Computer reinfected- can't access internet

Jcatsmom Topic Starter

Post #1September 15, 2010, 2:47 AM UTC

Same song, second verse. My friend was hit with a double whammy. An infected e-mail disabled McAfee and about a week later she was hit with a rogue antivirus program. Malware Bytes cleaned up one set in Safe Mode and the second in Regular Mode. We are unable to access the internet with IE or Mozilla.

The computer has Windows XP, SP3. My previous topic was [external image: Posted Image] Trojan_Zlob and other infection leftovers, computer slow, but improvin

I am attaching Malware Bytes logs and Otl reports. I would appreciate your help digging this one out again. Thank you!- Jcatsmom

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.orgDatabase version: 4532Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.187029/12/2010 4:20:34 PM
mbam-log-2010-09-12 (16-20-34).txtScan type: Quick scan
Objects scanned: 151502
Time elapsed: 10 minute(s), 4 second(s)Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2Memory Processes Infected:
(No malicious items detected)Memory Modules Infected:
(No malicious items detected)Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\wnxmal (Rogue.SecuritySuite) -> Quarantined and deleted successfully.Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rsoqalds (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rsoqalds (Rogue.SecuritySuite) -> Quarantined and deleted successfully.Registry Data Items Infected:
(No malicious items detected)Folders Infected:
(No malicious items detected)Files Infected:
C:\Documents and Settings\Dee\Local Settings\Application Data\uyrbbgjwr\fpqwvyyuqiw.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dee\Local Settings\Application Data\26630516.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.orgDatabase version: 4602Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.187029/12/2010 4:45:34 PM
mbam-log-2010-09-12 (16-45-34).txtScan type: Quick scan
Objects scanned: 154212
Time elapsed: 17 minute(s), 34 second(s)Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2Memory Processes Infected:
(No malicious items detected)Memory Modules Infected:
C:\WINDOWS\wuint12.dll (Trojan.Hiloti) -> Delete on reboot.Registry Keys Infected:
(No malicious items detected)Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tragevusukasev (Trojan.Hiloti) -> Quarantined and deleted successfully.Registry Data Items Infected:
(No malicious items detected)Folders Infected:
(No malicious items detected)Files Infected:
C:\WINDOWS\wuint12.dll (Trojan.Hiloti) -> Delete on reboot.
C:\Documents and Settings\Dee\Local Settings\Application Data\26630515.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

OTL logfile created on: 9/14/2010 9:14:11 PM - Run 1
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\Dee\Desktop\computer tools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 81.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 800 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.28 Gb Total Space | 58.44 Gb Free Space | 81.99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 488.60 Mb Total Space | 76.61 Mb Free Space | 15.68% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RECTORY
Current User Name: Dee
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Dee\Desktop\computer tools\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee\MSC\mcupdmgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)
PRC - C:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Dee\Desktop\computer tools\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()
MOD - C:\WINDOWS\unoravucuya.dll ()
MOD - C:\WINDOWS\SYSTEM32\opengl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\SYSTEM32\glu32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\SYSTEM32\ddraw.dll (Microsoft Corporation)
MOD - C:\WINDOWS\SYSTEM32\dciman32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys File not found
DRV - (SAUSBHW) – C:\WINDOWS\System32\Drivers\sausb.sys File not found
DRV - (RPSKT) Security Services Driver (x86) – C:\WINDOWS\System32\DRIVERS\rp_skt32.sys File not found
DRV - (cpuz132) – C:\DOCUME~1\Dee\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys File not found
DRV - (MPFP) – C:\WINDOWS\SYSTEM32\DRIVERS\Mpfp.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys (McAfee, Inc.)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (dsunidrv) – C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (senfilt) – C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys (Creative Technology Ltd.)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS (NVIDIA Corporation)
DRV - (WUSB54GV4SRV) – C:\WINDOWS\SYSTEM32\DRIVERS\rt2500usb.sys (Ralink Technology Inc.)
DRV - (GTNDIS5) – C:\WINDOWS\SYSTEM32\GTNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (hp4200c) – C:\WINDOWS\SYSTEM32\DRIVERS\hp4200c.sys (Hewlett-Packard)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:2.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {60799329-5010-4EEA-B216-C7A87C230110}:1.9.1

