.Transfer.Document

Reg HKLM\SOFTWARE\Classes\.mtd@Content Type application/x-musicnotes

Reg HKLM\SOFTWARE\Classes\.psy@ Psycle Music Archive

Reg HKLM\SOFTWARE\Classes\.sco@ Sibelius.Scorch

Reg HKLM\SOFTWARE\Classes\.sco@Content Type application/x-sibelius-score

Reg HKLM\SOFTWARE\Classes\.sib@ Sibelius.Scorch

Reg HKLM\SOFTWARE\Classes\.sib@Content Type application/x-sibelius-score

Reg HKLM\SOFTWARE\Classes\.tbt@ TabIt.tbt.file

Reg HKLM\SOFTWARE\Classes\.tbt@Content Type application/x-tabit-tablature

Reg HKLM\SOFTWARE\Classes\.tsme@ TSmideditor.NoteEditor

Reg HKLM\SOFTWARE\Classes\.uif@ PowerISO

Reg HKLM\SOFTWARE\Classes\.VQF@ MediaMonkey.VQFFile

Reg HKLM\SOFTWARE\Classes\.waver@ WaverArrangementFile

Reg HKLM\SOFTWARE\Classes\aim@ URL: AOL Instant Messenger Protocol

Reg HKLM\SOFTWARE\Classes\aim@URL Protocol

Reg HKLM\SOFTWARE\Classes\aim\shell

Reg HKLM\SOFTWARE\Classes\aim\shell\open

Reg HKLM\SOFTWARE\Classes\aim\shell\open\command

Reg HKLM\SOFTWARE\Classes\aim\shell\open\command@ "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp %1

Reg HKLM\SOFTWARE\Classes\amofile@ AIM Module Plugin

Reg HKLM\SOFTWARE\Classes\amofile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\amofile\DefaultIcon@ C:\Program Files\AIM6\services\imApp\ver6_8_15_1\resources\en-US\amo.ico

Reg HKLM\SOFTWARE\Classes\amofile\shell

Reg HKLM\SOFTWARE\Classes\amofile\shell\open

Reg HKLM\SOFTWARE\Classes\amofile\shell\open\command

Reg HKLM\SOFTWARE\Classes\amofile\shell\open\command@ "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp "%1"

Reg HKLM\SOFTWARE\Classes\AnStarBurnEngine.StarBurnEngine@ StarBurn CD Burning Engine Object

Reg HKLM\SOFTWARE\Classes\AnStarBurnEngine.StarBurnEngine\Clsid

Reg HKLM\SOFTWARE\Classes\AnStarBurnEngine.StarBurnEngine\Clsid@ {82B833F1-C2A2-48FE-BDF1-4A4DE5C10790}

Reg HKLM\SOFTWARE\Classes\AnvCtrl.SliderAnv@ AnvCtrl.SliderAnv

Reg HKLM\SOFTWARE\Classes\AnvCtrl.SliderAnv\Clsid

Reg HKLM\SOFTWARE\Classes\AnvCtrl.SliderAnv\Clsid@ {CFA50FB7-E777-11D3-B867-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress@ ASMuVoWMDMProgress Class

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress\CLSID

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress\CLSID@ {A66BB8B7-008A-4545-8756-FE77136E8331}

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress\CurVer

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress\CurVer@ ASMuVoHelper.ASMuVoWMDMProgress.1

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress.1@ ASMuVoWMDMProgress Class

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress.1\CLSID

Reg HKLM\SOFTWARE\Classes\ASMuVoHelper.ASMuVoWMDMProgress.1\CLSID@ {A66BB8B7-008A-4545-8756-FE77136E8331}

Reg HKLM\SOFTWARE\Classes\Audacity.Project@ Audacity Project File

Reg HKLM\SOFTWARE\Classes\Audacity.Project\shell

Reg HKLM\SOFTWARE\Classes\Audacity.Project\shell@

Reg HKLM\SOFTWARE\Classes\Audacity.Project\shell\open

Reg HKLM\SOFTWARE\Classes\Audacity.Project\shell\open\command

Reg HKLM\SOFTWARE\Classes\Audacity.Project\shell\open\command@ "C:\Program Files\Audacity 1.3 Beta (Unicode)\audacity.exe" "%1"

Reg HKLM\SOFTWARE\Classes\bittorrent@ TORRENT File

Reg HKLM\SOFTWARE\Classes\bittorrent\Content Type

Reg HKLM\SOFTWARE\Classes\bittorrent\Content Type@ application/x-bittorrent

Reg HKLM\SOFTWARE\Classes\bittorrent\DefaultIcon

Reg HKLM\SOFTWARE\Classes\bittorrent\DefaultIcon@ C:\Program Files\BitTorrent\bittorrent.exe,0

Reg HKLM\SOFTWARE\Classes\bittorrent\shell

Reg HKLM\SOFTWARE\Classes\bittorrent\shell@ open

Reg HKLM\SOFTWARE\Classes\bittorrent\shell\open

Reg HKLM\SOFTWARE\Classes\bittorrent\shell\open\command

Reg HKLM\SOFTWARE\Classes\bittorrent\shell\open\command@ "C:\Program Files\BitTorrent\bittorrent.exe" "%1"

Reg HKLM\SOFTWARE\Classes\BitTorrent.BitTorrentCtrl.1@ BitTorrent Control

Reg HKLM\SOFTWARE\Classes\BitTorrent.BitTorrentCtrl.1\CLSID

Reg HKLM\SOFTWARE\Classes\BitTorrent.BitTorrentCtrl.1\CLSID@ {21C4E4B2-40F7-4E77-BF19-8BED7187BB55}

Reg HKLM\SOFTWARE\Classes\bltfile@

Viewer

Post #5June 15, 2009, 10:34 PM UTC

AIM Buddy List File

Reg HKLM\SOFTWARE\Classes\bltfile\shell

Reg HKLM\SOFTWARE\Classes\bltfile\shell\open

Reg HKLM\SOFTWARE\Classes\bltfile\shell\open\command

Reg HKLM\SOFTWARE\Classes\bltfile\shell\open\command@ "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp "%1"

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager@ CddbCacheManager Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager\CLSID@ {75eb5f60-577f-47fa-bb65-762a93136021}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager\CurVer@ CDDBControlCreative.CddbCacheManager.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager.1@ CddbCacheManager Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCacheManager.1\CLSID@ {75eb5f60-577f-47fa-bb65-762a93136021}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBControl2@ CDDBControl2 Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBControl2\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBControl2\CLSID@ {551efe94-250f-4ff9-9ea9-b9dba3f70561}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBControl2.1@ CDDBControl2 Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBControl2.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBControl2.1\CLSID@ {551efe94-250f-4ff9-9ea9-b9dba3f70561}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl@ CDDBCreativeControl Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl\CLSID@ {4920ab9e-899c-4381-842b-29cff3af00cc}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl\CurVer@ CDDBControlCreative.CDDBCreativeControl.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl.1@ CDDBCreativeControl Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl.1\CLSID@ {4920ab9e-899c-4381-842b-29cff3af00cc}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CDDBCreativeControl.1\Insertable

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit@ CddbCredit Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit\CLSID@ {eca98d4c-6010-4edc-8c3d-d14dd2cce3c5}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit\CurVer@ CDDBControlCreative.CddbCredit.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit.1@ CddbCredit Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbCredit.1\CLSID@ {eca98d4c-6010-4edc-8c3d-d14dd2cce3c5}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc@ CddbDisc Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc\CLSID@ {37f15061-0336-46be-b33f-8f1e3e56f94c}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc\CurVer@ CDDBControlCreative.CddbDisc.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc.1@ CddbDisc Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbDisc.1\CLSID@ {37f15061-0336-46be-b33f-8f1e3e56f94c}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbFullName.1@ CddbFullName Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbFullName.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbFullName.1\CLSID@ {466c1c1f-d32f-4f94-ad09-efa9f4cbcdaa}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag@ CddbID3Tag Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag\CLSID@ {9c0c84e5-16ef-4026-a678-97c20eeada1d}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag\CurVer@ CDDBControlCreative.CddbID3Tag.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag.1@ CddbID3Tag Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3Tag.1\CLSID@ {9c0c84e5-16ef-4026-a678-97c20eeada1d}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager@ CddbID3TagManager Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager\CLSID@ {20994eab-1538-4623-8fb6-9eb6a1611874}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager\CurVer@ CDDBControlCreative.CddbID3TagManager.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager.1@ CddbID3TagManager Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbID3TagManager.1\CLSID@ {20994eab-1538-4623-8fb6-9eb6a1611874}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow@ CddbInfoWindow Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow\CLSID@ {1ede68f2-0157-4f1f-9445-f87a89768a98}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow\CurVer@ CDDBControlCreative.CddbInfoWindow.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow.1@ CddbInfoWindow Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbInfoWindow.1\CLSID@ {1ede68f2-0157-4f1f-9445-f87a89768a98}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment@ CddbSegment Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment\CLSID@ {96081656-1b79-4fdd-8f8e-a48f2b8274e9}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment\CurVer@ CDDBControlCreative.CddbSegment.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment.1@ CddbSegment Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbSegment.1\CLSID@ {96081656-1b79-4fdd-8f8e-a48f2b8274e9}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions@ CddbUIOptions Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions\CLSID@ {7c0aa824-2287-4406-b508-eba745bf4054}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions\CurVer@ CDDBControlCreative.CddbUIOptions.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions.1@ CddbUIOptions Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbUIOptions.1\CLSID@ {7c0aa824-2287-4406-b508-eba745bf4054}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL@ CddbURL Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL\CLSID@ {c27aeee8-703e-4fad-9763-7e752e446506}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL\CurVer@ CDDBControlCreative.CddbURL.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL.1@ CddbURL Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURL.1\CLSID@ {c27aeee8-703e-4fad-9763-7e752e446506}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager@ CddbURLManager Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager\CLSID@ {62d8cbcc-1191-475d-9002-29456066cbf8}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager\CurVer@ CDDBControlCreative.CddbURLManager.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager.1@ CddbURLManager Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbURLManager.1\CLSID@ {62d8cbcc-1191-475d-9002-29456066cbf8}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag@ CddbWMATag Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag\CLSID@ {c3761b2c-c389-4474-ad3a-4cfbae5bffe4}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag\CurVer@ CDDBControlCreative.CddbWMATag.1

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag.1@ CddbWMATag Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.CddbWMATag.1\CLSID@ {c3761b2c-c389-4474-ad3a-4cfbae5bffe4}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.FullName@ CddbFullName Class

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.FullName\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.FullName\CLSID@ {466c1c1f-d32f-4f94-ad09-efa9f4cbcdaa}

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.FullName\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBControlCreative.FullName\CurVer@ CDDBControlCreative.CddbFullName.1

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI@ CddbCreativeUI Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI\CLSID@ {786783b9-e294-4cc2-85fb-02d950cedb64}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI\CurVer@ CDDBUIControlCreative.CddbCreativeUI.1

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI.1@ CddbCreativeUI Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbCreativeUI.1\CLSID@ {786783b9-e294-4cc2-85fb-02d950cedb64}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2@ CddbInfoWindow Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2\CLSID@ {c7421c32-dd83-4018-b488-e1b261bf0adf}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2\CurVer@ CDDBUIControlCreative.CddbInfoWindow.1

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2.1@ CddbInfoWindow2 Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbInfoWindow2.1\CLSID@ {c7421c32-dd83-4018-b488-e1b261bf0adf}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2@ CddbUI2 Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2\CLSID@ {032092d7-ca9c-4b53-80ee-6df5efadad47}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2\CurVer@ CDDBUIControlCreative.CddbUI2.1

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2.1@ CddbUI2 Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUI2.1\CLSID@ {032092d7-ca9c-4b53-80ee-6df5efadad47}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2@ CddbUIOptions2 Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2\CLSID@ {63309c0d-025b-4bc8-b81c-337f4adc2f35}

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2\CurVer

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2\CurVer@ CDDBUIControlCreative.CddbUIOptions2.1

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2.1@ CddbUIOptions2 Class

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2.1\CLSID

Reg HKLM\SOFTWARE\Classes\CDDBUIControlCreative.CddbUIOptions2.1\CLSID@ {63309c0d-025b-4bc8-b81c-337f4adc2f35}

Reg HKLM\SOFTWARE\Classes\ChromeExt@ Chrome Extension Installer

Reg HKLM\SOFTWARE\Classes\ChromeExt\DefaultIcon

Reg HKLM\SOFTWARE\Classes\ChromeExt\DefaultIcon@ C:\Documents and Settings\Andrew_2\Local Settings\Application Data\Google\Chrome\Application\chrome.exe,0

Reg HKLM\SOFTWARE\Classes\ChromeExt\shell

Reg HKLM\SOFTWARE\Classes\ChromeExt\shell\open

Reg HKLM\SOFTWARE\Classes\ChromeExt\shell\open\command

Reg HKLM\SOFTWARE\Classes\ChromeExt\shell\open\command@ "C:\Documents and Settings\Andrew_2\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" –install-extension="%1"

