[Resolved] Adware HBHelper / Browser Hijacker Desktop (page 6)

Shenlord

Post #76March 27, 2010, 7:11 PM UTC

part 4 gmer

Breaker Class
Reg HKLM\SOFTWARE\Classes\NLG.Japanese Wordbreaker.4\CLSID
Reg HKLM\SOFTWARE\Classes\NLG.Japanese Wordbreaker.4\CLSID@ {BE41F4E6-9EAD-498f-A473-F3CA66F9BE8B}
Reg HKLM\SOFTWARE\Classes\OR Web Client@ Creative Product Registration ActiveX Control Module
Reg HKLM\SOFTWARE\Classes\OR Web Client\CLSID
Reg HKLM\SOFTWARE\Classes\OR Web Client\CLSID@ {E56347B0-6C2B-4C2E-939F-EE513EAC80BC}
Reg HKLM\SOFTWARE\Classes\OR Web Client\Insertable
Reg HKLM\SOFTWARE\Classes\OR Web Client\Insertable@
Reg HKLM\SOFTWARE\Classes\pando\Shell
Reg HKLM\SOFTWARE\Classes\pando\Shell\Open
Reg HKLM\SOFTWARE\Classes\pando\Shell\Open\Command
Reg HKLM\SOFTWARE\Classes\pando\Shell\Open\Command@ C:\WINDOWS\system32\cmd.exe /Q /D /C "start http://www.pando.com/link/pmb_pando"
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl@ PandoWebInstCtrl Class
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl\CLSID
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl\CLSID@ {68979310-D979-4CCA-AB57-83BEFB03E0D3}
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl\CurVer
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl\CurVer@ PandoWebInst.PandoWebInstCtrl.1
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl.1@ PandoWebInstCtrl Class
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl.1\CLSID
Reg HKLM\SOFTWARE\Classes\PandoWebInst.PandoWebInstCtrl.1\CLSID@ {68979310-D979-4CCA-AB57-83BEFB03E0D3}
Reg HKLM\SOFTWARE\Classes\PCEFILE@ PCEFILE
Reg HKLM\SOFTWARE\Classes\PCEFILE\DefaultIcon
Reg HKLM\SOFTWARE\Classes\PCEFILE\DefaultIcon@ C:\Program Files\PP Chinese Expert\CHNEXP\win32\ChExp.ico
Reg HKLM\SOFTWARE\Classes\PCEFILE\shell
Reg HKLM\SOFTWARE\Classes\PCEFILE\shell\open
Reg HKLM\SOFTWARE\Classes\PCEFILE\shell\open\command
Reg HKLM\SOFTWARE\Classes\PCEFILE\shell\open\command@ C:\Program Files\PP Chinese Expert\CHNEXP\win32\ChExp.exe %l
Reg HKLM\SOFTWARE\Classes\picasa@ Picasa Command protocol
Reg HKLM\SOFTWARE\Classes\picasa@URL Protocol
Reg HKLM\SOFTWARE\Classes\picasa\shell
Reg HKLM\SOFTWARE\Classes\picasa\shell\open
Reg HKLM\SOFTWARE\Classes\picasa\shell\open\command
Reg HKLM\SOFTWARE\Classes\picasa\shell\open\command@ "E:\Program Files\Google\Picasa3\Picasa3.exe" "%1"
Reg HKLM\SOFTWARE\Classes\picasa2.autoplay@DefaultIcon E:\Program Files\Google\Picasa3\Picasa3.exe,1
Reg HKLM\SOFTWARE\Classes\picasa2.autoplay\shell
Reg HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import
Reg HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command
Reg HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command@ E:\Program Files\Google\Picasa3\Picasa3.exe "%1"
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot@ PixHotspot Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot\CLSID@ {2E41758B-912C-4ec5-BD6C-187A05C7FFEA}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot\CurVer
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot\CurVer@ Piwe2.PixHotspot.1
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot.1@ PixHotspot Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot.1\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixHotspot.1\CLSID@ {2E41758B-912C-4ec5-BD6C-187A05C7FFEA}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode@ PixNode Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode\CLSID@ {98AFDFB6-72AE-444b-9AE1-1F740BEF411E}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode\CurVer
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode\CurVer@ Piwe2.PixNode.1
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode.1@ PixNode Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode.1\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixNode.1\CLSID@ {98AFDFB6-72AE-444b-9AE1-1F740BEF411E}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs@ PixPixHs Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs\CLSID@ {1D13DB21-CF59-4549-911E-D6461D43702C}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs\CurVer
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs\CurVer@ Piwe2.PixPixHs.1
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs.1@ PixPixHs Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs.1\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixPixHs.1\CLSID@ {1D13DB21-CF59-4549-911E-D6461D43702C}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView@ PixScreenView Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView\CLSID@ {4118FE34-5C50-4D44-8F76-D63D4D0F4225}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView\CurVer
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView\CurVer@ Piwe2.PixScreenView.1
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView.1@ PixScreenView Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView.1\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixScreenView.1\CLSID@ {4118FE34-5C50-4D44-8F76-D63D4D0F4225}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs@ PixSndHs Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs\CLSID@ {1E5F91E8-2B50-4307-BC81-FE8C21A65AD3}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs\CurVer
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs\CurVer@ Piwe2.PixSndHs.1
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs.1@ PixSndHs Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs.1\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixSndHs.1\CLSID@ {1E5F91E8-2B50-4307-BC81-FE8C21A65AD3}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs@ PixUrlHs Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs\CLSID@ {F205B775-4FDA-45ad-9631-AD90F3F643FF}
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs\CurVer
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs\CurVer@ Piwe2.PixUrlHs.1
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs.1@ PixUrlHs Class
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs.1\CLSID
Reg HKLM\SOFTWARE\Classes\Piwe2.PixUrlHs.1\CLSID@ {F205B775-4FDA-45ad-9631-AD90F3F643FF}
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2@ Codecs2 Class
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2\CurVer
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2\CurVer@ PixAround.Codecs2.11
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11@ Codecs2 Class
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\//CLSID
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\//CLSID@ {7C46C300-99F0-11d4-8E22-009027A23A3F}
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\//PixMaker
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\CLSID
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\CLSID@ {68FB2ECB-4D53-4c9c-81E4-D0F26513A612}
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\Pro
Reg HKLM\SOFTWARE\Classes\PixAround.Codecs2.11\Value
Reg HKLM\SOFTWARE\Classes\PixAround.Image2@ MyImage2 Class
Reg HKLM\SOFTWARE\Classes\PixAround.Image2\CurVer
Reg HKLM\SOFTWARE\Classes\PixAround.Image2\CurVer@ PixAround.Image2.11
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11@ MyImage2 Class
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11\//CLSID
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11\//CLSID@ {D5D52450-9917-11D4-8E22-009027A23A3F}
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11\//PixMaker
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11\CLSID
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11\CLSID@ {13C320CE-D30A-4f6e-8A46-F5FFACD91A83}
Reg HKLM\SOFTWARE\Classes\PixAround.Image2.11\Pro
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline@ CoFilterPipeline Class
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline\CLSID
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline\CLSID@ {d54378cd-91d8-4e10-a00b-819f9a9efcb1}
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline\CurVer
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline\CurVer@ PrintSys.CoFilterPipeline.1
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline.1@ CoFilterPipeline Class
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline.1\CLSID
Reg HKLM\SOFTWARE\Classes\PrintSys.CoFilterPipeline.1\CLSID@ {d54378cd-91d8-4e10-a00b-819f9a9efcb1}
Reg HKLM\SOFTWARE\Classes\Program ID@ MS PinYin 3.0 Dictionary Applet
Reg HKLM\SOFTWARE\Classes\Program ID\CLSID
Reg HKLM\SOFTWARE\Classes\Program ID\CLSID@ {6D0FD33B-0F59-4861-858C-17FCC56C7E50}
Reg HKLM\SOFTWARE\Classes\RealJukebox.ACP.1@ AAC for SD
Reg HKLM\SOFTWARE\Classes\RealJukebox.ACP.1\shell
Reg HKLM\SOFTWARE\Classes\RealJukebox.ACP.1\shell\open
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1@ CD Audio
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shell
Reg HKLM\SOFTWARE\Classes\RealJukebox.CDA.1\shell\open
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1@ Windows Media™ Audio Track
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shell
Reg HKLM\SOFTWARE\Classes\RealJukebox.wma.1\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AAC.6@ AAC Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.AAC.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.AAC.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6@ AIFF Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.AIFF.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6@ AU Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.AU.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6@ AVI Video
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.AVI.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.DVDBurn.6@ RealPlayer AutoPlay for Blank DVD
Reg HKLM\SOFTWARE\Classes\RealPlayer.DVDBurn.6@URL Protocol
Reg HKLM\SOFTWARE\Classes\RealPlayer.DVDBurn.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.DVDBurn.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.EVRC.10@ Qualcomm Enhanced Variable Rate
Reg HKLM\SOFTWARE\Classes\RealPlayer.EVRC.10\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.EVRC.10\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.M4A.6@ AAC Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.M4A.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.M4A.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP1.6@ MP1 Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP1.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP1.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6@ MP2 Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP2.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6@ MP3 Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6@ MP3 Audio PlayList