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/08/23 12:24:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/09/12 08:55:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{60799329-5010-4EEA-B216-C7A87C230110}: C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110} [2010/09/11 16:17:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/09 23:04:24 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/09 23:04:24 | 000,000,000 | —D | M]

[2008/12/02 20:50:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\Mozilla\Extensions
[2010/09/11 17:20:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\Mozilla\Firefox\Profiles\psq040np.default\extensions
[2010/09/04 12:44:06 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Dee\Application Data\Mozilla\Firefox\Profiles\psq040np.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/11 17:20:18 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/09/03 23:41:51 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/09/03 23:41:34 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/09/01 19:45:52 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Lgirovaruyuq] C:\WINDOWS\unoravucuya.DLL ()
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: kaspersky.com ([www] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Plugin Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/9/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…90/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1151174868143 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Dee\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dee\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 13:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/08/14 11:43:06 | 000,000,000 | RHSD | M] - E:\autorun.inf – [ FAT ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2010/09/11 16:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110}
[2010/09/11 16:16:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\uyrbbgjwr
[2010/09/06 17:01:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\My Documents\Dee's photos
[2010/09/03 23:42:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/09/03 23:41:49 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/09/03 23:41:49 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/09/03 23:41:49 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/09/03 23:41:49 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/09/03 13:51:17 | 000,000,000 | —D | C] – C:\Program Files\Eusing Free Registry Cleaner
[2010/09/02 21:40:05 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2010/09/02 21:14:20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\scripting
[2010/09/02 21:14:20 | 000,000,000 | —D | C] – C:\WINDOWS\l2schemas
[2010/09/02 21:14:20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en
[2010/09/02 21:14:20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\bits
[2010/09/02 21:06:27 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstall$
[2010/09/02 21:06:26 | 000,000,000 | —D | C] – C:\WINDOWS\EHome
[2010/09/02 20:51:29 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/09/02 18:23:23 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/09/02 18:23:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/09/02 18:22:54 | 000,423,656 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/09/01 19:39:25 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/09/01 19:32:51 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/08/30 08:05:34 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/08/30 07:24:11 | 000,000,000 | —D | C] – C:\Program Files\HD Tune
[2010/08/30 07:21:31 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/08/29 23:12:27 | 000,000,000 | —D | C] – C:\found.001
[2010/08/29 21:21:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Dee\PrivacIE
[2010/08/28 22:02:43 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Dee\IECompatCache
[2010/08/28 21:54:57 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Dee\IETldCache
[2010/08/28 21:33:30 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/08/28 13:06:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Desktop\computer tools
[2010/08/28 12:41:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Application Data\Malwarebytes
[2010/08/28 12:41:29 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/08/28 12:41:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/08/28 12:41:26 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/08/28 12:41:26 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2008/07/24 14:20:40 | 010,420,936 | —- | C] (Microsoft Corporation) – C:\Program Files\xlviewer.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/14 21:11:37 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/09/14 20:51:10 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/14 20:51:07 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/09/14 20:51:05 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/09/12 18:05:16 | 004,194,304 | —- | M] () – C:\Documents and Settings\Dee\ntuser.dat