Reg HKLM\SOFTWARE\Classes\CrystalPluginFile@ KRISTAL Plug-In

Reg HKLM\SOFTWARE\Classes\CTMtpAut.CTMtpEventHandler@ CTMtpEventHandler Class

Reg HKLM\SOFTWARE\Classes\CTMtpAut.CTMtpEventHandler\CLSID

Reg HKLM\SOFTWARE\Classes\CTMtpAut.CTMtpEventHandler\CLSID@ {9F40AC21-F4D1-477C-AC95-7A935224220F}

Reg HKLM\SOFTWARE\Classes\CTMtpAut.CTMtpEventHandler.1@ CTMtpEventHandler Class

Reg HKLM\SOFTWARE\Classes\CTMtpAut.CTMtpEventHandler.1\CLSID

Reg HKLM\SOFTWARE\Classes\CTMtpAut.CTMtpEventHandler.1\CLSID@ {9F40AC21-F4D1-477C-AC95-7A935224220F}

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu@ CtMtpContextMenu Class

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu\CLSID

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu\CLSID@ {7895F317-A125-42CC-BD3E-5830765CE577}

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu\CurVer

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu\CurVer@ CTMtpCtx.CtMtpContextMenu.1

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu.1@ CtMtpContextMenu Class

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu.1\CLSID

Reg HKLM\SOFTWARE\Classes\CTMtpCtx.CtMtpContextMenu.1\CLSID@ {7895F317-A125-42CC-BD3E-5830765CE577}

Reg HKLM\SOFTWARE\Classes\CTSUENG.CTSUEngCtrl.2@ Creative Software AutoUpdate 2

Reg HKLM\SOFTWARE\Classes\CTSUENG.CTSUEngCtrl.2\CLSID

Reg HKLM\SOFTWARE\Classes\CTSUENG.CTSUEngCtrl.2\CLSID@ {E705A591-DA3C-4228-B0D5-A356DBA42FBF}

Reg HKLM\SOFTWARE\Classes\CTSUENG.CTSUEngCtrl.2\Insertable

Reg HKLM\SOFTWARE\Classes\CTSUENG.CTSUEngCtrl.2\Insertable@

Reg HKLM\SOFTWARE\Classes\DVDAuthorLib.DVDAuthorAccess@ DVDAuthorAccess

Reg HKLM\SOFTWARE\Classes\DVDAuthorLib.DVDAuthorAccess\CLSID

Reg HKLM\SOFTWARE\Classes\DVDAuthorLib.DVDAuthorAccess\CLSID@ {BDCB0999-A97B-433F-88A3-F26D720FFBF3}

Reg HKLM\SOFTWARE\Classes\DVDAuthorLib.SpuMuxAccess@ SpuMuxAccess

Reg HKLM\SOFTWARE\Classes\DVDAuthorLib.SpuMuxAccess\CLSID

Reg HKLM\SOFTWARE\Classes\DVDAuthorLib.SpuMuxAccess\CLSID@ {7000673A-0996-4267-95BC-02FD238D7D93}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray@ CDeleteIntervalArray Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray\CLSID@ {815CD68C-63D9-4BEF-9D1B-4B40A6EA2F34}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray\CurVer

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray\CurVer@ DVSVideoPlayerJPG.DeleteIntervalArray.1

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray.1@ CDeleteIntervalArray Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray.1\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.DeleteIntervalArray.1\CLSID@ {815CD68C-63D9-4BEF-9D1B-4B40A6EA2F34}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch@ CSceneSearch Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch\CLSID@ {F8EAF40B-6D4E-4093-8AD8-07B04DC5CCD7}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch\CurVer

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch\CurVer@ DVSVideoPlayerJPG.SceneSearch.1

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch.1@ CSceneSearch Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch.1\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.SceneSearch.1\CLSID@ {F8EAF40B-6D4E-4093-8AD8-07B04DC5CCD7}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2@ CVideoPlayer2 Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2\CLSID@ {B650B8F5-70A2-4518-8A0A-9C74A07BA3AB}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2\CurVer

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2\CurVer@ DVSVideoPlayerJPG.VideoPlayer2.1

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2.1@ CVideoPlayer2 Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2.1\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayer2.1\CLSID@ {B650B8F5-70A2-4518-8A0A-9C74A07BA3AB}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG@ CVideoPlayerJPG Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG\CLSID@ {B650B8F5-70A2-4518-8A0A-9C74A07BA3AA}

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG\CurVer

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG\CurVer@ DVSVideoPlayerJPG.VideoPlayerJPG.1

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG.1@ CVideoPlayerJPG Object

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG.1\CLSID

Reg HKLM\SOFTWARE\Classes\DVSVideoPlayerJPG.VideoPlayerJPG.1\CLSID@ {B650B8F5-70A2-4518-8A0A-9C74A07BA3AA}

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl@ JQSIEStartDetectorImpl Class

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl\CLSID

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl\CLSID@ {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl\CurVer

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl\CurVer@ ieplugin.JQSIEStartDetectorImpl.1

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl.1@ JQSIEStartDetectorImpl Class

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl.1\CLSID

Reg HKLM\SOFTWARE\Classes\ieplugin.JQSIEStartDetectorImpl.1\CLSID@ {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

Reg HKLM\SOFTWARE\Classes\KristalProjectFile@ KRISTAL Project

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\DefaultIcon@ C:\Program Files\Kreatives.org\KRISTAL Audio Engine\KRISTAL.exe,1

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\shell

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\shell@ open

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\shell\open

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\shell\open\command

Reg HKLM\SOFTWARE\Classes\KristalProjectFile\shell\open\command@ "C:\Program Files\Kreatives.org\KRISTAL Audio Engine\KRISTAL.exe" "%1"

Reg HKLM\SOFTWARE\Classes\lastfm@ URL:lastfm

Reg HKLM\SOFTWARE\Classes\lastfm@URL Protocol

Reg HKLM\SOFTWARE\Classes\lastfm\shell

Reg HKLM\SOFTWARE\Classes\lastfm\shell\open

Reg HKLM\SOFTWARE\Classes\lastfm\shell\open\command

Reg HKLM\SOFTWARE\Classes\lastfm\shell\open\command@ "C:\Program Files\Last.fm\LastFM.exe" "%1"

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent@ CLicenseAgent Class

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent\CLSID

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent\CLSID@ {ACADF079-CBCD-4032-83F2-FA47C4DB096F}

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent\CurVer

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent\CurVer@ Licdll.CLicenseAgent.1

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent.1@ CLicenseAgent Class

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent.1\CLSID

Reg HKLM\SOFTWARE\Classes\Licdll.CLicenseAgent.1\CLSID@ {ACADF079-CBCD-4032-83F2-FA47C4DB096F}

Reg HKLM\SOFTWARE\Classes\Live 7.0.1.Document\shell

Reg HKLM\SOFTWARE\Classes\Live 7.0.1.Document\shell\open

Reg HKLM\SOFTWARE\Classes\Live 7.0.1.Document\shell\open\command

Reg HKLM\SOFTWARE\Classes\MCI.MMControl@ Microsoft Multimedia Control, version 6.0

Reg HKLM\SOFTWARE\Classes\MCI.MMControl\CLSID

Reg HKLM\SOFTWARE\Classes\MCI.MMControl\CLSID@ {C1A8AF25-1257-101B-8FB0-0020AF039CA3}

Reg HKLM\SOFTWARE\Classes\MCI.MMControl\CurVer

Reg HKLM\SOFTWARE\Classes\MCI.MMControl\CurVer@ MCI.MMControl.1

Reg HKLM\SOFTWARE\Classes\MCI.MMControl.1@ Microsoft Multimedia Control, version 6.0

Reg HKLM\SOFTWARE\Classes\MCI.MMControl.1\CLSID

Reg HKLM\SOFTWARE\Classes\MCI.MMControl.1\CLSID@ {C1A8AF25-1257-101B-8FB0-0020AF039CA3}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile@ APE Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APEFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile@ APL Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.APLFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile@ FLA Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.FLAFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile@ M3U Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.M3UFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile@ MAC Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MACFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile@ MediaMonkey Package File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell\1Play@ &Install MediaMonkey package

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MMIPFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File@ MP+ Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MP+File\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile@ MPC Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPCFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile@ MPP Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.MPPFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile@ PCAST Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\DefaultIcon@ C:\Program Files\MediaMonkey\MediaMonkey.exe,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\1Play\Command@ "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\2PlayNext\Command@ "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\3Enqueue\Command@ "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\open\Command@ "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PCASTFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile@ PLS Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.PLSFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile@ VQF Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.VQFFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile@ WAV Audio File

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\DefaultIcon@ C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE,1

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell@ 1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\1Play

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\1Play@ &Play in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\1Play\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\1Play\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\1Play\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\1Play\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\2PlayNext

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\2PlayNext@ Play &next in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\2PlayNext\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\2PlayNext\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /NEXT "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\2PlayNext\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\2PlayNext\DropTarget@Clsid {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\3Enqueue

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\3Enqueue@ Play &last in MediaMonkey

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\3Enqueue\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\3Enqueue\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" /ADD "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\3Enqueue\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\3Enqueue\DropTarget@Clsid {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\open

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\open@

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\open\Command

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\open\Command@ "C:\PROGRA~1\MEDIAM~1\MEDIAM~2.EXE" "%1"

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\MediaMonkey.WAVFile\Shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp@ Messenger Application

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp\CLSID

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp\CLSID@ {FB7199AB-79BF-11d2-8D94-0000F875C541}

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp\CurVer

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp\CurVer@ Messenger.MessengerApp.1

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp.1@ Messenger Application

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp.1\CLSID

Reg HKLM\SOFTWARE\Classes\Messenger.MessengerApp.1\CLSID@ {FB7199AB-79BF-11d2-8D94-0000F875C541}

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject@ Messenger Object

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject\CLSID

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject\CLSID@ {F3A614DC-ABE0-11d2-A441-00C04F795683}

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject\CurVer

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject\CurVer@ Messenger.MsgrObject.1

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject.1@ Messenger Object

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject.1\CLSID

Reg HKLM\SOFTWARE\Classes\Messenger.MsgrObject.1\CLSID@ {F3A614DC-ABE0-11d2-A441-00C04F795683}

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation@ Messenger Object

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation\CLSID

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation\CLSID@ {B69003B3-C55E-4b48-836C-BC5946FC3B28}

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation\CurVer

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation\CurVer@ Messenger.UIAutomation.1

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation.1@ Messenger Object

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation.1\CLSID

Reg HKLM\SOFTWARE\Classes\Messenger.UIAutomation.1\CLSID@ {B69003B3-C55E-4b48-836C-BC5946FC3B28}

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock@ Microsoft WinSock Control, version 6.0

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock\CLSID

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock\CLSID@ {248DD896-BB45-11CF-9ABC-0080C7E7B78D}

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock\CurVer

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock\CurVer@ MSWinsock.Winsock.1

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock.1@ Microsoft WinSock Control, version 6.0

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID

Reg HKLM\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID@ {248DD896-BB45-11CF-9ABC-0080C7E7B78D}

Reg HKLM\SOFTWARE\Classes\Msxml2.DOMDocument.6.0@ XML DOM Document 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.DOMDocument.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.DOMDocument.6.0\CLSID@ {88d96a05-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.6.0@ Free Threaded XML DOM Document 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.6.0\CLSID@ {88d96a06-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.MXHTMLWriter.6.0@ MXHTMLWriter 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.MXHTMLWriter.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.MXHTMLWriter.6.0\CLSID@ {88d96a10-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.MXNamespaceManager.6.0@ MXNamespaceManager 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.MXNamespaceManager.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.MXNamespaceManager.6.0\CLSID@ {88d96a11-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.MXXMLWriter.6.0@ MXXMLWriter 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.MXXMLWriter.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.MXXMLWriter.6.0\CLSID@ {88d96a0f-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.SAXAttributes.6.0@ SAXAttributes 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.SAXAttributes.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.SAXAttributes.6.0\CLSID@ {88d96a0e-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.SAXXMLReader.6.0@ SAX XML Reader 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.SAXXMLReader.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.SAXXMLReader.6.0\CLSID@ {88d96a0c-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.ServerXMLHTTP.6.0@ Server XML HTTP 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.ServerXMLHTTP.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.ServerXMLHTTP.6.0\CLSID@ {88d96a0b-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.XMLHTTP.6.0@ XML HTTP 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.XMLHTTP.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.XMLHTTP.6.0\CLSID@ {88d96a0a-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.XMLSchemaCache.6.0@ XML Schema Cache 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.XMLSchemaCache.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.XMLSchemaCache.6.0\CLSID@ {88d96a07-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\Msxml2.XSLTemplate.6.0@ XSL Template 6.0

Reg HKLM\SOFTWARE\Classes\Msxml2.XSLTemplate.6.0\CLSID

Reg HKLM\SOFTWARE\Classes\Msxml2.XSLTemplate.6.0\CLSID@ {88d96a08-f192-11d4-a65f-0040963251e5}