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.MP3PL.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6@ MPA Media
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPA.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPGA.6@ MPEG Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPGA.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.MPGA.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.PLSPL.6@ Audio PlayList
Reg HKLM\SOFTWARE\Classes\RealPlayer.PLSPL.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.PLSPL.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.QCP.10@ Qualcomm PureVoice and Enhanced Variable Rate
Reg HKLM\SOFTWARE\Classes\RealPlayer.QCP.10\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.QCP.10\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6@ WAV Audio
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.WAV.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.wax.6@ Windows Media™ Audio Shortcut
Reg HKLM\SOFTWARE\Classes\RealPlayer.wax.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.wax.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.wm.6@ Windows Media™ Audio/Video File
Reg HKLM\SOFTWARE\Classes\RealPlayer.wm.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.wm.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmf.6@ Windows Media™ Audio File
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmf.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmf.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmv.6@ Windows Media™ Video File
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmv.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmv.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmx.6@ Windows Media™ Audio/Video Shortcut
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmx.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.wmx.6\shell\open
Reg HKLM\SOFTWARE\Classes\RealPlayer.wvx.6@ Windows Media™ Video Shortcut
Reg HKLM\SOFTWARE\Classes\RealPlayer.wvx.6\shell
Reg HKLM\SOFTWARE\Classes\RealPlayer.wvx.6\shell\open
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl@ Microsoft Rich Textbox Control 6.0 (SP6)
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl\CLSID
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl\CLSID@ {3B7C8860-D78F-101B-B9B5-04021C009402}
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl\CurVer
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl\CurVer@ RICHTEXT.RichtextCtrl.1
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl.1@ Microsoft Rich Textbox Control 6.0 (SP6)
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl.1\CLSID
Reg HKLM\SOFTWARE\Classes\RICHTEXT.RichtextCtrl.1\CLSID@ {3B7C8860-D78F-101B-B9B5-04021C009402}
Reg HKLM\SOFTWARE\Classes\Sandra.Script@ SiSoftware Sandra Professional Home Script
Reg HKLM\SOFTWARE\Classes\Sandra.Script@Content Type text/plain
Reg HKLM\SOFTWARE\Classes\Sandra.Script@PerceivedType text
Reg HKLM\SOFTWARE\Classes\Sandra.Script\DefaultIcon
Reg HKLM\SOFTWARE\Classes\Sandra.Script\DefaultIcon@ E:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2009.SP3c\sandra.exe,1
Reg HKLM\SOFTWARE\Classes\Sandra.Script\shell
Reg HKLM\SOFTWARE\Classes\Sandra.Script\shell\open
Reg HKLM\SOFTWARE\Classes\Sandra.Script\shell\open\command
Reg HKLM\SOFTWARE\Classes\Sandra.Script\shell\open\command@ "E:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2009.SP3c\sandra.exe" /r "%1"
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar@ IE Toolbar
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar\CLSID
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar\CLSID@ {0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar\CurVer
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar\CurVer@ SBCONVERT.IEToolbar.1
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar.1@ IE Toolbar
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar.1\CLSID
Reg HKLM\SOFTWARE\Classes\SBCONVERT.IEToolbar.1\CLSID@ {0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT@ SpeedBit Video Downloader
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT\CLSID
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT\CLSID@ {0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT\CurVer
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT\CurVer@ SBCONVERT.SBCONVERT.3
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT.3@ SpeedBit Video Downloader
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT.3\CLSID
Reg HKLM\SOFTWARE\Classes\SBCONVERT.SBCONVERT.3\CLSID@ {0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Reg HKLM\SOFTWARE\Classes\Scripting.Dictionary@ Scripting.Dictionary
Reg HKLM\SOFTWARE\Classes\Scripting.Dictionary\CLSID
Reg HKLM\SOFTWARE\Classes\Scripting.Dictionary\CLSID@ {EE09B103-97E0-11CF-978F-00A02463E06F}
Reg HKLM\SOFTWARE\Classes\Scripting.Encoder@ Script Encoder Object
Reg HKLM\SOFTWARE\Classes\Scripting.Encoder\CLSID
Reg HKLM\SOFTWARE\Classes\Scripting.Encoder\CLSID@ {32DA2B15-CFED-11D1-B747-00C04FC2B085}
Reg HKLM\SOFTWARE\Classes\Scripting.FileSystemObject@ FileSystem Object
Reg HKLM\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID
Reg HKLM\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID@ {0D43FE01-F093-11CF-8940-00A0C9054228}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer@ ShockwaveFlash.ShockwaveFlash.10
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.3\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.7\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8@ Shockwave Flash Object
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\CLSID
Reg HKLM\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\CLSID@ {D27CDB6E-AE6D-11cf-96B8-444553540000}
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl@ SightSpeedWebImpl Class
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl\CLSID
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl\CLSID@ {57B2CA01-6C40-44BB-9FCC-BFA7FADAA6E3}
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl\CurVer
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl\CurVer@ sightspeedweb.SightSpeedWebImpl.1
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl.1@ SightSpeedWebImpl Class
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl.1\CLSID
Reg HKLM\SOFTWARE\Classes\sightspeedweb.SightSpeedWebImpl.1\CLSID@ {57B2CA01-6C40-44BB-9FCC-BFA7FADAA6E3}
Reg HKLM\SOFTWARE\Classes\SmartMenuXPLibrary.LibSmartMenuXP@ SmartMenuXPLibrary.LibSmartMenuXP
Reg HKLM\SOFTWARE\Classes\SmartMenuXPLibrary.LibSmartMenuXP\Clsid
Reg HKLM\SOFTWARE\Classes\SmartMenuXPLibrary.LibSmartMenuXP\Clsid@ {69D7483A-D984-4441-9A8F-42BF5C2970B0}
Reg HKLM\SOFTWARE\Classes\SmartNetButtonProject.SmartNetButton@ SmartNetButtonProject.SmartNetButton
Reg HKLM\SOFTWARE\Classes\SmartNetButtonProject.SmartNetButton\Clsid
Reg HKLM\SOFTWARE\Classes\SmartNetButtonProject.SmartNetButton\Clsid@ {1DAB2964-890E-424B-99C7-1D0FFDD0D574}
Reg HKLM\SOFTWARE\Classes\SmartSubClassLib.SmartSubClass@ SmartSubClassLib.SmartSubClass
Reg HKLM\SOFTWARE\Classes\SmartSubClassLib.SmartSubClass\Clsid
Reg HKLM\SOFTWARE\Classes\SmartSubClassLib.SmartSubClass\Clsid@ {7EAD12E0-1130-48ED-9EBE-48917F876C58}
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile@ Disabled startup file
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\blindman.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.DisabledFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\blindman.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile@ Spyware exclude file
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBEFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile@ Spyware include file
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBIFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile@ Spyware supplemental file
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.SBSFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile@ Internal informations
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.TInfoFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile@ Usage tracks include file
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTIFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile@ Usage tracks supplemental file
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile\DefaultIcon
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile\DefaultIcon@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe",0
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile\shell
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile\shell\open
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile\shell\open\command
Reg HKLM\SOFTWARE\Classes\SpybotSD.UTSFile\shell\open\command@ "E:\program files\Spybot - Search & Destroy\SpybotSD.exe" "%1"
Reg HKLM\SOFTWARE\Classes\SSM@ Streaming Media Metafile
Reg HKLM\SOFTWARE\Classes\SSM\shell
Reg HKLM\SOFTWARE\Classes\SSM\shell\open
Reg HKLM\SOFTWARE\Classes\SSubTimer6.CTimer@ SSubTimer6.CTimer
Reg HKLM\SOFTWARE\Classes\SSubTimer6.CTimer\Clsid
Reg HKLM\SOFTWARE\Classes\SSubTimer6.CTimer\Clsid@ {71A27034-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\SSubTimer6.GSubclass@ SSubTimer6.GSubclass
Reg HKLM\SOFTWARE\Classes\SSubTimer6.GSubclass\Clsid
Reg HKLM\SOFTWARE\Classes\SSubTimer6.GSubclass\Clsid@ {71A27032-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\SSubTimer6.ISubclass@ SSubTimer6.ISubclass
Reg HKLM\SOFTWARE\Classes\SSubTimer6.ISubclass\Clsid
Reg HKLM\SOFTWARE\Classes\SSubTimer6.ISubclass\Clsid@ {71A2702F-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Toolbar.CT1060933\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar.CT1060933\CLSID@ {d50f932f-a950-44ef-9bac-ae203967504f}
Reg HKLM\SOFTWARE\Classes\Toolbar.CT1714219\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar.CT1714219\CLSID@ {041d868b-eac9-4d0f-9125-85be9b61052b}
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier@ ContextMenuNotifier Class
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier\CLSID@ {9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier\CurVer
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier\CurVer@ Toolbar3.ContextMenuNotifier.1
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1@ ContextMenuNotifier Class
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1\CLSID@ {9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl@ CustomInternetSecurityImpl Class
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl\CLSID@ {D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl\CurVer
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl\CurVer@ Toolbar3.CustomInternetSecurityImpl.1