[2010/09/12 18:05:16 | 000,013,189 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2010/09/12 18:05:16 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Dee\NTUSER.INI
[2010/09/12 18:05:07 | 003,768,536 | -H– | M] () – C:\Documents and Settings\Dee\Local Settings\Application Data\IconCache.db
[2010/09/12 17:58:56 | 000,000,724 | —- | M] () – C:\WINDOWS\WIN.INI
[2010/09/12 17:58:56 | 000,000,327 | RHS- | M] () – C:\BOOT.INI
[2010/09/12 17:58:56 | 000,000,256 | —- | M] () – C:\WINDOWS\system.ini
[2010/09/12 16:17:06 | 000,000,444 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/12 08:43:51 | 000,002,838 | —- | M] () – C:\WINDOWS\owivanoqiqurih.dll
[2010/09/11 20:21:40 | 000,002,838 | —- | M] () – C:\WINDOWS\osedokezezocoh.dll
[2010/09/06 18:51:31 | 000,000,151 | —- | M] () – C:\WINDOWS\Ulead32.ini
[2010/09/06 17:06:18 | 000,000,071 | —- | M] () – C:\WINDOWS\pex.INI
[2010/09/06 16:57:38 | 000,058,080 | —- | M] () – C:\Documents and Settings\Dee\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/09/04 13:09:00 | 000,224,816 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/03 23:41:32 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/09/03 23:41:32 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/09/03 23:41:32 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/09/03 23:41:32 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/09/03 23:41:31 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/09/03 18:29:48 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/09/03 18:28:12 | 000,503,304 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/03 18:28:12 | 000,442,466 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2010/09/03 18:28:12 | 000,071,732 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2010/09/03 13:51:54 | 077,652,368 | —- | M] () – C:\Documents and Settings\Dee\My Documents\regis bkup1.reg
[2010/09/03 11:29:09 | 000,000,036 | —- | M] () – C:\Documents and Settings\Dee\Local Settings\Application Data\housecall.guid.cache
[2010/09/02 21:10:40 | 000,250,048 | RHS- | M] () – C:\NTLDR
[2010/09/02 20:37:39 | 000,219,648 | —- | M] () – C:\Documents and Settings\Dee\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/01 19:45:52 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2010/08/28 21:54:56 | 000,000,815 | —- | M] () – C:\Documents and Settings\Dee\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/28 12:41:32 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/23 19:18:06 | 000,008,359 | —- | M] () – C:\Documents and Settings\Dee\My Documents\Dee Eichler CV.wpd
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/12 16:17:06 | 000,000,444 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/12 08:43:51 | 000,002,838 | —- | C] () – C:\WINDOWS\owivanoqiqurih.dll
[2010/09/11 20:21:39 | 000,002,838 | —- | C] () – C:\WINDOWS\osedokezezocoh.dll
[2010/09/03 13:51:42 | 077,652,368 | —- | C] () – C:\Documents and Settings\Dee\My Documents\regis bkup1.reg
[2010/09/03 11:29:09 | 000,000,036 | —- | C] () – C:\Documents and Settings\Dee\Local Settings\Application Data\housecall.guid.cache
[2010/09/01 19:39:31 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/09/01 19:39:29 | 000,260,272 | RHS- | C] () – C:\cmldr
[2010/09/01 19:33:14 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/09/01 19:33:14 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/08/28 12:41:32 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2008/04/23 15:42:50 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2008/04/16 13:39:35 | 000,219,648 | —- | C] () – C:\Documents and Settings\Dee\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/01/09 04:01:57 | 000,000,197 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2006/04/24 16:06:59 | 000,000,397 | R— | C] () – C:\WINDOWS\hpw9800k.ini
[2006/04/24 16:04:33 | 000,000,478 | —- | C] () – C:\WINDOWS\hpdj9800.ini
[2006/04/24 16:04:21 | 000,001,567 | —- | C] () – C:\WINDOWS\mariner.ini
[2005/10/31 09:04:21 | 000,003,668 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2005/08/23 11:03:17 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[2005/08/23 11:03:17 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
[2005/08/03 11:01:08 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2005/08/03 11:00:54 | 000,001,635 | —- | C] () – C:\WINDOWS\System32\WLAN.INI
[2005/05/10 11:20:38 | 000,093,696 | —- | C] () – C:\WINDOWS\System32\hpgt42.dll
[2005/04/30 12:35:38 | 000,000,071 | —- | C] () – C:\WINDOWS\pex.INI
[2005/04/27 17:17:19 | 000,000,151 | —- | C] () – C:\WINDOWS\Ulead32.ini
[2005/04/27 16:44:22 | 000,000,848 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2005/04/26 21:17:56 | 000,061,678 | —- | C] () – C:\Documents and Settings\Dee\Application Data\PFP120JPR.{PB
[2005/04/26 21:17:56 | 000,012,358 | —- | C] () – C:\Documents and Settings\Dee\Application Data\PFP120JCM.{PB