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp@ CtMtp Class

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp\CLSID@ {5F81FBDD-6CE6-46CF-9542-7D918D18F47F}

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp\CurVer@ MtpMan.CtMtp.1

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp.1@ CtMtp Class

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.CtMtp.1\CLSID@ {5F81FBDD-6CE6-46CF-9542-7D918D18F47F}

Reg HKLM\SOFTWARE\Classes\MtpMan.Download@ Download Class

Reg HKLM\SOFTWARE\Classes\MtpMan.Download\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.Download\CLSID@ {F3BD62FD-5D5A-49D2-A9AA-1CC00215626D}

Reg HKLM\SOFTWARE\Classes\MtpMan.Download\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.Download\CurVer@ MtpMan.Download.1

Reg HKLM\SOFTWARE\Classes\MtpMan.Download.1@ Download Class

Reg HKLM\SOFTWARE\Classes\MtpMan.Download.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.Download.1\CLSID@ {F3BD62FD-5D5A-49D2-A9AA-1CC00215626D}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice@ EnumDevice Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice\CLSID@ {5167F839-19D8-44F2-AA8E-CAE16C721429}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice\CurVer@ MtpMan.EnumDevice.1

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice.1@ EnumDevice Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumDevice.1\CLSID@ {5167F839-19D8-44F2-AA8E-CAE16C721429}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder@ EnumFolder Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder\CLSID@ {166DD445-B9F6-4670-B68C-566B5E86914E}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder\CurVer@ MtpMan.EnumFolder.1

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder.1@ EnumFolder Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumFolder.1\CLSID@ {166DD445-B9F6-4670-B68C-566B5E86914E}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic@ EnumMusic Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic\CLSID@ {5BFB84E3-5609-48A0-9570-A62913F2F54E}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic\CurVer@ MtpMan.EnumMusic.1

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic.1@ EnumMusic Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumMusic.1\CLSID@ {5BFB84E3-5609-48A0-9570-A62913F2F54E}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer@ EnumOrganizer Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer\CLSID@ {F9974BB8-1CD3-4469-9275-9C39074FC3BE}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer\CurVer@ MtpMan.EnumOrganizer.1

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer.1@ EnumOrganizer Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumOrganizer.1\CLSID@ {F9974BB8-1CD3-4469-9275-9C39074FC3BE}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist@ EnumPlaylist Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist\CLSID@ {050911F7-C816-4287-B811-656D097461C1}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist\CurVer@ MtpMan.EnumPlaylist.1

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist.1@ EnumPlaylist Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumPlaylist.1\CLSID@ {050911F7-C816-4287-B811-656D097461C1}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow@ EnumSlideshow Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow\CLSID@ {7FEB2A09-2983-4BBC-B259-E05F8FD69A27}

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow\CurVer@ MtpMan.EnumSlideshow.1

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow.1@ EnumSlideshow Class

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.EnumSlideshow.1\CLSID@ {7FEB2A09-2983-4BBC-B259-E05F8FD69A27}

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary@ MusicLibrary Class

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary\CLSID@ {7E521649-1C25-4743-AAE3-63CF0F47AB42}

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary\CurVer@ MtpMan.MusicLibrary.1

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary.1@ MusicLibrary Class

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.MusicLibrary.1\CLSID@ {7E521649-1C25-4743-AAE3-63CF0F47AB42}

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary@ OrganizerLibrary Class

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary\CLSID@ {79BD47F6-0A88-419D-B6B4-ABC082C53582}

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary\CurVer@ MtpMan.OrganizerLibrary.1

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary.1@ OrganizerLibrary Class

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.OrganizerLibrary.1\CLSID@ {79BD47F6-0A88-419D-B6B4-ABC082C53582}

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload@ Upload Class

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload\CLSID@ {096023CB-A99A-4C98-A771-DDFCB85CD9C6}

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload\CurVer

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload\CurVer@ MtpMan.Upload.1

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload.1@ Upload Class

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload.1\CLSID

Reg HKLM\SOFTWARE\Classes\MtpMan.Upload.1\CLSID@ {096023CB-A99A-4C98-A771-DDFCB85CD9C6}

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document@ Digital Sheet Music

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document\DefaultIcon

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document\DefaultIcon@ C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll,0

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document\shell

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document\shell\open

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document\shell\open\command

Reg HKLM\SOFTWARE\Classes\Music.Transfer.Document\shell\open\command@ "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" http://www.musicnotes.com/download/player/?vrv=1.17

Reg HKLM\SOFTWARE\Classes\MusicnotesGuitar.File@ Musicnotes Guitar Song

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA@ BitTorrentDNA Class

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA\CLSID

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA\CLSID@ {A3C6DAFC-E193-42FC-ADCA-5316B5D6D653}

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA\CurVer

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA\CurVer@ npbtdna.BitTorrentDNA.1

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA.1@ BitTorrentDNA Class

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA.1\CLSID

Reg HKLM\SOFTWARE\Classes\npbtdna.BitTorrentDNA.1\CLSID@ {A3C6DAFC-E193-42FC-ADCA-5316B5D6D653}

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer@ Consumer Class

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer\CLSID

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer\CLSID@ {84042C58-DBA7-4570-80C9-77CAC68044A5}

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer\CurVer

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer\CurVer@ OpaQMan.Consumer.1

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer.1@ Consumer Class

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer.1\CLSID

Reg HKLM\SOFTWARE\Classes\OpaQMan.Consumer.1\CLSID@ {84042C58-DBA7-4570-80C9-77CAC68044A5}

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan@ OpaqueQueueMan Class

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan\CLSID

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan\CLSID@ {AD5F170E-0E9F-4555-B1B2-353B8BBF0583}

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan\CurVer

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan\CurVer@ OpaQMan.OpaqueQueueMan.1

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan.1@ OpaqueQueueMan Class

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan.1\CLSID

Reg HKLM\SOFTWARE\Classes\OpaQMan.OpaqueQueueMan.1\CLSID@ {AD5F170E-0E9F-4555-B1B2-353B8BBF0583}

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider@ Provider Class

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider\CLSID

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider\CLSID@ {1EC78D35-37E7-4CB0-AED1-C8E2C951D3C2}

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider\CurVer

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider\CurVer@ OpaQMan.Provider.1

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider.1@ Provider Class

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider.1\CLSID

Reg HKLM\SOFTWARE\Classes\OpaQMan.Provider.1\CLSID@ {1EC78D35-37E7-4CB0-AED1-C8E2C951D3C2}

Reg HKLM\SOFTWARE\Classes\PlayMan.Play@ Play Class

Reg HKLM\SOFTWARE\Classes\PlayMan.Play\CLSID

Reg HKLM\SOFTWARE\Classes\PlayMan.Play\CLSID@ {688E679E-8A31-44CA-BC96-EF1FC2D40461}

Reg HKLM\SOFTWARE\Classes\PlayMan.Play\CurVer

Reg HKLM\SOFTWARE\Classes\PlayMan.Play\CurVer@ PlayMan.Play.1

Reg HKLM\SOFTWARE\Classes\PlayMan.Play.1@ Play Class

Reg HKLM\SOFTWARE\Classes\PlayMan.Play.1\CLSID

Reg HKLM\SOFTWARE\Classes\PlayMan.Play.1\CLSID@ {688E679E-8A31-44CA-BC96-EF1FC2D40461}

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo@ QueryFileInfo Class

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo\CLSID

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo\CLSID@ {87B7DF92-3041-48E5-917F-8386F104705B}

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo\CurVer

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo\CurVer@ PlayMan.QueryFileInfo.1

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo.1@ QueryFileInfo Class

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo.1\CLSID

Reg HKLM\SOFTWARE\Classes\PlayMan.QueryFileInfo.1\CLSID@ {87B7DF92-3041-48E5-917F-8386F104705B}

Reg HKLM\SOFTWARE\Classes\PowerISO@ PowerISO File

Reg HKLM\SOFTWARE\Classes\PowerISO\DefaultIcon

Reg HKLM\SOFTWARE\Classes\PowerISO\DefaultIcon@ C:\Program Files\PowerISO\PowerISO.exe,0

Reg HKLM\SOFTWARE\Classes\PowerISO\shell

Reg HKLM\SOFTWARE\Classes\PowerISO\shell\open

Reg HKLM\SOFTWARE\Classes\PowerISO\shell\open\command

Reg HKLM\SOFTWARE\Classes\PowerISO\shell\open\command@ C:\Program Files\PowerISO\PowerISO.exe "%1"

Reg HKLM\SOFTWARE\Classes\ppifile@ Microsoft Passport configuration file

Reg HKLM\SOFTWARE\Classes\ppifile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\ppifile\DefaultIcon@ %SystemRoot%\system32\msppcnfg.exe,1

Reg HKLM\SOFTWARE\Classes\ppifile\shell

Reg HKLM\SOFTWARE\Classes\ppifile\shell\open

Reg HKLM\SOFTWARE\Classes\ppifile\shell\open\command

Reg HKLM\SOFTWARE\Classes\ppifile\shell\open\command@ %SystemRoot%\System32\msppcnfg.exe /Config %1

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper@ ProgressHelper Class

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper\CLSID

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper\CLSID@ {37ADF65D-C83C-409D-B415-FCC1854EB4E5}

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper\CurVer

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper\CurVer@ ProgHlp.ProgressHelper.1

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper.1@ ProgressHelper Class

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper.1\CLSID

Reg HKLM\SOFTWARE\Classes\ProgHlp.ProgressHelper.1\CLSID@ {37ADF65D-C83C-409D-B415-FCC1854EB4E5}

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive@ Psycle Music Archive

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive\DefaultIcon

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive\DefaultIcon@ C:\Program Files\Psycle\Psycle.exe

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive\Shell

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive\Shell\Open

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive\Shell\Open\Command

Reg HKLM\SOFTWARE\Classes\Psycle Music Archive\Shell\Open\Command@ ""C:\Program Files\Psycle\Psycle.exe"" ""%1""

Reg HKLM\SOFTWARE\Classes\QueMan.Queue@ Queue Class

Reg HKLM\SOFTWARE\Classes\QueMan.Queue\CLSID

Reg HKLM\SOFTWARE\Classes\QueMan.Queue\CLSID@ {20C69DF8-0DF5-4F4F-B2D1-49F53EE28563}

Reg HKLM\SOFTWARE\Classes\QueMan.Queue\CurVer

Reg HKLM\SOFTWARE\Classes\QueMan.Queue\CurVer@ QueMan.Queue.1

Reg HKLM\SOFTWARE\Classes\QueMan.Queue.1@ Queue Class

Reg HKLM\SOFTWARE\Classes\QueMan.Queue.1\CLSID

Reg HKLM\SOFTWARE\Classes\QueMan.Queue.1\CLSID@ {20C69DF8-0DF5-4F4F-B2D1-49F53EE28563}

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan@ QueueMan Class

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan\CLSID

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan\CLSID@ {FF528014-DF7C-4FE6-8D38-675195AC5162}

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan\CurVer

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan\CurVer@ QueMan.QueueMan.1

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan.1@ QueueMan Class

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan.1\CLSID

Reg HKLM\SOFTWARE\Classes\QueMan.QueueMan.1\CLSID@ {FF528014-DF7C-4FE6-8D38-675195AC5162}

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin@ ScorchPlugin Class

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin\CLSID

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin\CLSID@ {A8F2B9BD-A6A0-486A-9744-18920D898429}

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin\CurVer

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin\CurVer@ ScorchActiveXPlugin.ScorchPlugin.1

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin.1@ ScorchPlugin Class

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin.1\CLSID

Reg HKLM\SOFTWARE\Classes\ScorchActiveXPlugin.ScorchPlugin.1\CLSID@ {A8F2B9BD-A6A0-486A-9744-18920D898429}

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment@ Alignment Class

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment\CLSID

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment\CLSID@ {67C79012-A022-464a-AA13-3CB1E52AE04C}

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment\CurVer

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment\CurVer@ ScorchAxPluginBase.Alignment.1

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment.1@ Alignment Class

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment.1\CLSID

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Alignment.1\CLSID@ {67C79012-A022-464a-AA13-3CB1E52AE04C}

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size@ Size Class

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size\CLSID

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size\CLSID@ {E425C010-B9B4-43d9-8ECE-5D7D5ADB428B}

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size\CurVer

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size\CurVer@ ScorchAxPluginBase.Size.1

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size.1@ Size Class

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size.1\CLSID

Reg HKLM\SOFTWARE\Classes\ScorchAxPluginBase.Size.1\CLSID@ {E425C010-B9B4-43d9-8ECE-5D7D5ADB428B}

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch@ Sibelius Scorch Score

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch@EditFlags 0

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch@BrowserFlags 8

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch\DefaultIcon

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch\DefaultIcon@ "C:\Program Files\Mozilla Firefox\firefox.exe", 1