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1@ CustomInternetSecurityImpl Class
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1\CLSID@ {D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT@ SBCONVERT Class
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT\CLSID@ {3017FB3E-9A77-4396-88C5-0EC9548FB42F}
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT\CurVer
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT\CurVer@ Toolbar3.SBCONVERT.1
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT.1@ SBCONVERT Class
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT.1\CLSID
Reg HKLM\SOFTWARE\Classes\Toolbar3.SBCONVERT.1\CLSID@ {3017FB3E-9A77-4396-88C5-0EC9548FB42F}
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine@ AtcmTTSEngine Class
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine\CLSID
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine\CLSID@ {22FEDDD4-F1F0-4797-8CF9-0DD09F9E626C}
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine\CurVer
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine\CurVer@ TtsEng.AtcmTTSEngine.1
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine.1@ AtcmTTSEngine Class
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine.1\CLSID
Reg HKLM\SOFTWARE\Classes\TtsEng.AtcmTTSEngine.1\CLSID@ {22FEDDD4-F1F0-4797-8CF9-0DD09F9E626C}
Reg HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook@ ToolbarURLSearchHook Class
Reg HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook\CLSID
Reg HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook\CLSID@ {CA3EB689-8F09-4026-AA10-B9534C691CE0}
Reg HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1@ ToolbarURLSearchHook Class
Reg HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1\CLSID
Reg HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1\CLSID@ {CA3EB689-8F09-4026-AA10-B9534C691CE0}
Reg HKLM\SOFTWARE\Classes\Valve.SteamP2P\shell
Reg HKLM\SOFTWARE\Classes\Valve.SteamP2P\shell\open
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridCell@ vbAcceleratorSGrid6.cGridCell
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridCell\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridCell\Clsid@ {9BD3A001-42A2-491E-AACA-9512F6CF4CDB}
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridSortObject@ vbAcceleratorSGrid6.cGridSortObject
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridSortObject\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridSortObject\Clsid@ {D2129738-6A78-4BCB-915A-412982CAA23D}
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.IGridCellOwnerDraw@ vbAcceleratorSGrid6.IGridCellOwnerDraw
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.IGridCellOwnerDraw\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.IGridCellOwnerDraw\Clsid@ {DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.vbalGrid@ vbAccelerator Grid Control
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.vbalGrid\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.vbalGrid\Clsid@ {C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}
Reg HKLM\SOFTWARE\Classes\VBSFile.HostEncode\CLSID
Reg HKLM\SOFTWARE\Classes\VBSFile.HostEncode\CLSID@ {85131631-480C-11D2-B1F9-00C04F86C324}
Reg HKLM\SOFTWARE\Classes\VBSmartXPMenu.SmartMenuList@ VBSmartXPMenu.SmartMenuList
Reg HKLM\SOFTWARE\Classes\VBSmartXPMenu.SmartMenuList\Clsid
Reg HKLM\SOFTWARE\Classes\VBSmartXPMenu.SmartMenuList\Clsid@ {79D8BAC6-B95C-45D8-BA59-2C000E663532}
Reg HKLM\SOFTWARE\Classes\VBSmartXPMenu.SmartMenuXP@ VBSmartXPMenu.SmartMenuXP
Reg HKLM\SOFTWARE\Classes\VBSmartXPMenu.SmartMenuXP\Clsid
Reg HKLM\SOFTWARE\Classes\VBSmartXPMenu.SmartMenuXP\Clsid@ {BEBE0B18-F5AA-4F91-8E43-0309F73ED35A}
Reg HKLM\SOFTWARE\Classes\VerID@ MS PinYin 3.0 Dictionary Applet
Reg HKLM\SOFTWARE\Classes\VerID\CLSID
Reg HKLM\SOFTWARE\Classes\VerID\CLSID@ {6D0FD33B-0F59-4861-858C-17FCC56C7E50}
Reg HKLM\SOFTWARE\Classes\VerID\CurVer
Reg HKLM\SOFTWARE\Classes\VerID\CurVer@ Program ID
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin@ VideoLAN VLC ActiveX Plugin v2
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin\CLSID
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin\CLSID@ {9BE31822-FDAD-461B-AD51-BE1D1C159921}
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin\CurVer
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin\CurVer@ VideoLAN.VLCPlugin.2
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin.1@ VideoLAN VLC ActiveX Plugin v1
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin.1\CLSID
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin.1\CLSID@ {E23FE9C6-778E-49D4-B537-38FCDE4887D8}
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin.2@ VideoLAN VLC ActiveX Plugin v2
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin.2\CLSID
Reg HKLM\SOFTWARE\Classes\VideoLAN.VLCPlugin.2\CLSID@ {9BE31822-FDAD-461B-AD51-BE1D1C159921}
Reg HKLM\SOFTWARE\Classes\VLC.a52@ VLC media file (.a52)
Reg HKLM\SOFTWARE\Classes\VLC.a52\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.a52\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.a52\shell
Reg HKLM\SOFTWARE\Classes\VLC.a52\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.a52\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.a52\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.a52\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.aac@ VLC media file (.aac)
Reg HKLM\SOFTWARE\Classes\VLC.aac\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.aac\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.aac\shell
Reg HKLM\SOFTWARE\Classes\VLC.aac\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.aac\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.aac\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.aac\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.ac3@ VLC media file (.ac3)
Reg HKLM\SOFTWARE\Classes\VLC.ac3\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.ac3\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.ac3\shell
Reg HKLM\SOFTWARE\Classes\VLC.ac3\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.ac3\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.ac3\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.ac3\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.asf@ VLC media file (.asf)
Reg HKLM\SOFTWARE\Classes\VLC.asf\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.asf\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.asf\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.asx@ VLC media file (.asx)
Reg HKLM\SOFTWARE\Classes\VLC.asx\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.asx\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.asx\shell
Reg HKLM\SOFTWARE\Classes\VLC.asx\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.asx\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.asx\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.asx\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.avi@ VLC media file (.avi)
Reg HKLM\SOFTWARE\Classes\VLC.avi\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.avi\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.avi\shell
Reg HKLM\SOFTWARE\Classes\VLC.avi\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.avi\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.avi\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.avi\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.bin@ VLC media file (.bin)
Reg HKLM\SOFTWARE\Classes\VLC.bin\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.bin\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.bin\shell
Reg HKLM\SOFTWARE\Classes\VLC.bin\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.bin\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.bin\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.bin\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio@ VLC CD Audio
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\shell
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\Play\command@ C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file cdda:%1
Reg HKLM\SOFTWARE\Classes\VLC.cue@ VLC media file (.cue)
Reg HKLM\SOFTWARE\Classes\VLC.cue\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.cue\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.cue\shell
Reg HKLM\SOFTWARE\Classes\VLC.cue\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.cue\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.cue\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.cue\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.divx@ VLC media file (.divx)
Reg HKLM\SOFTWARE\Classes\VLC.divx\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.divx\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.divx\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.dts@ VLC media file (.dts)
Reg HKLM\SOFTWARE\Classes\VLC.dts\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.dts\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.dts\shell
Reg HKLM\SOFTWARE\Classes\VLC.dts\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.dts\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.dts\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.dts\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.dv@ VLC media file (.dv)
Reg HKLM\SOFTWARE\Classes\VLC.dv\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.dv\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.dv\shell
Reg HKLM\SOFTWARE\Classes\VLC.dv\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.dv\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.dv\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.dv\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie@ VLC DVD Movie
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\Play\command@ C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file dvd:%1
Reg HKLM\SOFTWARE\Classes\VLC.flac@ VLC media file (.flac)
Reg HKLM\SOFTWARE\Classes\VLC.flac\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.flac\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.flac\shell
Reg HKLM\SOFTWARE\Classes\VLC.flac\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.flac\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.flac\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.flac\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.m1v@ VLC media file (.m1v)
Reg HKLM\SOFTWARE\Classes\VLC.m1v\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.m1v\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.m1v\shell
Reg HKLM\SOFTWARE\Classes\VLC.m1v\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.m1v\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.m1v\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.m1v\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.m2v@ VLC media file (.m2v)