[2005/04/26 19:23:35 | 000,006,602 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2005/04/25 20:10:41 | 000,000,126 | —- | C] () – C:\Documents and Settings\Dee\Local Settings\Application Data\fusioncache.dat
[2005/04/23 20:00:53 | 000,000,190 | —- | C] () – C:\WINDOWS\QTW.INI
[2005/04/23 19:55:15 | 000,000,073 | —- | C] () – C:\WINDOWS\ldg.ini
[2005/04/23 19:54:34 | 000,000,776 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/04/23 19:54:34 | 000,000,282 | —- | C] () – C:\WINDOWS\pib.ini
[2005/04/20 14:45:41 | 000,000,070 | —- | C] () – C:\WINDOWS\D96E1E82.ini
[2005/04/20 11:13:15 | 000,006,048 | —- | C] () – C:\WINDOWS\System32\MCC16.dll
[2005/04/20 11:11:40 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\BJInstaller.dll
[2005/04/20 11:11:40 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\BJAXSecurityManager.dll
[2005/04/18 16:38:05 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2005/04/14 00:07:49 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/04/14 00:05:58 | 000,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/04/13 23:31:02 | 000,000,370 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 13:13:12 | 000,000,882 | —- | C] () – C:\WINDOWS\ORUN32.INI
[2004/08/04 05:00:00 | 000,199,168 | —- | C] () – C:\WINDOWS\unoravucuya.dll
[2004/08/04 05:00:00 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\FXSPERF.INI
[1980/01/01 00:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2009/11/23 11:53:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AT&T;
[2007/10/27 11:25:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BellSouth
[2010/05/03 10:54:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2007/12/13 16:34:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/04/27 17:20:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2008/02/03 17:08:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/04/22 08:51:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo
[2009/11/23 11:53:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\AT&T;
[2007/10/27 11:25:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\BellSouth
[2006/10/24 22:06:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\Leadertech
[2010/08/03 13:26:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\Sammsoft
[2010/07/24 10:42:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\Ulead Systems
[2009/03/20 11:21:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Dee\Application Data\Viewpoint
[2005/04/18 16:09:59 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\ISP signup reminder 1.job
[2010/07/15 01:00:00 | 000,000,344 | —- | M] () – C:\WINDOWS\Tasks\McDefragTask.job
[2010/05/11 14:59:29 | 000,000,322 | —- | M] () – C:\WINDOWS\Tasks\McQcTask.job
[2010/09/14 21:11:37 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2004/08/10 13:04:08 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2006/11/20 19:01:01 | 019,856,430 | —- | M] () – C:\BellSouthIW.re~
[2008/12/16 19:59:12 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/09/12 17:58:56 | 000,000,327 | RHS- | M] () – C:\BOOT.INI
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2004/08/10 13:04:08 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2005/04/13 23:34:32 | 000,004,403 | RH– | M] () – C:\DELL.SDR
[2005/08/23 10:43:27 | 000,547,952 | —- | M] () – C:\HPScanjet4200C.exe
[2004/08/10 13:14:36 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2004/08/10 13:04:08 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2005/04/14 00:03:13 | 000,000,770 | -H– | M] () – C:\IPH.PH
[2010/09/02 19:49:53 | 000,006,794 | —- | M] () – C:\JavaRa.log
[2004/08/10 13:04:08 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/09/02 21:10:40 | 000,250,048 | RHS- | M] () – C:\NTLDR
[2010/09/14 20:51:04 | 838,860,800 | -HS- | M] () – C:\pagefile.sys
[2005/08/23 11:02:28 | 036,422,256 | —- | M] () – C:\sj655en.exe
[2008/02/28 19:28:53 | 000,000,495 | —- | M] () – C:\stub.log
[2005/04/14 00:03:22 | 000,000,087 | —- | M] () – C:\SystemInfo.ini
[1 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 13:03:42 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\filterpipelineprintproc.dll
[2005/05/10 16:14:32 | 000,067,072 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\hpzpp3xt.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/07/24 14:21:10 | 010,420,936 | —- | M] (Microsoft Corporation) – C:\Program Files\xlviewer.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 12:56:48 | 000,094,208 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
[2004/08/10 12:56:46 | 000,634,880 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
[2004/08/10 12:56:46 | 000,872,448 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/09/02 21:15:06 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/04/18 20:29:30 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Dee\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2004/08/10 13:08:38 | 000,000,079 | —- | M] () – C:\Documents and Settings\Dee\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-11 01:45:37