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch\shell

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch\shell\open

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch\shell\open\command

Reg HKLM\SOFTWARE\Classes\Sibelius.Scorch\shell\open\command@ "C:\Program Files\Mozilla Firefox\firefox.exe" "%1"

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbum@ SDBAlbum Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbum\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbum\Clsid@ {DE84FCEF-2C39-4379-AAF9-6C4A24F546F7}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbumArtItem@ SDBAlbumArtItem Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbumArtItem\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbumArtItem\Clsid@ {271724C3-5F42-49FE-988D-B47D695B3BDA}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbumArtList@ SDBAlbumArtList Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbumArtList\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbumArtList\Clsid@ {CBD2D647-2951-4B6B-9E4F-9F86460DFD5E}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbums@ SDBAlbums Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbums\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBAlbums\Clsid@ {5191CAFF-A745-4FE5-A192-767CF809823D}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBApplication@ SDBApplication Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBApplication\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBApplication\Clsid@ {148F7BB6-4943-4C53-8E30-0F9115D30283}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBArtist@ SDBArtist Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBArtist\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBArtist\Clsid@ {678D2B8C-D4FA-4087-97E2-9E6CAA10322F}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBArtists@ SDBArtists Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBArtists\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBArtists\Clsid@ {D3823CB6-635D-40B9-8744-E6621A13815A}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBCommonDialog@ SDBCommonDialog Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBCommonDialog\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBCommonDialog\Clsid@ {BEB50AAC-4796-44DC-ABCE-A017CC85489E}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDatabase@ SDBDatabase Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDatabase\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDatabase\Clsid@ {5997EFC2-503C-4D8A-89F4-DD17393F07A6}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDBIterator@ SDBDBIterator Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDBIterator\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDBIterator\Clsid@ {9F1E992A-F117-4CB0-B077-7F050F8DF8E2}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDevice@ SDBDevice Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDevice\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDevice\Clsid@ {1036EE86-E7FA-4188-8A8C-C8538DFEE8B8}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDeviceList@ SDBDeviceList Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDeviceList\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDeviceList\Clsid@ {CF173AC2-17D1-45DE-9771-0B69EAB906A0}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget@ SDBDropTarget

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget\Clsid@ {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget\shell

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget\shell\open

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget\shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTarget\shell\open\DropTarget@Clsid {AB97EDE4-091B-405F-83E6-9A31AD18EDAF}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetLast@ SDBDropTargetLast

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetLast\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetLast\Clsid@ {59924C9D-ED53-42AC-A2BA-1A5CA42D412D}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetNext@ SDBDropTargetNext

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetNext\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetNext\Clsid@ {14D51F54-D86B-4925-9BF6-5F582AF76FAA}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip@ SDBDropTargetRip

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip\Clsid@ {7903D765-DA8C-4CB9-ADF2-F88D82E6BFFE}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip\shell

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip\shell\open

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip\shell\open\DropTarget

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBDropTargetRip\shell\open\DropTarget@Clsid {7903D765-DA8C-4CB9-ADF2-F88D82E6BFFE}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBFileSystem@ SDBFileSystem Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBFileSystem\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBFileSystem\Clsid@ {8F9F89DF-2252-4D71-9CA5-E3CD15DC7073}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBHWEvents@ SDBHWEvents

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBHWEvents\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBHWEvents\Clsid@ {0BA2D9E2-D4C8-45B2-8F5B-B3ADE5E461E6}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBImage@ SDBImage Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBImage\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBImage\Clsid@ {17C64717-EFE8-44BA-AB8F-DCD34524DD31}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBIniFile@ SDBIniFile Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBIniFile\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBIniFile\Clsid@ {3981ED1A-D706-4A7F-9A58-3A8EAB9BCA33}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBMedia@ SDBMedia Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBMedia\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBMedia\Clsid@ {25FBF537-7850-48E4-90A0-8519EBA1A053}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBMenuItem@ SDBMenuItem Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBMenuItem\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBMenuItem\Clsid@ {92C40377-A07B-48E8-81AC-6ADCA700C536}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlayer@ SDBPlayer Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlayer\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlayer\Clsid@ {9DD8C561-427F-4DAB-B388-1C0837DB0FBD}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlaylist@ SDBPlaylist Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlaylist\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlaylist\Clsid@ {EDAAD31C-FEBC-4C21-BA3D-89388C6619CC}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlaylists@ SDBPlaylists Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlaylists\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBPlaylists\Clsid@ {0632ED14-116D-4CB4-B5E6-2945C4193D81}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBProgress@ SDBProgress Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBProgress\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBProgress\Clsid@ {FC025122-8B9D-4C8A-BB21-5305526BD3F6}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBRegistry@ SDBRegistry Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBRegistry\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBRegistry\Clsid@ {B8F819B6-7CF1-4C92-90C7-B3BD45BCAA8D}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBScriptControl@ SDBScriptControl Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBScriptControl\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBScriptControl\Clsid@ {B49EB7C9-4F81-496F-8FDC-1CE6FBA6EB04}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongData@ SDBSongData Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongData\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongData\Clsid@ {6BFDE5D2-6CC2-4F56-B5E7-D77E2BDBDFC1}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongIterator@ SDBSongIterator Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongIterator\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongIterator\Clsid@ {E3023C76-065D-4882-80CC-86D6C585EF90}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongList@ SDBSongList Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongList\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBSongList\Clsid@ {6D1A5B5D-E66B-41B5-8990-D876C697363C}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBStringList@ SDBStringList Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBStringList\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBStringList\Clsid@ {11340F80-9B0E-4072-B2CB-2629379A956F}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTextFile@ SDBTextFile Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTextFile\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTextFile\Clsid@ {64C870C4-35CA-4EC3-B548-DE48C1398E14}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTimer@ SDBTimer Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTimer\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTimer\Clsid@ {6B9AC9EF-BCAF-457F-A843-4987C87413C9}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTools@ SDBTools Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTools\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTools\Clsid@ {41FC2986-BA3B-4827-A9D8-6E6B406BD808}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTracksWindow@ SDBTracksWindow Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTracksWindow\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTracksWindow\Clsid@ {E6C73E13-7546-4A75-A53D-A97EDA76C941}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTrackSynchStatus@ SDBTrackSynchStatus Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTrackSynchStatus\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTrackSynchStatus\Clsid@ {45A75B30-FEB8-48D3-B215-7E70602B47D8}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTree@ SDBTree Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTree\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTree\Clsid@ {553EDFDA-388A-475E-A5C1-2E80B96DE6F9}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTreeNode@ SDBTreeNode Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTreeNode\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBTreeNode\Clsid@ {32EAD83F-AEEC-4F15-ABF6-C97186DD4EEE}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUI@ SDBUI Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUI\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUI\Clsid@ {592BF4D1-7ACF-4177-B56C-3EDC680ABF14}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIActiveX@ SDBUIActiveX Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIActiveX\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIActiveX\Clsid@ {DCAAEA6B-7A67-4F4D-93A5-23E565A8AE94}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIButton@ SDBUIButton Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIButton\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIButton\Clsid@ {47688C41-46E0-4879-9CD6-5585DD41055A}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUICheckBox@ SDBUICheckBox Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUICheckBox\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUICheckBox\Clsid@ {732E6889-F75C-4A07-8BA7-4F5414775FA4}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUICommon@ SDBUICommon Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUICommon\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUICommon\Clsid@ {70488D17-1533-4FCC-A234-9320DB980E5E}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIDockablePanel@ SDBUIDockablePanel Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIDockablePanel\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIDockablePanel\Clsid@ {778382D4-A8EF-4740-9FA9-F99C06664A3E}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIDropDown@ SDBUIDropDown Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIDropDown\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIDropDown\Clsid@ {4F520AC5-5916-47EF-B229-612D73B6F543}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIEdit@ SDBUIEdit Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIEdit\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIEdit\Clsid@ {80735E54-75C7-4E7F-9780-CA7774D6ABDB}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIForm@ SDBUIForm Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIForm\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIForm\Clsid@ {1967A0F0-B926-47B5-876E-F548BD2C96BC}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIGroupBox@ SDBUIGroupBox Object.

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIGroupBox\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIGroupBox\Clsid@ {366C9FB5-81D3-444B-AE20-4356693D55C4}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUILabel@ SDBUILabel Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUILabel\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUILabel\Clsid@ {1339436D-4ECE-40B7-B861-26F7024181B2}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIMaskEdit@ SDBUIMaskEdit Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIMaskEdit\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIMaskEdit\Clsid@ {7691E2DA-B335-4A3E-9938-D089B6343B4B}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIMultiLineEdit@ SDBUIMultiLineEdit Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIMultiLineEdit\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIMultiLineEdit\Clsid@ {EFEFBCE7-9D03-4306-91AA-783BB2308CE6}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIPanel@ SDBUIPanel Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIPanel\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIPanel\Clsid@ {242AB4BE-7BC9-4148-9CB2-56894E0709E1}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIRadioButton@ SDBUIRadioButton Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIRadioButton\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUIRadioButton\Clsid@ {C259899B-D2B9-4F73-8E14-57EC3381BB05}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUISpinEdit@ SDBUISpinEdit Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUISpinEdit\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUISpinEdit\Clsid@ {259C512B-A4A2-4BB1-A0A4-BE2997F3C0B0}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUITrackBar@ SDBUITrackBar Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUITrackBar\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUITrackBar\Clsid@ {30BC8FC9-2E92-4134-B1A6-E376535D1415}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUITranspPanel@ SDBUITranspPanel Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUITranspPanel\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBUITranspPanel\Clsid@ {A60D63C8-A653-4726-BED7-2FB0F7ACEE4B}

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBWebSearch@ SDBWebSearch Object

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBWebSearch\Clsid

Reg HKLM\SOFTWARE\Classes\SongsDB.SDBWebSearch\Clsid@ {BBCE8437-9449-4FF0-8D31-506ED45363E2}

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer@ StreamPlayer Class

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer\CLSID

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer\CLSID@ {2CF0B54B-BC7C-4130-987F-0EF3E4103C49}

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer\CurVer

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer\CurVer@ StreamPlay.StreamPlayer.1

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer.1@ StreamPlayer Class

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer.1\CLSID

Reg HKLM\SOFTWARE\Classes\StreamPlay.StreamPlayer.1\CLSID@ {2CF0B54B-BC7C-4130-987F-0EF3E4103C49}

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper@ SwHelper Class

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper\CLSID

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper\CLSID@ {1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper\CurVer

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper\CurVer@ SwBroker.SwHelper.1

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper.1@ SwHelper Class

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper.1\CLSID

Reg HKLM\SOFTWARE\Classes\SwBroker.SwHelper.1\CLSID@ {1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}

Reg HKLM\SOFTWARE\Classes\SWCtl.SWCtl.11@ Shockwave ActiveX Control

Reg HKLM\SOFTWARE\Classes\SWCtl.SWCtl.11\CLSID

Reg HKLM\SOFTWARE\Classes\SWCtl.SWCtl.11\CLSID@ {233C1507-6A77-46A4-9443-F871F945D258}

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl@ SwInstallerCtl Class

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl\CLSID

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl\CLSID@ {4DB2E429-B905-479A-9EFF-F7CBD9FD52DE}

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl\CurVer

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl\CurVer@ Swdir.SwInstallerCtl.1

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl.1@ SwInstallerCtl Class

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl.1\CLSID

Reg HKLM\SOFTWARE\Classes\Swdir.SwInstallerCtl.1\CLSID@ {4DB2E429-B905-479A-9EFF-F7CBD9FD52DE}

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes@ SwHelperAttributes Class

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes\CLSID

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes\CLSID@ {0103A448-2934-4B3D-A54E-FED761D472E0}

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes\CurVer

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes\CurVer@ SwHelper.SwHelperAttributes.1

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes.1@ SwHelperAttributes Class

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes.1\CLSID

Reg HKLM\SOFTWARE\Classes\SwHelper.SwHelperAttributes.1\CLSID@ {0103A448-2934-4B3D-A54E-FED761D472E0}

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control\MediaResources

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control\MediaResources\icm

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control\MediaResources\icm\vidc.IV41

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control\MediaResources\icm\vidc.IV41@Description Indeo? Video Interactive R4.5

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control\MediaResources\icm\vidc.IV41@Driver ir41_32.ax

Reg HKLM\SOFTWARE\Classes\System\CurrentControlSet\control\MediaResources\icm\vidc.IV41@FriendlyName Indeo? Video Interactive R4.5

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab@ Microsoft Tabbed Dialog Control, version 5.0 (SP2)

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab\CLSID

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab\CLSID@ {BDC217C5-ED16-11CD-956C-0000C04E4C0A}

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab\CurVer

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab\CurVer@ TabDlg.SSTab.1

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab.1@ Microsoft Tabbed Dialog Control, version 5.0 (SP2)

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab.1\CLSID

Reg HKLM\SOFTWARE\Classes\TabDlg.SSTab.1\CLSID@ {BDC217C5-ED16-11CD-956C-0000C04E4C0A}

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file@ TabIt Tablature

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file\DefaultIcon

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file\DefaultIcon@ C:\Program Files\TabIt\TabIt.exe,0