Reg HKLM\SOFTWARE\Classes\VLC.m2v\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.m2v\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.m2v\shell
Reg HKLM\SOFTWARE\Classes\VLC.m2v\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.m2v\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.m2v\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.m2v\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.m3u@ VLC media file (.m3u)
Reg HKLM\SOFTWARE\Classes\VLC.m3u\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.m3u\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.m3u\shell
Reg HKLM\SOFTWARE\Classes\VLC.m3u\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.m3u\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.m3u\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.m3u\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mka@ VLC media file (.mka)
Reg HKLM\SOFTWARE\Classes\VLC.mka\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mka\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mka\shell
Reg HKLM\SOFTWARE\Classes\VLC.mka\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mka\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mka\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mka\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mkv@ VLC media file (.mkv)
Reg HKLM\SOFTWARE\Classes\VLC.mkv\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mkv\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mkv\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mov@ VLC media file (.mov)
Reg HKLM\SOFTWARE\Classes\VLC.mov\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mov\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mov\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mov\shellex
Reg HKLM\SOFTWARE\Classes\VLC.mp1@ VLC media file (.mp1)
Reg HKLM\SOFTWARE\Classes\VLC.mp1\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mp1\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mp1\shell
Reg HKLM\SOFTWARE\Classes\VLC.mp1\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mp1\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mp1\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mp1\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mp2@ VLC media file (.mp2)
Reg HKLM\SOFTWARE\Classes\VLC.mp2\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mp2\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mp2\shell
Reg HKLM\SOFTWARE\Classes\VLC.mp2\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mp2\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mp2\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mp2\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mp3@ VLC media file (.mp3)
Reg HKLM\SOFTWARE\Classes\VLC.mp3\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mp3\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mp3\shell
Reg HKLM\SOFTWARE\Classes\VLC.mp3\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mp3\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mp3\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mp3\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mp4@ VLC media file (.mp4)
Reg HKLM\SOFTWARE\Classes\VLC.mp4\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mp4\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mp4\shellex
Reg HKLM\SOFTWARE\Classes\VLC.mpeg@ VLC media file (.mpeg)
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mpeg\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1@ VLC media file (.mpeg1)
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\shell
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mpeg1\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2@ VLC media file (.mpeg2)
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\shell
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mpeg2\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4@ VLC media file (.mpeg4)
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\shell
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mpeg4\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.mpg@ VLC media file (.mpg)
Reg HKLM\SOFTWARE\Classes\VLC.mpg\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.mpg\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.mpg\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.ogg@ VLC media file (.ogg)
Reg HKLM\SOFTWARE\Classes\VLC.ogg\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.ogg\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.ogg\shell
Reg HKLM\SOFTWARE\Classes\VLC.ogg\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.ogg\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.ogg\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.ogg\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.ogm@ VLC media file (.ogm)
Reg HKLM\SOFTWARE\Classes\VLC.ogm\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.ogm\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.ogm\shell
Reg HKLM\SOFTWARE\Classes\VLC.ogm\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.ogm\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.ogm\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.ogm\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.pls@ VLC media file (.pls)
Reg HKLM\SOFTWARE\Classes\VLC.pls\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.pls\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.pls\shell
Reg HKLM\SOFTWARE\Classes\VLC.pls\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.pls\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.pls\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.pls\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.ps@ VLC media file (.ps)
Reg HKLM\SOFTWARE\Classes\VLC.ps\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.ps\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.ps\shell
Reg HKLM\SOFTWARE\Classes\VLC.ps\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.ps\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.ps\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.ps\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.spx@ VLC media file (.spx)
Reg HKLM\SOFTWARE\Classes\VLC.spx\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.spx\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.spx\shell
Reg HKLM\SOFTWARE\Classes\VLC.spx\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.spx\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.spx\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.spx\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.ts@ VLC media file (.ts)
Reg HKLM\SOFTWARE\Classes\VLC.ts\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.ts\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.ts\shell
Reg HKLM\SOFTWARE\Classes\VLC.ts\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.ts\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.ts\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.ts\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.vlc@ VLC media file (.vlc)
Reg HKLM\SOFTWARE\Classes\VLC.vlc\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.vlc\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.vlc\shell
Reg HKLM\SOFTWARE\Classes\VLC.vlc\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.vlc\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.vlc\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.vlc\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.vob@ VLC media file (.vob)
Reg HKLM\SOFTWARE\Classes\VLC.vob\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.vob\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell\Convert with Prism Video Converter
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell\Convert with Prism Video Converter\command
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell\Convert with Prism Video Converter\command@ "C:\Program Files\NCH Software\Prism\prism.exe" "%L"
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.vob\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.wav@ VLC media file (.wav)
Reg HKLM\SOFTWARE\Classes\VLC.wav\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.wav\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.wav\shell
Reg HKLM\SOFTWARE\Classes\VLC.wav\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.wav\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.wav\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.wav\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.wma@ VLC media file (.wma)
Reg HKLM\SOFTWARE\Classes\VLC.wma\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.wma\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.wma\shell
Reg HKLM\SOFTWARE\Classes\VLC.wma\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.wma\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.wma\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.wma\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VLC.wmv@ VLC media file (.wmv)
Reg HKLM\SOFTWARE\Classes\VLC.wmv\DefaultIcon
Reg HKLM\SOFTWARE\Classes\VLC.wmv\DefaultIcon@ "C:\Program Files\VideoLAN\VLC\vlc.exe",0
Reg HKLM\SOFTWARE\Classes\VLC.wmv\shell
Reg HKLM\SOFTWARE\Classes\VLC.wmv\shell@ Play
Reg HKLM\SOFTWARE\Classes\VLC.wmv\shell\Play
Reg HKLM\SOFTWARE\Classes\VLC.wmv\shell\Play\command
Reg HKLM\SOFTWARE\Classes\VLC.wmv\shell\Play\command@ "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file "%1"
Reg HKLM\SOFTWARE\Classes\VOB_auto_file@
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell@ play
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\open
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\open@ &Open
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\open\command
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\open\command@ "C:\Program Files\iTunes\iTunes.exe" /open "%L"
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\play
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\play@ &Play
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\play\command
Reg HKLM\SOFTWARE\Classes\VOB_auto_file\shell\play\command@ "C:\Program Files\iTunes\iTunes.exe" /play "%L"
Reg HKLM\SOFTWARE\Classes\vpjfile@ VideoPad Project
Reg HKLM\SOFTWARE\Classes\wipe.Document@ wipe Document
Reg HKLM\SOFTWARE\Classes\wipe.Document\shell
Reg HKLM\SOFTWARE\Classes\wipe.Document\shell\open
Reg HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar@ Yahoo! Toolbar
Reg HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1@ Yahoo! Toolbar