========== Alternate Data Streams ==========

@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:18B7103A
< End of report >

OTL Extras logfile created on: 9/14/2010 9:14:11 PM - Run 1
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\Dee\Desktop\computer tools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 81.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 800 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.28 Gb Total Space | 58.44 Gb Free Space | 81.99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 488.60 Mb Total Space | 76.61 Mb Free Space | 15.68% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RECTORY
Current User Name: Dee
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL – File not found
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\HP1610\HP Software Update\HPWUCli.exe" = C:\Program Files\HP1610\HP Software Update\HPWUCli.exe:*:Enabled:HP Software Update Client – (Hewlett-Packard)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer – (RealNetworks, Inc.)
"C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox – (Yahoo! Inc.)
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent – (McAfee, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{14BEB6DF-A499-4A38-8E06-E173BCD5C087}" = ScannerCopy
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel® PROSet for Wired Connections
"{1AD5F465-8282-4DAD-B957-E09C0B783D18}" = InstantShare
"{1B680FBA-E317-4E93-AF43-3B59798A4BE0}" = Copy
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}" = TrayApp
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{272EC8BA-5A08-4ea1-A189-684466A06B02}" = cp_dwShrek2Albums1
"{2E8428AD-6CD2-4031-916A-3CF9BBF2DEC9}" = Unload
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3762DB2D-71BD-421F-9E55-C74DA7DF4D07}" = CueTour
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47813E93-F2A0-484A-838E-47EC1B28D190}" = Adobe Stock Photos 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5DFDEAAA-E050-482E-A5B6-138CAE53F7BF}" = Radialpoint Security Services
"{5E8D588F-307C-4250-B622-26969027319A}" = PanoStandAlone
"{644D04A2-C682-4FD5-977D-03B804C4B9C5}" = CreativeProjects
"{646A65DD-23FC-418E-B9F0-E0500FB42CB1}" = PhotoGallery
"{68963635-14A4-48D9-B431-DF3A74D1AAE1}" = Destinations
"{700A6597-3CE6-49C1-AA75-846B24CDA66D}" = BufferChm
"{724517BD-1DE1-4986-BFCA-C1DFD379E3BC}" = cp_dwShrek2Cards1
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{7AD25C9F-9957-4D1C-95EF-9BCD09F6D31B}" = HPSystemDiagnostics
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{84CDF5A8-1D57-4B69-BAB6-1F11D8923375}" = SkinsHP1
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8BC3B99B-A6BE-4A0B-8535-B1B94BA4B1B1}" = DocProc
"{90840409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5B9D22C-755A-4AC6-9904-875E80838BB6}" = CP_AtenaShokunin1Config
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B911B811-BA3E-46D4-90F8-6F3338359651}" = Director
"{BD29EBAC-AD7D-4b27-B727-4CC6AC52D36B}" = MarketResearch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDFCF124-115F-4976-8BF4-08C89187A146}" = WebReg
"{CE0C8CC5-E396-442B-A50E-D1D374A9E820}" = DocumentViewer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0 SE Basic
"{EC3B8CA2-49B8-4D38-BE9C-ABD0F6029168}" = Yahoo! Music Jukebox
"{F24862FD-DDC7-490D-AC02-8797B575D6A9}" = SpaMsiWrapper
"{FC22D020-3005-4715-8DF9-F3EDE81DEB3D}" = CreativeProjectsTemplates
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Registry Optimizer_is1" = Advanced Registry Optimizer
"BellsouthHelpCenter4.0b_is1" = FastAccess® DSL Help Center 4.3
"blstoolbar" = AT&T; Toolbar
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"HD Tune_is1" = HD Tune 2.54
"HijackThis" = HijackThis 2.0.2
"HP Photo & Imaging" = HP Image Zone 4.7
"HPExtendedCapabilities" = HP Extended Capabilities 4.7
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.9)" = Mozilla Firefox (3.6.9)
"MSC" = McAfee SecurityCenter
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel® PRO Network Adapters and Drivers
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/5/2010 11:06:04 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 9/5/2010 11:06:04 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 9/5/2010 11:06:04 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 9/5/2010 11:06:05 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 9/11/2010 1:00:30 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 9/11/2010 1:00:30 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 9/14/2010 9:51:17 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: A connection with the server could not be established

Error - 9/14/2010 9:51:17 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: A connection with the server could not be established

Error - 9/14/2010 9:51:17 PM | Computer Name = RECTORY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdo…authrootseq.txt>
with error: A connection with the server could not be established

Error - 9/14/2010 10:11:35 PM | Computer Name = RECTORY | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 9/12/2010 6:31:29 PM | Computer Name = RECTORY | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service McAfee SiteAdvisor
Service with arguments "" in order to run the server: {5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}

Error - 9/12/2010 6:31:29 PM | Computer Name = RECTORY | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service McAfee SiteAdvisor
Service with arguments "" in order to run the server: {5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}