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file\shell

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file\shell\open

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file\shell\open\command

Reg HKLM\SOFTWARE\Classes\TabIt.tbt.file\shell\open\command@ "C:\Program Files\TabIt\TabIt.exe" "%1"

Reg HKLM\SOFTWARE\Classes\torrent@ TORRENT File

Reg HKLM\SOFTWARE\Classes\torrent\Content Type

Reg HKLM\SOFTWARE\Classes\torrent\Content Type@ application/x-bittorrent

Reg HKLM\SOFTWARE\Classes\torrent\DefaultIcon

Reg HKLM\SOFTWARE\Classes\torrent\DefaultIcon@ C:\Program Files\BitTorrent\bittorrent.exe,0

Reg HKLM\SOFTWARE\Classes\torrent\shell

Reg HKLM\SOFTWARE\Classes\torrent\shell@ open

Reg HKLM\SOFTWARE\Classes\torrent\shell\open

Reg HKLM\SOFTWARE\Classes\torrent\shell\open\command

Reg HKLM\SOFTWARE\Classes\torrent\shell\open\command@backup "C:\Program Files\BitTorrent\bittorrent.exe" "%1"

Reg HKLM\SOFTWARE\Classes\torrent\shell\open\command@ "C:\Program Files\BitTorrent\bittorrent.exe" "%1"

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor@ TS-MIDI Editor Note File

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor\DefaultIcon

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor\DefaultIcon@ C:\Program Files\TallStick\TS-MIDI Editor 1.0\ts_midedit.exe,1

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor\shell

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor\shell\open

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor\shell\open\command

Reg HKLM\SOFTWARE\Classes\TSmideditor.NoteEditor\shell\open\command@ "C:\Program Files\TallStick\TS-MIDI Editor 1.0\ts_midedit.exe" "%1"

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection@ MPCConnection Class

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection\CLSID

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection\CLSID@ {8E82AD03-D1A3-11D2-9374-00C04F72DAF7}

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection\CurVer

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection\CurVer@ UploadManager.MPCConnection.1

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection.1@ MPCConnection Class

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection.1\CLSID

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCConnection.1\CLSID@ {8E82AD03-D1A3-11D2-9374-00C04F72DAF7}

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload@ MPCUpload Class

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload\CLSID

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload\CLSID@ {8E82AD02-D1A3-11D2-9374-00C04F72DAF7}

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload\CurVer

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload\CurVer@ UploadManager.MPCUpload.1

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload.1@ MPCUpload Class

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload.1\CLSID

Reg HKLM\SOFTWARE\Classes\UploadManager.MPCUpload.1\CLSID@ {8E82AD02-D1A3-11D2-9374-00C04F72DAF7}

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo@ AudioFileInfo Class

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo\CLSID

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo\CLSID@ {C87069BE-1D15-4430-AC28-C764EA1F4C2D}

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo\CurVer

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo\CurVer@ VFSvr.AudioFileInfo.1

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo.1@ AudioFileInfo Class

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo.1\CLSID

Reg HKLM\SOFTWARE\Classes\VFSvr.AudioFileInfo.1\CLSID@ {C87069BE-1D15-4430-AC28-C764EA1F4C2D}

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo@ VideoFileInfo Class

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo\CLSID

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo\CLSID@ {855DF1ED-8620-4BEE-B09E-5DA26D056523}

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo\CurVer

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo\CurVer@ VFSvr.VideoFileInfo.1

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo.1@ VideoFileInfo Class

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo.1\CLSID

Reg HKLM\SOFTWARE\Classes\VFSvr.VideoFileInfo.1\CLSID@ {855DF1ED-8620-4BEE-B09E-5DA26D056523}

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter@ CVideoConverter Object

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter\CLSID

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter\CLSID@ {2CB8D922-FCB6-4C3D-BF17-EA2FBD98C7D2}

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter\CurVer

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter\CurVer@ VideoFileToIPOD.VideoConverter.1

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter.1@ CVideoConverter Object

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter.1\CLSID

Reg HKLM\SOFTWARE\Classes\VideoFileToIPOD.VideoConverter.1\CLSID@ {2CB8D922-FCB6-4C3D-BF17-EA2FBD98C7D2}

Reg HKLM\SOFTWARE\Classes\WaverArrangementFile@ Waver Arrangement

Reg HKLM\SOFTWARE\Classes\WaverArrangementFile\DefaultIcon

Reg HKLM\SOFTWARE\Classes\WaverArrangementFile\DefaultIcon@ C:\Program Files\Kreatives.org\KRISTAL Audio Engine\KRISTAL.exe,1

Reg HKLM\SOFTWARE\Classes\Willow.BmpRestore@ BmpRestore

Reg HKLM\SOFTWARE\Classes\Willow.BmpRestore\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.BmpRestore\CurVer@ Willow.BmpRestore.2

Reg HKLM\SOFTWARE\Classes\Willow.BmpRestore.2@ BmpRestore

Reg HKLM\SOFTWARE\Classes\Willow.BmpRestore.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.BmpRestore.2\CLSID@ {B2D75DFC-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.DXFilter@ DXFilter

Reg HKLM\SOFTWARE\Classes\Willow.DXFilter\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.DXFilter\CurVer@ Willow.DXFilter.1

Reg HKLM\SOFTWARE\Classes\Willow.DXFilter.1@ DXFilter

Reg HKLM\SOFTWARE\Classes\Willow.DXFilter.1\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.DXFilter.1\CLSID@ {B2D75E04-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.ImageUtil@ ImageUtil

Reg HKLM\SOFTWARE\Classes\Willow.ImageUtil\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.ImageUtil\CurVer@ Willow.ImageUtil.2

Reg HKLM\SOFTWARE\Classes\Willow.ImageUtil.2@ ImageUtil

Reg HKLM\SOFTWARE\Classes\Willow.ImageUtil.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.ImageUtil.2\CLSID@ {B2D75DFB-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Midi@ MIDI by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.Midi\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Midi\CurVer@ Willow.Midi.2

Reg HKLM\SOFTWARE\Classes\Willow.Midi.2@ MIDI by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.Midi.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Midi.2\CLSID@ {B2D75E09-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.MidiEvt@ MidiEvt

Reg HKLM\SOFTWARE\Classes\Willow.MidiEvt\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.MidiEvt\CurVer@ Willow.MidiEvt.2

Reg HKLM\SOFTWARE\Classes\Willow.MidiEvt.2@ MidiEvt

Reg HKLM\SOFTWARE\Classes\Willow.MidiEvt.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.MidiEvt.2\CLSID@ {B2D75E03-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.MidiPort@ MidiPort

Reg HKLM\SOFTWARE\Classes\Willow.MidiPort\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.MidiPort\CurVer@ Willow.MidiPort.2

Reg HKLM\SOFTWARE\Classes\Willow.MidiPort.2@ MidiPort

Reg HKLM\SOFTWARE\Classes\Willow.MidiPort.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.MidiPort.2\CLSID@ {B2D75E01-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Mix@ Mix

Reg HKLM\SOFTWARE\Classes\Willow.Mix\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Mix\CurVer@ Willow.Mix.2

Reg HKLM\SOFTWARE\Classes\Willow.Mix.2@ Mix

Reg HKLM\SOFTWARE\Classes\Willow.Mix.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Mix.2\CLSID@ {B2D75DFD-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.MixLine@ MixLine

Reg HKLM\SOFTWARE\Classes\Willow.MixLine\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.MixLine\CurVer@ Willow.MixLine.1

Reg HKLM\SOFTWARE\Classes\Willow.MixLine.1@ MixLine

Reg HKLM\SOFTWARE\Classes\Willow.MixLine.1\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.MixLine.1\CLSID@ {B2D75E21-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.PatchLib@ PatchLib

Reg HKLM\SOFTWARE\Classes\Willow.PatchLib\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.PatchLib\CurVer@ Willow.PatchLib.2

Reg HKLM\SOFTWARE\Classes\Willow.PatchLib.2@ PatchLib

Reg HKLM\SOFTWARE\Classes\Willow.PatchLib.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.PatchLib.2\CLSID@ {B2D75E02-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.PlayAsio@ Asio by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayAsio\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.PlayAsio\CurVer@ Willow.PlayAsio.2

Reg HKLM\SOFTWARE\Classes\Willow.PlayAsio.2@ Asio by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayAsio.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.PlayAsio.2\CLSID@ {B2D75E0B-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirShow@ DirShow by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirShow\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirShow\CurVer@ Willow.PlayDirShow.2

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirShow.2@ DirShow by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirShow.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirShow.2\CLSID@ {B2D75E07-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirSound@ DirSound by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirSound\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirSound\CurVer@ Willow.PlayDirSound.2

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirSound.2@ DirSound by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirSound.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.PlayDirSound.2\CLSID@ {B2D75E06-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.PlayWaveOut@ WaveOut by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayWaveOut\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.PlayWaveOut\CurVer@ Willow.PlayWaveOut.2

Reg HKLM\SOFTWARE\Classes\Willow.PlayWaveOut.2@ WaveOut ActiveX Control by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.PlayWaveOut.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.PlayWaveOut.2\CLSID@ {B2D75E05-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Sequence@ Sequence

Reg HKLM\SOFTWARE\Classes\Willow.Sequence\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Sequence\CurVer@ Willow.Sequence.2

Reg HKLM\SOFTWARE\Classes\Willow.Sequence.2@ Sequence

Reg HKLM\SOFTWARE\Classes\Willow.Sequence.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Sequence.2\CLSID@ {B2D75DFE-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Sfdev@ Sfdev

Reg HKLM\SOFTWARE\Classes\Willow.Sfdev\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Sfdev\CurVer@ Willow.Sfdev.1

Reg HKLM\SOFTWARE\Classes\Willow.Sfdev.1@ Sfdev

Reg HKLM\SOFTWARE\Classes\Willow.Sfdev.1\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Sfdev.1\CLSID@ {B2D75DFA-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Sfmgr@ Sfmgr

Reg HKLM\SOFTWARE\Classes\Willow.Sfmgr\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Sfmgr\CurVer@ Willow.Sfmgr.1

Reg HKLM\SOFTWARE\Classes\Willow.Sfmgr.1@ Sfmgr

Reg HKLM\SOFTWARE\Classes\Willow.Sfmgr.1\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Sfmgr.1\CLSID@ {B2D75DF9-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.SndCtrl@ Sound ActiveX Control by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.SndCtrl\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.SndCtrl\CurVer@ Willow.SndCtrl.2

Reg HKLM\SOFTWARE\Classes\Willow.SndCtrl.2@ Sound ActiveX Control by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.SndCtrl.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.SndCtrl.2\CLSID@ {B2D75DF8-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Track@ Track

Reg HKLM\SOFTWARE\Classes\Willow.Track\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Track\CurVer@ Willow.Track.2

Reg HKLM\SOFTWARE\Classes\Willow.Track.2@ Track

Reg HKLM\SOFTWARE\Classes\Willow.Track.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Track.2\CLSID@ {B2D75DFF-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Tracks@ Tracks

Reg HKLM\SOFTWARE\Classes\Willow.Tracks\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Tracks\CurVer@ Willow.Tracks.2

Reg HKLM\SOFTWARE\Classes\Willow.Tracks.2@ Tracks

Reg HKLM\SOFTWARE\Classes\Willow.Tracks.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Tracks.2\CLSID@ {B2D75E00-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.VstEffect@ VstEffect

Reg HKLM\SOFTWARE\Classes\Willow.VstEffect\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.VstEffect\CurVer@ Willow.VstEffect.1

Reg HKLM\SOFTWARE\Classes\Willow.VstEffect.1@ VstEffect

Reg HKLM\SOFTWARE\Classes\Willow.VstEffect.1\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.VstEffect.1\CLSID@ {B2D75E0F-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\Willow.Wave@ Wave by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.Wave\CurVer

Reg HKLM\SOFTWARE\Classes\Willow.Wave\CurVer@ Willow.Wave.2

Reg HKLM\SOFTWARE\Classes\Willow.Wave.2@ Wave by Willow Software

Reg HKLM\SOFTWARE\Classes\Willow.Wave.2\CLSID

Reg HKLM\SOFTWARE\Classes\Willow.Wave.2\CLSID@ {B2D75E08-E856-11d4-B868-00A0CC3D6313}

Reg HKLM\SOFTWARE\Classes\zcast@URL Protocol

Reg HKLM\SOFTWARE\Classes\zcast@ URL:zcast Protocol

Reg HKLM\SOFTWARE\Classes\zcast\DefaultIcon

Reg HKLM\SOFTWARE\Classes\zcast\DefaultIcon@ CTZenCu.exe

Reg HKLM\SOFTWARE\Classes\zcast\shell

Reg HKLM\SOFTWARE\Classes\zcast\shell\open

Reg HKLM\SOFTWARE\Classes\zcast\shell\open\command

Reg HKLM\SOFTWARE\Classes\zcast\shell\open\command@ "C:\Program Files\Creative\ZENcast Organizer\CTZenCu.exe" /url "%1"

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.com

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.com@* 4

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.org

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\skynet-laboratory.org@* 4

—- EOF - GMER 1.0.15 —-

CatByte

Post #6June 16, 2009, 12:33 AM UTC

Hi,

Please do the following:

Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Double click on combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Viewer

Post #7June 16, 2009, 3:32 AM UTC last edited June 16, 2009, 4:01 AM UTC

I managed to disable everything except for Spybot, which can't be accessed in Safe mode. Once in awhile, I can boot Windows into normal mode for a couple of minutes; long enough to see TeaTimer running. How should I go about this? EDIT: After turning off all the anti-malware protection possible, it seems that Windows no longer crashes in normal mode. However, SpyBot remains inaccessible in spite of the appearance of a TeaTimer notification.