—- EOF - GMER 1.0.15 —-

SweetTech

Post #77March 27, 2010, 7:26 PM UTC

Is your computer running any differently?

Shenlord

Post #78March 27, 2010, 9:30 PM UTC

Hi. No, comp is not running any differently yet. (start run , start search, setup.exe files are still a no-go)

SweetTech

Post #79March 28, 2010, 12:02 AM UTC

FixPolicies

Download to your Desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the filewithin: Fix_Policies.cmd.
A black box should briefly appear and then close. This should fix the issues you are experiencing with not being able to access the search feature, the run dialog feature, as well as any other features that may have been disabled by malware.

Please provide me with a new OTL log and an update on how your computer is currently running.

Shenlord

Post #80March 28, 2010, 1:46 AM UTC

Hi.
OTL log (with LOP and Purity check)
after sending this from Safe mode , I will go check how comp is running and post it,
ty
OTL logfile created on: 3/27/2010 8:40:10 PM - Run 3
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 14.65 Gb Free Space | 19.66% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 74.52 Gb Total Space | 48.93 Gb Free Space | 65.66% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JPRIG
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msacm32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\AppPatch\acgenral.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SoundMovieServer) – File not found
SRV - (JavaQuickStarterService) – File not found
SRV - (avast! Web Scanner) – File not found
SRV - (avast! Mail Scanner) – File not found
SRV - (avast! Antivirus) – File not found
SRV - (aswUpdSv) – File not found
SRV - (VideoAcceleratorService) – C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorService.exe (Speedbit Ltd.)
SRV - (BroadCamService) – C:\Program Files\NCH Software\BroadCam\broadcam.exe (NCH Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
SRV - (OAcat) – C:\Program Files\Tall Emu\Online Armor\OAcat.exe (Tall Emu)
SRV - (TekSIP) – E:\Program Files\TekSIP\TekSIP.exe (Yasin KAPLAN)
SRV - (DvmMDES) – C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
SRV - (AODService) – C:\Program Files\AMD\OverDrive\AODAssist.exe ()
SRV - (AMD_RAIDXpert) – C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Tall Emu)
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Tall Emu Pty Ltd)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys (Tall Emu)
DRV - (L1e) – C:\WINDOWS\system32\drivers\l1e51x86.sys (Atheros Communications, Inc.)
DRV - (NuidFltr) – C:\WINDOWS\system32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (cpuz132) – C:\WINDOWS\system32\drivers\cpuz132_x32.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ZSMC30x) – C:\WINDOWS\system32\drivers\ZS211.sys (ZSMC.Corporation)
DRV - (vvftav211) – C:\WINDOWS\system32\drivers\vvftav211.sys (Vimicro Corporation)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (dvd43llh) – C:\WINDOWS\system32\drivers\dvd43llh.sys (RIF)
DRV - (MovRVDrv32) – C:\WINDOWS\system32\drivers\MovRVDrv32.sys (Windows ® 2000 DDK provider)
DRV - (SndTDriverV32) – C:\WINDOWS\system32\drivers\SndTDriverV32.sys (Windows ® 2000/XP)
DRV - (SASENUM) – E:\program files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – E:\program files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – E:\program files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (MovPDrv32) – C:\WINDOWS\system32\drivers\MovPDrv32.sys (Windows ® 2000/XP)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (nxsIO32) – C:\WINDOWS\system32\drivers\nxsIO32.sys ()
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (SaiNtBus) – C:\WINDOWS\system32\drivers\SaiBus.sys (Saitek)
DRV - (SaiMini) – C:\WINDOWS\system32\drivers\SaiMini.sys (Saitek)
DRV - (SaiU0004) – C:\WINDOWS\system32\drivers\SaiU0004.sys (Saitek)
DRV - (SaiH0004) – C:\WINDOWS\system32\drivers\SaiH0004.sys (Saitek)
DRV - (SaiL0004) – C:\WINDOWS\system32\drivers\SaiL0004.sys (Saitek)
DRV - (Alpham) – C:\WINDOWS\system32\drivers\Alpham.sys (Ideazon Corporation)
DRV - (dfmirage) – C:\WINDOWS\system32\drivers\dfmirage.sys (DemoForge, LLC)
DRV - (NCPro) – C:\WINDOWS\system32\drivers\MTictwl.sys ()
DRV - (MagicTune) – C:\WINDOWS\system32\drivers\MTictwl.sys ()
DRV - (ATITool) – C:\WINDOWS\system32\drivers\ATITool.sys ()
DRV - (nvnforce) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvapu.sys (NVIDIA Corporation)
DRV - (nvax) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvax.sys (NVIDIA Corporation)
DRV - (P0630VID) – C:\WINDOWS\system32\drivers\P0630Vid.sys (Creative Technology Ltd.)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (nvatabus) – C:\WINDOWS\System32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ULCDRHlp) – C:\WINDOWS\system32\drivers\ULCDRHlp.sys (Ulead Systems, Inc.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) – C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (Sntnlusb) – C:\WINDOWS\system32\drivers\SNTNLUSB.SYS (Rainbow Technologies Inc.)
DRV - (DS1410D) – C:\WINDOWS\system32\drivers\ds1410d.sys ()
DRV - (sbpci) SB AudioPCI Audio Driver (WDM) – C:\WINDOWS\system32\drivers\sbpci.sys (Creative Technology Ltd.)
DRV - (PfModNT) – C:\WINDOWS\system32\PfModNT.sys (Creative Technology Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {0329E7D6-6F54-462D-93F6-F5C3118BADF2}:2.1.5
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..keyword.URL: "http://www.ask.com/web?o=13796&l=dis&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF - HKLM\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files\SpeedBit Video Downloader\SPFireFox [2010/02/24 09:39:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Flock 2.5.5\extensions\\Components: C:\Program Files\Flock\components [2010/02/25 14:25:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Flock 2.5.5\extensions\\Plugins: C:\Program Files\Flock\plugins [2010/02/25 14:25:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/26 17:43:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/26 17:43:45 | 000,000,000 | —D | M]

[2008/09/17 15:34:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/03/25 18:54:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\bo4nnl5q.default\extensions
[2010/03/07 17:27:56 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\bo4nnl5q.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/07 17:28:03 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\bo4nnl5q.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/26 18:16:55 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/03/14 17:10:48 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/03/07 17:28:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/01/23 01:20:30 | 000,491,520 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2008/07/16 23:36:16 | 000,204,800 | —- | M] (Dimdim Inc.) – C:\Program Files\Mozilla Firefox\plugins\npDimdimControl.dll
[2009/10/03 13:15:57 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2008/03/12 15:04:10 | 000,086,016 | —- | M] (SpiralFrog Inc.) – C:\Program Files\Mozilla Firefox\plugins\NPSFDMGR.dll

O1 HOSTS File: ([2010/03/21 16:22:34 | 000,348,846 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 11960 more lines…
O2 - BHO: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll (Conduit Ltd.)
O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - E:\program files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\5.0.342.0\npchrome_frame.dll (@COMPANY_FULLNAME@)
O2 - BHO: (GrabberObj Class) - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\SpeedBit Video Downloader\Toolbar\Grabber.dll (Speedbit Ltd.)
O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - E:\program files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Ai Nap] C:\Program Files\ASUS\AI Suite\Q-Button\QButton.exe ()
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe ()
O4 - HKLM..\Run: [dvd43] C:\Program Files\dvd43\DVD43_Tray.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe (ZSMCSNAP)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - E:\program files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - E:\program files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/3/9…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} http://protect.microsoft.com/security/prot…b?1116220378452 (MSSecurityAdvisor Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1221690851234 (MUWebControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\5.0.342.0\npchrome_frame.dll (@COMPANY_FULLNAME@)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - E:\program files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/06 13:47:37 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/26 18:18:45 | 016,258,848 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Administrator\Desktop\jre-6u18-windows-i586.exe
[2010/03/26 17:45:12 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\Administrator\Desktop\erunt-setup.exe
[2010/03/26 17:42:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\logs recovery
[2010/03/25 20:51:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Sun
[2010/03/25 18:21:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\tdsskiller
[2010/03/25 18:20:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\GooredFix Backups
[2010/03/25 18:18:18 | 000,070,858 | —- | C] (jpshortstuff) – C:\Documents and Settings\Administrator\Desktop\GooredFix.exe
[2010/03/25 18:14:28 | 000,000,000 | —D | C] – C:\_OTL
[2010/03/25 14:00:23 | 000,555,520 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/03/25 13:14:55 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents\My Pictures
[2010/03/25 13:14:55 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents\My Music
[2010/03/25 13:07:23 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2
[2010/03/25 13:03:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\Dial-a-fix-v0.60.0.24
[2010/03/24 18:59:48 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/03/24 18:37:12 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/03/24 18:29:36 | 000,000,000 | —D | C] – C:\nicnpjnp
[2010/03/23 19:23:11 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/03/23 19:22:03 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/03/23 19:22:03 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/03/23 19:22:03 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/03/23 19:22:03 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/03/23 19:21:26 | 000,000,000 | —D | C] – C:\Qoobox
[2010/03/22 17:07:41 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/03/22 15:34:34 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/03/20 21:54:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
[2010/03/20 19:26:07 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2010/03/20 19:24:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2010/03/18 15:35:13 | 000,000,000 | —D | C] – C:\Program Files\GiPo@Utilities
[2010/03/18 15:35:13 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Gibinsoft Shared
[2010/03/14 17:10:37 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/03/12 18:38:05 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/03/12 14:06:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/03/12 14:06:45 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar
[2010/03/12 14:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/03/12 14:05:46 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar Installer
[2010/03/12 14:05:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/03/12 11:23:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/03/10 11:17:51 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/07 18:10:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2010/03/07 18:09:48 | 000,223,312 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OADriver.sys
[2010/03/07 18:09:48 | 000,029,776 | —- | C] (Tall Emu Pty Ltd) – C:\WINDOWS\System32\drivers\OAnet.sys
[2010/03/07 18:09:48 | 000,024,656 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OAmon.sys
[2010/03/07 18:09:47 | 000,000,000 | —D | C] – C:\Program Files\Tall Emu
[2010/03/07 17:34:29 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/03/07 17:33:50 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/03/07 17:28:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Downloads
[2010/03/07 17:23:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/03/07 17:22:06 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/03/07 17:12:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Macromedia
[2010/03/07 16:57:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2010/03/07 16:57:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Identities
[2010/03/07 16:40:03 | 000,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2010/03/07 16:38:44 | 000,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\My Documents\HijackThis.exe
[2010/03/07 16:33:36 | 009,758,152 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\windows-kb890830-v3.4.exe
[2010/03/07 16:32:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Opera
[2010/03/07 16:32:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/03/07 11:09:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2010/03/02 09:49:48 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\hidserv.dll
[2010/02/25 12:12:09 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2010/02/25 12:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2009/10/22 13:37:00 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/10/22 13:32:20 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/01/16 12:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Freecorder
[2008/10/08 10:55:50 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/09/23 12:43:00 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2008/07/29 23:13:03 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/07/23 15:19:17 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2008/07/23 15:19:02 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2008/07/23 15:18:27 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2008/07/23 15:18:27 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Mozilla
[1998/12/08 13:53:54 | 000,186,368 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRAREG.DLL
[1998/12/08 13:53:54 | 000,099,840 | —- | C] (Symantec Corp.) – C:\Program Files\Common Files\IRAABOUT.DLL
[1998/12/08 13:53:54 | 000,070,144 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRAMDMTR.DLL
[1998/12/08 13:53:54 | 000,048,640 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRALPTTR.DLL
[1998/12/08 13:53:54 | 000,031,744 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRAWEBTR.DLL
[1998/12/08 13:53:54 | 000,017,920 | —- | C] (Symantec Corp.) – C:\Program Files\Common Files\IRASRIAL.DLL

========== Files - Modified Within 30 Days ==========

[2010/03/27 20:37:55 | 000,185,065 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\FixPolicies.exe
[2010/03/27 20:35:55 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/27 20:35:35 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/27 16:52:42 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/27 16:27:08 | 000,000,888 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/27 16:25:49 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/03/27 16:25:48 | 004,718,592 | —- | M] () – C:\Documents and Settings\Administrator\ntuser.dat
[2010/03/27 16:25:47 | 006,880,656 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/03/27 13:37:19 | 000,533,362 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/27 13:37:19 | 000,448,550 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/03/27 13:37:19 | 000,074,948 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/03/27 11:53:40 | 000,000,637 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\permissions.bat
[2010/03/26 20:25:03 | 000,293,376 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\wxy4lnyh.exe
[2010/03/26 19:18:00 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-2000478354-725345543-1003UA.job
[2010/03/26 18:18:46 | 016,258,848 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Administrator\Desktop\jre-6u18-windows-i586.exe
[2010/03/26 17:45:55 | 000,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/03/26 17:45:55 | 000,000,592 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/03/26 17:45:13 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\Administrator\Desktop\erunt-setup.exe
[2010/03/26 17:44:07 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/03/26 16:53:00 | 000,000,892 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/26 14:25:39 | 000,001,347 | —- | M] () – C:\WINDOWS\win.ini
[2010/03/25 18:18:34 | 000,154,469 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\tdsskiller.zip
[2010/03/25 18:18:18 | 000,070,858 | —- | M] (jpshortstuff) – C:\Documents and Settings\Administrator\Desktop\GooredFix.exe
[2010/03/25 14:00:23 | 000,555,520 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/03/25 13:07:54 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2010/03/25 13:07:54 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2010/03/25 13:03:04 | 000,335,992 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Dial-a-fix-v0.60.0.24.zip
[2010/03/25 12:52:08 | 000,000,012 | -H– | M] () – C:\WINDOWS\System32\%sdvmexp.idx
[2010/03/25 11:18:00 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-2000478354-725345543-1003Core.job
[2010/03/24 18:35:27 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/03/24 18:28:39 | 003,899,286 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\nicnpjnp.exe
[2010/03/24 18:00:00 | 000,000,454 | —- | M] () – C:\WINDOWS\tasks\next.job
[2010/03/24 14:40:32 | 000,001,519 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Notepad.lnk
[2010/03/23 19:23:15 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/03/23 13:48:16 | 2145,386,496 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2010/03/23 01:48:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/22 20:10:41 | 000,001,958 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Age Of Kings.lnk
[2010/03/22 20:10:41 | 000,001,949 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Conquerors.lnk
[2010/03/22 15:17:36 | 000,001,543 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Command Prompt.lnk
[2010/03/21 16:22:34 | 000,348,846 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/20 22:25:34 | 000,059,360 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/03/20 20:33:34 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/03/19 10:52:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/03/12 18:33:39 | 000,001,854 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2010/03/12 18:02:38 | 000,261,632 | —- | M] () – C:\WINDOWS\PEV.exe
[2010/03/12 11:24:23 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/03/12 11:24:22 | 000,002,688 | —- | M] () – C:\WINDOWS\System32\config.nt
[2010/03/10 13:43:43 | 000,001,675 | —- | M] () – C:\Documents and Settings\All Users\Desktop\FileZilla Client.lnk
[2010/03/09 06:24:23 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\avastSS.scr
[2010/03/09 06:24:05 | 000,153,184 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/03/09 06:12:54 | 000,046,672 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/03/09 06:12:33 | 000,162,640 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/03/09 06:09:08 | 000,023,376 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/03/09 06:08:41 | 000,100,432 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/03/09 06:08:38 | 000,094,800 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/03/09 06:08:30 | 000,019,024 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/03/09 06:08:15 | 000,028,880 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/03/07 18:10:10 | 000,095,020 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.idx
[2010/03/07 18:01:08 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/03/07 17:38:28 | 004,718,592 | -H– | M] () – C:\Documents and Settings\Administrator\ntuser.bak
[2010/03/07 17:31:42 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/07 17:22:59 | 000,000,682 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to CCleaner.lnk
[2010/03/07 17:22:37 | 000,000,406 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_162230.reg
[2010/03/07 17:21:39 | 000,000,664 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk
[2010/03/07 17:18:27 | 000,126,424 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_161800.reg
[2010/03/07 16:56:58 | 000,001,297 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\WinXP_EXE_Fix.reg
[2010/03/07 16:40:03 | 000,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2010/03/07 16:38:44 | 000,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\My Documents\HijackThis.exe
[2010/03/07 16:33:36 | 009,758,152 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\windows-kb890830-v3.4.exe
[2010/03/07 16:24:52 | 000,000,438 | RHS- | M] () – C:\Documents and Settings\Administrator\ntuser.pol
[2010/03/07 15:40:14 | 000,001,475 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Windows Explorer.lnk
[2010/03/02 09:49:51 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf

========== Files Created - No Company Name ==========

[2010/03/27 20:37:54 | 000,185,065 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\FixPolicies.exe
[2010/03/27 11:53:40 | 000,000,637 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\permissions.bat
[2010/03/26 20:25:02 | 000,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\wxy4lnyh.exe
[2010/03/25 18:18:33 | 000,154,469 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\tdsskiller.zip
[2010/03/25 13:03:01 | 000,335,992 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Dial-a-fix-v0.60.0.24.zip
[2010/03/24 18:28:39 | 003,899,286 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\nicnpjnp.exe
[2010/03/24 17:20:52 | 000,000,012 | -H– | C] () – C:\WINDOWS\System32\%sdvmexp.idx
[2010/03/24 14:40:32 | 000,001,519 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Notepad.lnk
[2010/03/23 19:23:15 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/03/23 19:23:13 | 000,260,272 | —- | C] () – C:\cmldr
[2010/03/23 19:22:03 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/03/23 19:22:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/03/23 19:22:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/03/23 19:22:03 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/03/23 19:22:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/03/22 20:10:41 | 000,001,958 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Age Of Kings.lnk
[2010/03/22 20:10:41 | 000,001,949 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Conquerors.lnk
[2010/03/22 15:17:29 | 000,001,543 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Command Prompt.lnk
[2010/03/12 18:38:46 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/03/12 11:24:23 | 000,001,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/03/07 17:33:50 | 000,000,611 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/03/07 17:33:50 | 000,000,592 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/03/07 17:22:59 | 000,000,682 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to CCleaner.lnk
[2010/03/07 17:22:34 | 000,000,406 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_162230.reg
[2010/03/07 17:21:39 | 000,000,664 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk
[2010/03/07 17:18:16 | 000,126,424 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_161800.reg
[2010/03/07 16:56:58 | 000,001,297 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\WinXP_EXE_Fix.reg
[2010/03/07 16:24:52 | 000,000,438 | RHS- | C] () – C:\Documents and Settings\Administrator\ntuser.pol
[2010/03/07 15:39:54 | 000,001,475 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Windows Explorer.lnk
[2010/03/02 09:49:51 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2009/09/19 16:04:20 | 000,000,116 | —- | C] () – C:\WINDOWS\ConverterCore.INI
[2009/09/11 19:28:23 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2009/07/31 00:10:14 | 000,000,142 | —- | C] () – C:\Program Files\GamersHell.url
[2009/05/25 14:37:21 | 000,000,128 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.ldb
[2009/05/25 14:35:24 | 010,440,704 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.mda
[2009/05/24 20:15:32 | 000,219,136 | —- | C] () – C:\WINDOWS\sqlite3_engine.dll
[2009/05/21 01:46:09 | 000,004,588 | —- | C] () – C:\WINDOWS\AbleBurn.ini
[2009/05/21 01:42:55 | 000,000,111 | —- | C] () – C:\WINDOWS\TruDirect.ini
[2009/05/19 22:43:04 | 000,024,576 | R— | C] () – C:\WINDOWS\System32\AsIO.dll
[2009/05/19 22:43:04 | 000,012,400 | R— | C] () – C:\WINDOWS\System32\drivers\AsIO.sys
[2009/05/19 22:39:04 | 000,001,746 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2009/05/19 22:36:47 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/05/19 22:36:26 | 000,040,216 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2009/05/19 22:36:25 | 000,010,296 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/11/26 01:08:23 | 000,000,120 | —- | C] () – C:\WINDOWS\NVPerformance.INI
[2008/10/08 02:36:58 | 000,090,668 | —- | C] () – C:\WINDOWS\System32\vobis32.dll
[2008/10/08 01:48:54 | 000,000,036 | —- | C] () – C:\WINDOWS\Progs_.ini
[2008/10/08 01:48:49 | 000,000,601 | —- | C] () – C:\WINDOWS\1Way.ini
[2008/07/04 03:07:00 | 000,532,480 | —- | C] () – C:\WINDOWS\System32\libxml2.dll
[2007/11/08 18:52:07 | 000,013,396 | —- | C] () – C:\WINDOWS\System32\drivers\MTictwl.sys
[2007/06/25 16:30:17 | 000,000,057 | —- | C] () – C:\WINDOWS\TUTORI~1.INI
[2007/04/28 13:49:17 | 000,000,477 | —- | C] () – C:\WINDOWS\System32\ntmsqapi.dll
[2007/04/28 13:41:24 | 000,002,208 | —- | C] () – C:\WINDOWS\System32\drivers\nxsIO32.sys
[2007/02/13 12:32:28 | 000,006,592 | —- | C] () – C:\WINDOWS\System32\drivers\ds1410d.sys
[2006/12/14 15:32:52 | 000,000,009 | —- | C] () – C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameD.txt
[2006/11/16 21:43:33 | 000,667,648 | —- | C] () – C:\WINDOWS\System32\FreeImage.dll
[2006/11/16 18:44:53 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2006/11/16 18:43:07 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2006/08/31 11:46:13 | 000,000,310 | —- | C] () – C:\WINDOWS\primopdf.ini
[2006/08/22 11:57:37 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\hpzids01.dll
[2006/07/30 17:05:23 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/05/12 04:09:38 | 000,579,602 | —- | C] () – C:\WINDOWS\System32\x264vfw.dll
[2006/05/07 20:55:05 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/07 13:26:58 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\dxr.dll
[2006/05/07 13:24:54 | 000,099,840 | —- | C] () – C:\WINDOWS\System32\mkx.dll
[2006/05/07 13:24:42 | 000,051,200 | —- | C] () – C:\WINDOWS\System32\avi.dll
[2006/05/07 13:24:30 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\mmfinfo.dll
[2006/05/07 13:24:16 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\mp4.dll
[2006/05/07 13:24:04 | 000,057,856 | —- | C] () – C:\WINDOWS\System32\ogm.dll
[2006/05/07 13:23:46 | 000,045,568 | —- | C] () – C:\WINDOWS\System32\mkzlib.dll
[2006/05/07 13:23:42 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\mkunicode.dll
[2006/04/18 17:30:56 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2006/04/17 16:19:39 | 000,000,285 | —- | C] () – C:\WINDOWS\MusicEditor.INI
[2006/04/16 19:32:39 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\xmltok.dll
[2006/04/16 19:32:39 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\xmlparse.dll
[2006/03/21 14:13:33 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2006/02/22 11:21:25 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2006/02/22 11:21:25 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\unace.dll
[2005/12/30 15:18:26 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2005/12/30 15:10:30 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2005/11/29 15:17:16 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2005/11/29 15:14:42 | 002,675,712 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2005/11/29 15:11:30 | 000,371,200 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2005/11/29 15:10:46 | 000,217,088 | —- | C] () – C:\WINDOWS\System32\ff_kernelDeint.dll
[2005/11/29 15:10:10 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2005/11/29 15:10:06 | 000,512,000 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2005/11/29 15:09:54 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\ff_realaac.dll
[2005/11/29 15:09:50 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2005/11/29 15:09:30 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2005/11/29 15:09:24 | 000,056,320 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2005/11/29 15:09:14 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2005/11/29 15:09:06 | 000,131,072 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2005/11/29 15:09:04 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2005/11/29 15:09:00 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2005/11/29 15:09:00 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2005/11/05 08:31:14 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2005/09/26 04:24:38 | 000,024,064 | —- | C] () – C:\WINDOWS\System32\drivers\ATITool.sys
[2005/07/23 20:43:24 | 000,000,063 | —- | C] () – C:\WINDOWS\WININIT.INI
[2005/07/23 19:22:32 | 000,000,374 | —- | C] () – C:\WINDOWS\dreamsp.ini
[2005/07/13 10:36:48 | 000,000,100 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2005/06/12 17:55:30 | 000,000,535 | —- | C] () – C:\WINDOWS\CleaningLab.INI
[2005/06/12 17:48:59 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2005/06/12 17:46:13 | 000,000,919 | —- | C] () – C:\WINDOWS\mgxoschk.ini
[2005/06/12 17:46:13 | 000,000,024 | —- | C] () – C:\WINDOWS\magix.ini
[2005/06/12 16:53:50 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2005/05/16 04:55:24 | 000,003,972 | —- | C] () – C:\WINDOWS\System32\drivers\PciBus.sys
[2005/05/16 02:23:16 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/05/16 02:03:27 | 000,000,590 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/05/06 13:57:18 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/10/15 12:10:04 | 000,217,088 | —- | C] () – C:\WINDOWS\NVGfxOgl.dll
[2003/02/10 03:13:10 | 000,000,416 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\systmsp2pb6
[2002/05/17 17:18:30 | 000,124,928 | —- | C] () – C:\WINDOWS\System32\mp4fil32.dll
[1999/01/22 05:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2010/03/23 18:38:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/03/07 16:32:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/03/20 19:30:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2009/05/22 00:17:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\1Click DVD Copy
[2008/12/04 20:48:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2010/03/12 11:23:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/05/21 15:17:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Applications
[2009/05/21 19:38:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ASUS OC Profiles
[2009/08/16 09:19:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund
[2006/12/14 11:45:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CA
[2006/11/16 18:30:54 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/08/26 17:31:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Chexp
[2010/02/23 16:55:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Dimdim
[2008/09/18 03:38:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fsribcre
[2010/03/23 18:38:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2009/08/26 17:30:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ITRI mTTS
[2009/10/19 15:51:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MyDefrag
[2007/06/25 15:45:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nuance
[2010/03/07 18:41:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2008/09/20 15:29:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/10/03 13:17:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2007/06/25 15:45:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/10/10 23:19:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2009/05/21 20:43:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spiralfrog
[2010/02/25 12:14:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/09/30 22:25:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Transparent
[2009/06/05 22:47:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2009/09/16 10:25:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/29 20:47:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/02/23 16:55:58 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BF03BF7A-B118-4C26-B9F7-08C12D3D06E3}
[2010/02/09 12:09:02 | 000,000,306 | —- | M] () – C:\WINDOWS\Tasks\expressburnSevenDays.job
[2010/02/09 12:09:02 | 000,000,312 | —- | M] () – C:\WINDOWS\Tasks\expressburnSevenDaysInit.job
[2010/03/23 01:48:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/03/24 18:00:00 | 000,000,454 | —- | M] () – C:\WINDOWS\Tasks\next.job
[2010/02/09 12:08:46 | 000,000,288 | —- | M] () – C:\WINDOWS\Tasks\videopadSevenDays.job
[2010/02/09 12:08:45 | 000,000,288 | —- | M] () – C:\WINDOWS\Tasks\videopadShakeIcon.job