CatByte

Post #8June 16, 2009, 9:20 AM UTC last edited June 16, 2009, 9:22 AM UTC

uninstall spybot for now - it can always be reinstalled at a later date if you decide you still want the program

Normally to disable tea timer you would do the following:

Run Spybot-S&D in Advanced Mode.
If it is not already set to do this Go to the Mode menu select "Advanced Mode"
On the left hand side, Click on Tools
Then click on the Resident Icon in the List
Uncheck "Resident TeaTimer" and OK any prompts.
Restart your computer.<–You need to do this for it to take effect

Viewer

Post #9June 16, 2009, 5:07 PM UTC

Everything seems squeaky-clean now! Regardless, I await your confirmation.

It may be worth noting that during the cleaning process, Combofix prompted me with the following information:

C:\WINDOWS\system32\mbx2midu.dll tried to hijack Combofix.

Combofix asked me to allow it to update itself, which I did.

Combofix installed the "Microsoft Windows recovery console".

Combofix detected more attempted hijackers, describing them as "rootkit" infections. They were C:\WINDOWS\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys, C:\WINDOWS\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll, C:\WINDOWS\system32\MSIVXgvvnymsxekyqlskbpirddreruhdottws.dll, C:\WINDOWS\system32\drivers\SKYNETebprsaqr.sys, C:\WINDOWS\system32\SKYNETbxiqjdoo.dll, C:\WINDOWS\system32\SKYNETsyxwxqfl.dat, C:\WINDOWS\system32\SKYNETvcbdiyij.dll, and C:\WINDOWS\system32\SKYNETvnexrlvx.dat.

I had also been dealing with a similar infection on another PC that I managed to fix on my own thanks to Superantispyware, Malwarebytes, and Spybot while in Safe Mode as the machine would crash in normal mode after about 20 minutes. After doing so, I was told that those tools nor anything else was runnable on that machine until the contents of a certain folder were deleted (I think it was c:\documents and settings\All Users\Application Data\19844684\). While it seems fine now, would further inspection of that machine be warranted and if so, would you kindly offer it? Thank you so much for your help.

Combofix.txt:

ComboFix 09-06-15.07 - Dan 2009-06-16 12:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.895.552 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG 7.5.488 *On-access scanning disabled* (Updated) {41564737-3200-1071-989B-0000E87B4FB1}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\19844684
c:\documents and settings\All Users\Application Data\99854676
c:\documents and settings\Dan\Application Data\PCTurbo Pro Free
c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504
c:\program files\Common Files\WinNT 32
c:\program files\Mozilla Firefox\Components\a5dc6df8-b186-4b59-d1d7-26b3ab12e255.dll
c:\program files\Mozilla Firefox\components\fqgejysgtcimedz.dll
c:\windows\system32\d953190e-9c36-857e-401f-cbfed790d9f4.exe
c:\windows\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys
c:\windows\system32\drivers\SKYNETebprsaqr.sys
c:\windows\system32\MSIVXgvvnymsxekyqlskbpirddreruhdottws.dll
c:\windows\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll
c:\windows\system32\SKYNETbxiqjdoo.dll
c:\windows\system32\SKYNETsyxwxqfl.dat
c:\windows\system32\SKYNETvcbdiyij.dll
c:\windows\system32\SKYNETvnexrlvx.dat
c:\docume~1\Dan\LOCALS~1\Temp\tmp1.tmp
c:\documents and settings\All Users\Application Data\19844684\19844684.exe
c:\documents and settings\All Users\Application Data\19844684\19844684.glu
c:\documents and settings\All Users\Application Data\19844684\pc19844684cnf
c:\documents and settings\All Users\Application Data\19844684\pc19844684ins
c:\documents and settings\All Users\Application Data\99854676\99854676.exe
c:\documents and settings\Dan\Application Data\PCTurbo Pro Free\Logs\update.log
c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\desktop.ini
c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\lsasvc.exe
c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\mswinsck.ocx
c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\services.exe
c:\program files\Common Files\SERVICES\S-1-5-21-1303342014-1704936951-537590071-0504\system.ico
c:\program files\Common Files\WinNT 32\service.exe
c:\windows\IE4 Error Log.txt
c:\windows\kb913800.exe
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\drivers\MSIVXpvaqcmyrltnynmioybpjcxevsiadersn.sys
c:\windows\system32\drivers\SKYNETebprsaqr.sys
c:\windows\system32\fqgejysgtcimedz.dll-uninst.exe
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXgvvnymsxekyqlskbpirddreruhdottws.dll
c:\windows\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll
c:\windows\system32\msvcsv60.dll
c:\windows\system32\SKYNETbxiqjdoo.dll
c:\windows\system32\SKYNETsyxwxqfl.dat
c:\windows\system32\SKYNETvcbdiyij.dll
c:\windows\system32\SKYNETvnexrlvx.dat
c:\windows\system32\uqksxaypqngzrz.dll
c:\windows\system32\zfyazrmoyjjrsz.exe
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
D:\Desktop.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\LEGACY_NWSAPAGENT
——-\NwSapAgent
——-\Legacy_OREANS32

((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
.

2009-06-15 15:11 . 2009-06-15 15:11 ——– d–h–w- c:\windows\PIF
2009-06-14 23:51 . 2009-06-16 15:44 ——– d—–w- C:\ComboFix
2009-06-13 16:23 . 2009-05-26 17:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-13 16:23 . 2009-06-15 00:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-13 16:23 . 2009-06-13 16:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-13 16:23 . 2009-05-26 17:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-12 19:00 . 2009-06-12 19:00 ——– dc—-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-09 11:08 . 2009-06-09 11:08 ——– d—–w- c:\program files\Common Files\Microsoft Update Engine
2009-06-09 11:08 . 2009-06-09 11:08 ——– d—–w- c:\program files\DVDConv
2009-06-09 02:02 . 2009-06-09 02:10 ——– d—–w- c:\program files\coolpro
2009-06-09 02:02 . 2009-06-09 02:02 ——– d—–w- c:\program files\coolpro2
2009-06-09 01:06 . 2009-06-09 01:06 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\NetMedia Providers
2009-06-09 00:41 . 2009-06-09 00:44 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Audacity
2009-06-09 00:41 . 2009-06-09 00:41 ——– d—–w- c:\program files\Audacity 1.3 Beta (Unicode)
2009-06-04 01:44 . 2009-06-04 02:15 ——– d—–w- c:\program files\TabIt
2009-06-01 09:54 . 2009-06-01 09:54 444928 —-a-w- c:\windows\system32\fqgejysgtcimedz.dll
2009-05-24 08:48 . 2008-12-11 12:38 159600 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-05-24 08:47 . 2009-04-03 15:18 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-05-24 08:47 . 2008-12-18 16:16 73840 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-05-24 08:47 . 2009-05-24 08:48 ——– d—–w- c:\program files\Common Files\PC Tools
2009-05-24 08:47 . 2008-12-10 15:36 64392 —-a-w- c:\windows\system32\drivers\pctplsg.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 16:36 . 2006-10-29 03:08 ——– d—–w- c:\documents and settings\Dan\Application Data\Free Download Manager
2009-06-16 16:35 . 2009-01-22 17:55 ——– d—–w- c:\documents and settings\Dan\Application Data\Dropbox
2009-06-16 15:35 . 2006-10-15 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-16 15:35 . 2006-10-15 03:38 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-16 07:07 . 2006-08-10 15:11 ——– d—–w- c:\program files\Microsoft Works
2009-06-16 03:55 . 2006-10-28 23:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-16 03:22 . 2007-04-10 05:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-16 02:02 . 2007-06-28 00:13 ——– d—–w- c:\program files\Spyware Doctor
2009-06-14 19:02 . 2007-04-10 03:55 ——– d—–w- c:\documents and settings\Dan\Application Data\AVG7
2009-06-14 14:02 . 2006-10-22 23:55 ——– d—–w- c:\program files\Xilisoft
2009-06-14 00:53 . 2007-04-13 19:00 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-06-13 16:16 . 2007-06-19 19:04 73596 —ha-w- c:\windows\system32\mlfcache.dat
2009-06-12 23:03 . 2008-10-20 02:23 ——– d—–w- c:\program files\Norton Security Scan
2009-06-12 19:18 . 2007-04-10 12:23 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\AVG7
2009-06-12 18:24 . 2007-02-14 23:26 1100 —-a-w- c:\windows\system32\d3d8caps.dat
2009-06-12 03:15 . 2006-11-21 20:50 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\OpenOffice.org2
2009-06-11 02:18 . 2008-10-21 22:05 ——– d—–w- c:\program files\DNA
2009-06-11 02:18 . 2008-10-21 22:05 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\DNA
2009-06-09 01:33 . 2006-08-10 15:08 ——– d—–w- c:\program files\Common Files\Adobe
2009-06-09 01:17 . 2006-12-06 23:59 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\BitTorrent
2009-06-09 01:09 . 2008-12-20 19:20 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Sony
2009-06-09 01:07 . 2007-01-05 23:33 48 —-a-w- c:\windows\msocreg32.dat
2009-06-09 00:59 . 2008-12-20 15:28 ——– d—–w- c:\program files\Sony
2009-06-09 00:59 . 2008-12-20 15:27 ——– d—–w- c:\program files\Sony Setup
2009-06-09 00:30 . 2006-06-19 04:25 99952 -c–a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-07 23:18 . 2007-12-16 01:00 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Digidesign
2009-06-05 19:45 . 2008-02-15 02:12 ——– d—–w- c:\program files\AIMTunes
2009-06-04 16:27 . 2009-01-22 17:55 ——– d—–w- c:\program files\Dropbox
2009-05-19 05:36 . 2009-06-12 03:37 2884832 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\vwpt.exe
2009-05-19 05:36 . 2009-06-12 03:37 28 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unregister.bat
2009-05-19 05:36 . 2009-06-12 03:37 1484856 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\toolbar.exe
2009-05-19 05:36 . 2009-06-12 03:37 25 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\register.bat
2009-05-19 05:36 . 2009-06-12 03:37 97072 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\bsetutil.exe
2009-05-19 05:36 . 2009-06-12 03:37 142040 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\alsetup.exe
2009-05-19 05:36 . 2009-06-12 03:37 30512 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\Uninstaller.exe
2009-05-19 05:36 . 2009-06-12 03:37 111920 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLSearch.dll
2009-05-16 13:47 . 2009-01-03 16:47 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Any Video Converter
2009-05-07 15:44 . 2009-03-31 19:32 344064 —-a-w- c:\windows\system32\localspl.dll
2009-05-03 17:12 . 2009-05-03 17:11 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2009-05-03 17:11 . 2009-05-03 17:11 ——– d—–w- c:\program files\DVDVideoSoft
2009-04-29 04:56 . 2006-06-17 09:23 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2006-06-17 09:23 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-26 02:27 . 2009-04-26 02:27 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-04-26 02:27 . 2006-08-10 15:05 ——– d—–w- c:\program files\Java
2009-04-26 02:25 . 2009-04-26 02:25 152576 —-a-w- c:\documents and settings\Andrew_2\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-26 02:21 . 2006-08-10 14:57 ——– d—–w- c:\program files\Google
2009-04-19 00:21 . 2009-04-19 00:21 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motport_01005.Wdf
2009-04-19 00:21 . 2009-04-19 00:21 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2009-04-19 00:20 . 2009-04-19 00:20 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2009-04-19 00:20 . 2009-04-19 00:20 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2009-04-17 09:58 . 2009-03-31 19:32 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 15:26 . 2006-06-17 09:23 583168 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-10 09:58 . 2009-04-10 09:58 711680 —-a-w- c:\windows\system32\nsa34.dll
2009-04-01 02:12 . 2006-06-17 09:39 86811 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2007-04-16 20:53 . 2007-04-16 20:53 6600704 -c–a-w- c:\program files\NETGEAR WG311T Wireless Adapter.msi
2007-04-16 20:53 . 2007-04-16 20:53 4107 -c–a-w- c:\program files\0x0409.ini
2008-01-24 21:23 . 2007-06-27 23:50 131584 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-05-03 10:06 . 2007-03-20 01:33 163328 –sha-r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2007-03-20 01:33 31232 –sha-r- c:\windows\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58CC178C-807D-74C8-917C-2D09857BA4DA}]
2009-06-01 09:54 444928 —-a-w- c:\windows\system32\fqgejysgtcimedz.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2008-09-07 07:20 143360 —-a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2008-09-07 07:20 143360 —-a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2008-09-07 07:20 143360 —-a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"StrokeIt"="c:\program files\Strokeit\strokeit.exe" [2005-02-17 21504]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2006-08-21 2068527]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-10 68856]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
"Google Update"="c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-10 139264]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-30 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-30 86016]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2003-07-13 155648]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 196608]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"DigidesignMMERefresh"="c:\program files\Digidesign\Drivers\MMERefresh.exe" [2005-10-26 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]
"CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2004-12-09 550912]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-11-09 15473664]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-11-30 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2006-10-04 53760]

c:\documents and settings\Dan\Start Menu\Programs\Startup\
Dropbox.lnk - c:\program files\Dropbox\Dropbox.exe [2008-9-26 24096981]
Grattitude Journal.txt.lnk - c:\documents and settings\Dan\My Documents\Grattitude Journal.txt [2007-4-20 6492]
Shortcut to Accomplishments2.txt.lnk - c:\documents and settings\Dan\My Documents\Accomplishments2.txt [2007-4-3 2039]
Shortcut to Vision.bmp.lnk - c:\documents and settings\Dan\My Documents\Vision.bmp [2007-2-22 11664054]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI2"=diomidi.dll
"midi1"=mbx2midu.dll
"wave1"=Digi32.dll
"midi3"=mbx2midu.dll
"midi4"=mbx2midu.dll
"midi5"=mbx2midu.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Maxthon Access Connector.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Maxthon Access Connector.lnk
backup=c:\windows\pss\Maxthon Access Connector.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311T Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG311T Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Andrew_2^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Andrew_2^Start Menu^Programs^Startup^Quick'n Easy FTP Server.lnk]
backup=c:\windows\pss\Quick'n Easy FTP Server.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Downloads\\utorrent.exe"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 DigiFilter;DigiFilter;c:\windows\system32\drivers\DigiFilt.sys [2007-12-15 8:52 PM 16384]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-05-24 4:47 AM 130936]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2007-10-29 9:34 AM 132736]
R1 IfsDrives;IfsDrives;c:\windows\system32\drivers\IfsDrives.sys [2007-10-29 9:34 AM 4608]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-02-14 24652]
R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2007-04-15 6016]
R3 dalwdmservice;dal service;c:\windows\system32\drivers\Dalwdm.sys [2007-12-15 8:51 PM 105472]
R3 MBX2DFU;MBX2DFU;c:\windows\system32\drivers\mbx2dfu.sys [2007-12-15 8:51 PM 15488]
R3 MBX2MIDK;Digidesign Mbox 2 Midi Driver;c:\windows\system32\drivers\mbx2midk.sys [2007-12-15 8:51 PM 15232]
S3 ForteUSB;AUDIOVOX USB Driver Service;c:\windows\system32\drivers\ForteUSB.sys [2008-11-02 10658]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-06-27 7:50 PM 29744]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-08-21 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-08-21 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-06-18 8:18 PM 23680]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-03-26 8:49 PM 348752]
S3 ultradfg;ultradfg;c:\windows\system32\drivers\ultradfg.sys [2007-12-22 4:50 PM 23552]
.
Contents of the 'Scheduled Tasks' folder

2009-06-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-25 04:54]

2009-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1858818111-1743214436-3610660567-1008.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 12:43]

2009-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1858818111-1743214436-3610660567-1011.job
- c:\documents and settings\Andrew_2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 21:50]

2009-06-14 c:\windows\Tasks\Norton Security Scan for Andrew_2.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 00:20]

2009-06-16 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 18:08]

2009-06-04 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 18:08]
.
- - - - ORPHANS REMOVED - - - -

Notify-dimsntfy - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/ig/gatewayr?hl=en
uInternet Connection Wizard,ShellNext = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5220
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://64.21.226.243/activex/AMC.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-16 12:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
"AB141C35E9F4BF344B9FC010BB17F68A"=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•A~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\mbx2midu.dll

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\mbx2midu.dll

- - - - - - - > 'explorer.exe'(1140)
c:\windows\system32\mbx2midu.dll
c:\program files\Dropbox\DropboxExt.dll
c:\program files\Strokeit\mhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\SmartFTP Client\smarthook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\acs.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\ehome\mcrdsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\SpywareGuard\sgmain.exe
.
**************************************************************************
.
Completion time: 2009-06-16 12:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-16 16:41

Pre-Run: 20,388,388,864 bytes free
Post-Run: 22,878,429,184 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

379 — E O F — 2009-06-16 07:07

CatByte

Post #10June 16, 2009, 5:22 PM UTC

Hi,
There is still more work to do on this machine, absense of symptoms doesn't always mean the machine is totally clean, so still stay with me till i give the 'all clear', then i will be happy to have a look at the 2nd machine.

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Windows_Only_Runs_Safe_Mode_Anti_Malware_Apps_Inaccessible_t104119.html&view=findpost&p=568888#entry568888

collect::
c:\windows\system32\fqgejysgtcimedz.dll

registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58CC178C-807D-74C8-917C-2D09857BA4DA}]

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Viewer

Post #11June 16, 2009, 6:07 PM UTC

ComboFix 09-06-15.07 - Dan 2009-06-16 13:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.895.347 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt
AV: AVG 7.5.488 *On-access scanning disabled* (Updated) {41564737-3200-1071-989B-0000E87B4FB1}

file zipped: c:\windows\system32\fqgejysgtcimedz.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\fqgejysgtcimedz.dll

.
((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
.

2009-06-15 15:11 . 2009-06-15 15:11 ——– d–h–w- c:\windows\PIF
2009-06-14 23:51 . 2009-06-16 15:44 ——– d—–w- C:\ComboFix
2009-06-13 16:23 . 2009-05-26 17:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-13 16:23 . 2009-06-15 00:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-13 16:23 . 2009-06-13 16:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-13 16:23 . 2009-05-26 17:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-12 19:00 . 2009-06-12 19:00 ——– dc—-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-09 11:08 . 2009-06-09 11:08 ——– d—–w- c:\program files\Common Files\Microsoft Update Engine
2009-06-09 11:08 . 2009-06-09 11:08 ——– d—–w- c:\program files\DVDConv
2009-06-09 02:02 . 2009-06-09 02:10 ——– d—–w- c:\program files\coolpro
2009-06-09 02:02 . 2009-06-09 02:02 ——– d—–w- c:\program files\coolpro2
2009-06-09 01:06 . 2009-06-09 01:06 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\NetMedia Providers
2009-06-09 00:41 . 2009-06-09 00:44 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Audacity
2009-06-09 00:41 . 2009-06-09 00:41 ——– d—–w- c:\program files\Audacity 1.3 Beta (Unicode)
2009-06-04 01:44 . 2009-06-04 02:15 ——– d—–w- c:\program files\TabIt
2009-05-24 08:48 . 2008-12-11 12:38 159600 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-05-24 08:47 . 2009-04-03 15:18 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-05-24 08:47 . 2008-12-18 16:16 73840 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-05-24 08:47 . 2009-05-24 08:48 ——– d—–w- c:\program files\Common Files\PC Tools
2009-05-24 08:47 . 2008-12-10 15:36 64392 —-a-w- c:\windows\system32\drivers\pctplsg.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 18:03 . 2006-10-29 03:08 ——– d—–w- c:\documents and settings\Dan\Application Data\Free Download Manager
2009-06-16 17:22 . 2009-01-22 17:55 ——– d—–w- c:\documents and settings\Dan\Application Data\Dropbox
2009-06-16 15:35 . 2006-10-15 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-16 15:35 . 2006-10-15 03:38 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-16 07:07 . 2006-08-10 15:11 ——– d—–w- c:\program files\Microsoft Works
2009-06-16 03:55 . 2006-10-28 23:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-16 03:22 . 2007-04-10 05:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-16 02:02 . 2007-06-28 00:13 ——– d—–w- c:\program files\Spyware Doctor
2009-06-14 19:02 . 2007-04-10 03:55 ——– d—–w- c:\documents and settings\Dan\Application Data\AVG7
2009-06-14 14:02 . 2006-10-22 23:55 ——– d—–w- c:\program files\Xilisoft
2009-06-14 00:53 . 2007-04-13 19:00 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-06-13 16:16 . 2007-06-19 19:04 73596 —ha-w- c:\windows\system32\mlfcache.dat
2009-06-12 23:03 . 2008-10-20 02:23 ——– d—–w- c:\program files\Norton Security Scan
2009-06-12 19:18 . 2007-04-10 12:23 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\AVG7
2009-06-12 18:24 . 2007-02-14 23:26 1100 —-a-w- c:\windows\system32\d3d8caps.dat
2009-06-12 03:15 . 2006-11-21 20:50 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\OpenOffice.org2
2009-06-11 02:18 . 2008-10-21 22:05 ——– d—–w- c:\program files\DNA
2009-06-11 02:18 . 2008-10-21 22:05 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\DNA
2009-06-09 01:33 . 2006-08-10 15:08 ——– d—–w- c:\program files\Common Files\Adobe
2009-06-09 01:17 . 2006-12-06 23:59 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\BitTorrent
2009-06-09 01:09 . 2008-12-20 19:20 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Sony
2009-06-09 01:07 . 2007-01-05 23:33 48 —-a-w- c:\windows\msocreg32.dat
2009-06-09 00:59 . 2008-12-20 15:28 ——– d—–w- c:\program files\Sony
2009-06-09 00:59 . 2008-12-20 15:27 ——– d—–w- c:\program files\Sony Setup
2009-06-09 00:30 . 2006-06-19 04:25 99952 -c–a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-07 23:18 . 2007-12-16 01:00 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Digidesign
2009-06-05 19:45 . 2008-02-15 02:12 ——– d—–w- c:\program files\AIMTunes
2009-06-04 16:27 . 2009-01-22 17:55 ——– d—–w- c:\program files\Dropbox
2009-05-19 05:36 . 2009-06-12 03:37 2884832 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\vwpt.exe
2009-05-19 05:36 . 2009-06-12 03:37 28 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unregister.bat
2009-05-19 05:36 . 2009-06-12 03:37 1484856 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\toolbar.exe
2009-05-19 05:36 . 2009-06-12 03:37 25 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\register.bat
2009-05-19 05:36 . 2009-06-12 03:37 97072 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\bsetutil.exe
2009-05-19 05:36 . 2009-06-12 03:37 142040 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\alsetup.exe
2009-05-19 05:36 . 2009-06-12 03:37 30512 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\Uninstaller.exe
2009-05-19 05:36 . 2009-06-12 03:37 111920 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLSearch.dll
2009-05-16 13:47 . 2009-01-03 16:47 ——– d—–w- c:\documents and settings\Andrew_2\Application Data\Any Video Converter
2009-05-07 15:44 . 2009-03-31 19:32 344064 —-a-w- c:\windows\system32\localspl.dll
2009-05-03 17:12 . 2009-05-03 17:11 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2009-05-03 17:11 . 2009-05-03 17:11 ——– d—–w- c:\program files\DVDVideoSoft
2009-04-29 04:56 . 2006-06-17 09:23 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2006-06-17 09:23 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-26 02:27 . 2009-04-26 02:27 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-04-26 02:27 . 2006-08-10 15:05 ——– d—–w- c:\program files\Java
2009-04-26 02:25 . 2009-04-26 02:25 152576 —-a-w- c:\documents and settings\Andrew_2\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-26 02:21 . 2006-08-10 14:57 ——– d—–w- c:\program files\Google
2009-04-19 00:21 . 2009-04-19 00:21 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motport_01005.Wdf
2009-04-19 00:21 . 2009-04-19 00:21 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2009-04-19 00:20 . 2009-04-19 00:20 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2009-04-19 00:20 . 2009-04-19 00:20 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2009-04-17 09:58 . 2009-03-31 19:32 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 15:26 . 2006-06-17 09:23 583168 —-a-w- c:\windows\system32\rpcrt4.dll
2009-04-10 09:58 . 2009-04-10 09:58 711680 —-a-w- c:\windows\system32\nsa34.dll
2009-04-01 02:12 . 2006-06-17 09:39 86811 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2007-04-16 20:53 . 2007-04-16 20:53 6600704 -c–a-w- c:\program files\NETGEAR WG311T Wireless Adapter.msi
2007-04-16 20:53 . 2007-04-16 20:53 4107 -c–a-w- c:\program files\0x0409.ini
2008-01-24 21:23 . 2007-06-27 23:50 131584 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-05-03 10:06 . 2007-03-20 01:33 163328 –sha-r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2007-03-20 01:33 31232 –sha-r- c:\windows\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2008-09-07 07:20 143360 —-a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2008-09-07 07:20 143360 —-a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2008-09-07 07:20 143360 —-a-w- c:\program files\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"StrokeIt"="c:\program files\Strokeit\strokeit.exe" [2005-02-17 21504]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2006-08-21 2068527]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-10 68856]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
"Google Update"="c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-10 139264]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-30 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-30 86016]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2003-07-13 155648]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 196608]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2005-03-23 217088]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"DigidesignMMERefresh"="c:\program files\Digidesign\Drivers\MMERefresh.exe" [2005-10-26 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-11-02 167936]
"CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]
"CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2004-12-09 550912]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-11-09 15473664]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-11-30 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2006-10-04 53760]