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2009/11/03 12:15:34 | 000,000,000 | —D | M](C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader ????) – C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader 安装程序
[2009/11/03 12:15:25 | 000,000,000 | —D | C](C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader ????) – C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader 安装程序
< End of report >

Shenlord

Post #81March 28, 2010, 1:54 AM UTC

The ongoing issues are still present. No change on functionality yet. Cheers. JJP

SweetTech

Post #82March 28, 2010, 2:10 AM UTC

Shenlord,

Do you have any idea where this registry fix file came from? Please do not double click on it.

C:\Documents and Settings\Administrator\Desktop\WinXP_EXE_Fix.reg

This will be my last post for the evening.

Have a nice night,

SweetTech

Shenlord

Post #83March 28, 2010, 3:24 AM UTC last edited March 28, 2010, 3:25 AM UTC

Good Morning SweetTech.

The WinXP-EXE-Fix file comes from my roommate trying to fix the .exe dysfunction a few weeks ago. Her fixworked for a while, but then the problem recurred and I contacted you guys. She also downloaded ERUNT and I have a backup registry from the same day.

The file in question is a registration entries file. Opening with regedit. Created, modified and accessed Sunday March 07 2010 4:56PM.

It has not run since march 7 when she used it as a fix. The other regedit file -cc-20100307-etc - on the desktop is from the exact same day and time when she was working on this issue.
I have of course not done anything on the comp that you did not specifically request since we started working together. >_>

This has been a very interesting journey for me. (I am learning a lot.) I hope it has been for you as well.

btw: Are the logs showing clean now?
Have a good Sunday. I will be checking regularly to see if you have assignments for me.
Thanks and Cheers

>
JPS

SweetTech

Post #84March 28, 2010, 4:17 PM UTC

Good Morning Shenlord,

Thank you for the clarification on that file.

From what I can see from your logs they look clean. I'm going to have you run ComboFix again, I'd like to take a look at a few things.

ComboFix Script

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Adware_HBHelper_Browser_Hijacker_Desktop_t111140.html&view=findpost&p=643992#entry643992
Dir::
C:\Documents and Settings\All Users\Application Data\{BF03BF7A-B118-4C26-B9F7-08C12D3D06E3}
C:\Documents and Settings\All Users\Application Data\fsribcre
C:\Documents and Settings\All Users\Application Data\IObit
C:\Documents and Settings\All Users\Application Data\ITRI mTTS

Submit::[102]
C:\Documents and Settings\All Users\Application Data\systmsp2pb6
C:\WINDOWS\System32\%sdvmexp.idx

Files::
C:\Program Files\Common Files\IRAREG.DLL
C:\Program Files\Common Files\IRAABOUT.DLL
C:\Program Files\Common Files\IRAMDMTR.DLL
C:\Program Files\Common Files\IRALPTTR.DLL
C:\Program Files\Common Files\IRAWEBTR.DLL
C:\Program Files\Common Files\IRASRIAL.DLL

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Shenlord

Post #85March 28, 2010, 5:13 PM UTC

Hi, Sweettech. I ran Combo Fix. It showed the loading animation. Then nothing happened. I ran it again (foolishly). Nothing happened. No scan . no log. Task Manager says CF is running, but there is nothing going on. Any suggestions? I used a fresh CF both times

Shenlord

Post #86March 28, 2010, 5:17 PM UTC last edited March 28, 2010, 5:21 PM UTC

I checked the pasted script I dragged into CF. It is the whole script copied from your post. Task Manager still shows CF running. (15 minutes or so, but no scan or any other activity). SHould I reboot anfd try again with a new CF? I didn't click it while it was running either.

SweetTech

Post #87March 28, 2010, 5:21 PM UTC

Please wait until I advise you further.

SweetTech

Post #88March 28, 2010, 5:41 PM UTC

If you see the following tasks running in Task Manager please go and and kill/end them. PEV.exe NirCmd.cfxxe PEV.cfxxe

Shenlord

Post #89March 28, 2010, 5:54 PM UTC

Nothing running except firefox.

SweetTech

Post #90March 28, 2010, 5:56 PM UTC

Does your task manager still show ComboFix as running?