c:\documents and settings\Dan\Start Menu\Programs\Startup\
Dropbox.lnk - c:\program files\Dropbox\Dropbox.exe [2008-9-26 24096981]
Grattitude Journal.txt.lnk - c:\documents and settings\Dan\My Documents\Grattitude Journal.txt [2007-4-20 6492]
Shortcut to Accomplishments2.txt.lnk - c:\documents and settings\Dan\My Documents\Accomplishments2.txt [2007-4-3 2039]
Shortcut to Vision.bmp.lnk - c:\documents and settings\Dan\My Documents\Vision.bmp [2007-2-22 11664054]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MIDI2"=diomidi.dll
"midi1"=mbx2midu.dll
"wave1"=Digi32.dll
"midi3"=mbx2midu.dll
"midi4"=mbx2midu.dll
"midi5"=mbx2midu.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Maxthon Access Connector.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Maxthon Access Connector.lnk
backup=c:\windows\pss\Maxthon Access Connector.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG311T Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG311T Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Andrew_2^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Andrew_2^Start Menu^Programs^Startup^Quick'n Easy FTP Server.lnk]
backup=c:\windows\pss\Quick'n Easy FTP Server.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Downloads\\utorrent.exe"=
"c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Sony\\Vegas Pro 8.0\\VegSrv80.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 DigiFilter;DigiFilter;c:\windows\system32\drivers\DigiFilt.sys [2007-12-15 8:52 PM 16384]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-05-24 4:47 AM 130936]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2007-10-29 9:34 AM 132736]
R1 IfsDrives;IfsDrives;c:\windows\system32\drivers\IfsDrives.sys [2007-10-29 9:34 AM 4608]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-02-14 24652]
R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2007-04-15 6016]
R3 dalwdmservice;dal service;c:\windows\system32\drivers\Dalwdm.sys [2007-12-15 8:51 PM 105472]
R3 MBX2DFU;MBX2DFU;c:\windows\system32\drivers\mbx2dfu.sys [2007-12-15 8:51 PM 15488]
R3 MBX2MIDK;Digidesign Mbox 2 Midi Driver;c:\windows\system32\drivers\mbx2midk.sys [2007-12-15 8:51 PM 15232]
S3 ForteUSB;AUDIOVOX USB Driver Service;c:\windows\system32\drivers\ForteUSB.sys [2008-11-02 10658]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-06-27 7:50 PM 29744]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-08-21 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-08-21 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-06-18 8:18 PM 23680]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-03-26 8:49 PM 348752]
S3 ultradfg;ultradfg;c:\windows\system32\drivers\ultradfg.sys [2007-12-22 4:50 PM 23552]
.
Contents of the 'Scheduled Tasks' folder

2009-06-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-25 04:54]

2009-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1858818111-1743214436-3610660567-1008.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 12:43]

2009-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1858818111-1743214436-3610660567-1011.job
- c:\documents and settings\Andrew_2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 21:50]

2009-06-14 c:\windows\Tasks\Norton Security Scan for Andrew_2.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 00:20]

2009-06-16 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 18:08]

2009-06-04 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 18:08]
.
- - - - ORPHANS REMOVED - - - -

BHO-{58CC178C-807D-74C8-917C-2D09857BA4DA} - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/ig/gatewayr?hl=en
uInternet Connection Wizard,ShellNext = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5220
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://64.21.226.243/activex/AMC.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-16 14:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
"AB141C35E9F4BF344B9FC010BB17F68A"=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•A~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\mbx2midu.dll

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\mbx2midu.dll
.
Completion time: 2009-06-16 14:05
ComboFix-quarantined-files.txt 2009-06-16 18:05
ComboFix2.txt 2009-06-16 16:41

Pre-Run: 22,220,451,840 bytes free
Post-Run: 22,193,287,168 bytes free

285 — E O F — 2009-06-16 07:07
Upload was successful

CatByte

Post #12June 16, 2009, 6:35 PM UTC

Hi,

please do the following:

I would like you to upload a file to be scanned

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:

c:\windows\system32\mbx2midu.dll
Click on the Upload button
If a pop-up appears saying the file has been scanned already, please select the ReScan button.
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

Viewer

Post #13June 16, 2009, 6:43 PM UTC last edited June 16, 2009, 6:46 PM UTC

Doesn't seem to want to copy anything even though it told me it has. Here's the url: http://virscan.org/report/ca413f3d50e6374f…27ed6b3ecc.html

VirSCAN.org Scanned Report :
Scanned time : 2009/06/16 13:38:41 (CDT)
Scanner results: All Scanners reported not find malware!
File Name : mbx2midu.dll
File Size : 45056 byte
File Type : PE32 executable for MS Windows (DLL) (console) Intel 80386 3
MD5 : 1ecf1a9d4b6ad41d5e262ccfc9a7138c
SHA1 : add59b91082405b9dfe270b42d575972c3f904ff
Online report : http://virscan.org/report/ca413f3d50e6374f…27ed6b3ecc.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090616223118 2009-06-16 2.58 -
AhnLab V3 2009.06.17.00 2009.06.17 2009-06-17 0.69 -
AntiVir 8.2.0.187 7.1.4.100 2009-06-16 0.46 -
Antiy 2.0.18 20090616.2549523 2009-06-16 0.12 -
Arcavir 2009 200906161348 2009-06-16 0.04 -
Authentium 5.1.1 200906161555 2009-06-16 1.14 -
AVAST! 4.7.4 090616-0 2009-06-16 0.00 -
AVG 8.5.286 270.12.73/2180 2009-06-16 3.31 -
BitDefender 7.81008.3349117 7.26016 2009-06-17 2.99 -
CA (VET) 9.0.0.143 31.6.6560 2009-06-16 7.42 -
ClamAV 0.95.1 9470 2009-06-16 0.02 -
Comodo 3.9 1341 2009-06-16 0.78 -
CP Secure 1.1.0.715 2009.06.16 2009-06-16 10.08 -
Dr.Web 4.44.0.9170 2009.06.16 2009-06-16 4.71 -
F-Prot 4.4.4.56 20090615 2009-06-15 1.11 -
F-Secure 5.51.6100 2009.06.16.13 2009-06-16 0.07 -
Fortinet 2.81-3.117 10.502 2009-06-16 0.20 -
GData 19.5858/19.366 20090616 2009-06-16 4.27 -
ViRobot 20090616 2009.06.16 2009-06-16 0.41 -
Ikarus T3.1.01.59 2009.06.16.72875 2009-06-16 3.15 -
JiangMin 11.0.706 2009.06.16 2009-06-16 2.04 -
Kaspersky 5.5.10 2009.06.16 2009-06-16 0.06 -
KingSoft 2009.2.5.15 2009.6.16.18 2009-06-16 0.50 -
McAfee 5.3.00 5648 2009-06-16 3.05 -
Microsoft 1.4701 2009.06.16 2009-06-16 4.34 -
mks_vir 2.01 2009.06.15 2009-06-15 3.27 -
Norman 6.01.09 6.01.00 2009-06-16 4.01 -
Panda 9.05.01 2009.06.16 2009-06-16 1.69 -
Trend Micro 8.700-1004 6.197.00 2009-06-16 0.02 -
Quick Heal 10.00 2009.06.16 2009-06-16 1.19 -
Rising 20.0 21.34.13.00 2009-06-16 0.76 -
Sophos 2.87.1 4.42 2009-06-17 2.48 -
Sunbelt 5191 5191 2009-06-15 0.84 -
Symantec 1.3.0.24 20090616.004 2009-06-16 0.06 -
nProtect 20090616.03 4261430 2009-06-16 5.43 -
The Hacker 6.3.4.3 v00345 2009-06-15 0.67 -
VBA32 3.12.10.7 20090615.1405 2009-06-15 1.97 -
VirusBuster 4.5.11.10 10.107.15/1636796 2009-06-16 1.97 -

CatByte

Post #14June 16, 2009, 6:48 PM UTC

Ok, good,

Please do the following:

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so.

NEXT
It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner:

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

You can refer to this animation by sundavis.

Viewer

Post #15June 17, 2009, 6:20 PM UTC

mbam-log-2009-06-16 (15-12-26).txt: Malwarebytes' Anti-Malware 1.37 Database version: 2288 Windows 5.1.2600 Service Pack 2 2009-06-16 3:12:26 PM mbam-log-2009-06-16 (15-12-26).txt Scan type: Quick Scan Objects scanned: 100987 Time elapsed: 5 minute(s), 10 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 2 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDConv (Trojan.DNSChanger) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: c:\documents and settings\Andrew_2\Start Menu\Programs\DVDConv (Trojan.DNSChanger) -> Quarantined and deleted successfully. C:\Program Files\DVDConv (Trojan.DNSChanger) -> Quarantined and deleted successfully. Files Infected: c:\documents and settings\Andrew_2\start menu\Programs\DVDConv\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully. c:\program files\DVDConv\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully. Kaspersky Online Scanner 7: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, June 17, 2009 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Tuesday, June 16, 2009 20:59:57 Records in database: 2352537 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan statistics: Files scanned: 425250 Threat name: 16 Infected objects: 30 Suspicious objects: 0 Duration of the scan: 21:58:39 File name / Threat name / Threats count C:\Documents and Settings\Andrew_2\My Documents\Downloads\Sony_ACID_Music_Studio 7-over 3,000 ACIDized loops\SonyACID Music-Studio.7\musicstudio70a-trial_enu.exe Infected: Trojan.Win32.Buzus.ryd 1 C:\Documents and Settings\Dan\DoctorWeb\Quarantine\VNCHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1 C:\Documents and Settings\Dan\DoctorWeb\Quarantine\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1 C:\Documents and Settings\Dan\DoctorWeb\Quarantine\WinVNC.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1 C:\Downloads\LogMeIn.exe Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a 2 C:\Downloads\tightvnc-1.2.9-setup.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1 C:\Downloads\tightvnc-1.2.9-setup.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1 C:\Program Files\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1 C:\Program Files\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1 C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\19844684\19844684.exe.vir Infected: not-a-virus:FraudTool.Win32.SystemSecurity.mk 1 C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\99854676\99854676.exe.vir Infected: Trojan-Downloader.Win32.FraudLoad.wbza 1 C:\QooBox\Quarantine\C\Program Files\Common Files\Services\S-1-5-21-1303342014-1704936951-537590071-0504\lsasvc.exe.vir Infected: Backdoor.Win32.VB.jfs 1 C:\QooBox\Quarantine\C\Program Files\Common Files\Services\S-1-5-21-1303342014-1704936951-537590071-0504\services.exe.vir Infected: Trojan-Dropper.Win32.Agent.attc 1 C:\QooBox\Quarantine\C\Program Files\Common Files\WinNT 32\service.exe.vir Infected: Trojan.Win32.Buzus.beos 1 C:\QooBox\Quarantine\C\Program Files\Mozilla Firefox\components\a5dc6df8-b186-4b59-d1d7-26b3ab12e255.dll.vir Infected: Trojan-Downloader.Win32.Zlob.bgzo 1 C:\QooBox\Quarantine\C\Program Files\Mozilla Firefox\components\fqgejysgtcimedz.dll.vir Infected: Trojan-Downloader.Win32.Zlob.bfeb 1 C:\QooBox\Quarantine\C\WINDOWS\system32\MSIVXtoqmiydlnpkmlkpubfufnmupuyxcwuvu.dll.vir Infected: Trojan.Win32.Agent.clxm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\SKYNETvcbdiyij.dll.vir Infected: Trojan.Win32.Small.bzc 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000001.dll Infected: Trojan.Win32.Agent.clxm 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000005.dll Infected: Trojan.Win32.Small.bzc 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000026.exe Infected: Backdoor.Win32.VB.jfs 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000028.exe Infected: Trojan-Dropper.Win32.Agent.attc 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000030.exe Infected: Trojan.Win32.Buzus.beos 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000034.exe Infected: not-a-virus:FraudTool.Win32.SystemSecurity.mk 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000035.exe Infected: Trojan-Downloader.Win32.FraudLoad.wbza 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000069.exe Infected: Trojan-Dropper.Win32.Agent.attc 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000078.dll Infected: Trojan-Downloader.Win32.Zlob.bgzo 1 C:\System Volume Information\_restore{4E015214-6BB0-4181-B365-456CF1DEC069}\RP0\A0000079.dll Infected: Trojan-Downloader.Win32.Zlob.bfeb 1 D:\i386\Apps\App00577\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 The selected area was scanned.

[Resolved] Windows Only Runs in Safe Mode; Anti-Malware Apps Inac

✨ Ask AI

Ask AI