Error - 9/12/2010 6:31:48 PM | Computer Name = RECTORY | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service McNASvc with
arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}

Error - 9/12/2010 6:31:49 PM | Computer Name = RECTORY | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service McNASvc with
arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}

Error - 9/12/2010 6:40:42 PM | Computer Name = RECTORY | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 9/12/2010 6:41:37 PM | Computer Name = RECTORY | Source = Service Control Manager | ID = 7000
Description = The Security Services Driver (x86) service failed to start due to
the following error: %%2

Error - 9/12/2010 7:00:00 PM | Computer Name = RECTORY | Source = Service Control Manager | ID = 7000
Description = The Security Services Driver (x86) service failed to start due to
the following error: %%2

Error - 9/14/2010 9:51:19 PM | Computer Name = RECTORY | Source = Service Control Manager | ID = 7000
Description = The Security Services Driver (x86) service failed to start due to
the following error: %%2

Error - 9/14/2010 10:14:34 PM | Computer Name = RECTORY | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 9/14/2010 10:14:34 PM | Computer Name = RECTORY | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

< End of report >

mowman

Post #2September 15, 2010, 8:51 AM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post
•Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
•This may cause a delay in response time, but I will do my best to keep it as short as possible.
•I will reply back shortly with instructions.

mowman

Post #3September 15, 2010, 12:36 PM UTC

Please do the following.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
MOD - C:\WINDOWS\unoravucuya.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092
O2 - BHO: (no name) - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Lgirovaruyuq] C:\WINDOWS\unoravucuya.DLL ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
[2010/09/11 16:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110}
[2010/09/11 16:16:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\uyrbbgjwr
[2010/09/12 08:43:51 | 000,002,838 | —- | C] () – C:\WINDOWS\owivanoqiqurih.dll
[2010/09/11 20:21:39 | 000,002,838 | —- | C] () – C:\WINDOWS\osedokezezocoh.dll
[2004/08/04 05:00:00 | 000,199,168 | —- | C] () – C:\WINDOWS\unoravucuya.dll


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.

Please scan the following files

Please visit Virus Total by clicking here.
Click the Browse button and search for the following file: C:\WINDOWS\System32\FXSPERF.INI
Click Open.
Then click Send File.
Please be patient while the file is scanned.
If Virus Total tells you that the file has already been scanned, click "reanalyse now".

Once the scan results appear, copy and paste them into Notepad and repeat the procedure for the following file(s):
C:\WINDOWS\System32\e100bmsg.dll
Please provide the results from the scans in your next reply.

Jcatsmom

Post #4September 16, 2010, 3:36 AM UTC

Mowman, I am having trouble posting from either computer.

Jcatsmom

Post #5September 16, 2010, 3:48 AM UTC

Hi, Mowman. Thank you for taking on this case. I have finally been able to get the computer back on

the internet. The lan settings had been changed to proxy. Fortunately Mozilla diagnostic tools

helped me figure that out. I found that I couldn't really enter text for this report using Mozilla.

Here are the scans you requested. I had disabled unoravucuya.DLL with Msconfig in the start-up

menu because I didn't recognize it. I am getting Real Player errors when I am running scans,

though. -Jcatsmom

The GMER log is large 930 KB.

OTL Fix Log
All processes killed
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret > in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret <[2010/09/11 16:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110}> in the current context!
Error: Unable to interpret <[2010/09/11 16:16:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\uyrbbgjwr> in the current context!
Error: Unable to interpret <[2010/09/12 08:43:51 | 000,002,838 | —- | C] () – C:\WINDOWS\owivanoqiqurih.dll> in the current context!
Error: Unable to interpret <[2010/09/11 20:21:39 | 000,002,838 | —- | C] () – C:\WINDOWS\osedokezezocoh.dll> in the current context!
Error: Unable to interpret <[2004/08/04 05:00:00 | 000,199,168 | —- | C] () – C:\WINDOWS\unoravucuya.dll> in the current context!
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Dee
->Temp folder emptied: 92851 bytes
->Temporary Internet Files folder emptied: 540806 bytes
->Java cache emptied: 149422 bytes
->FireFox cache emptied: 42228034 bytes
->Flash cache emptied: 97134 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 2682245 bytes
->FireFox cache emptied: 3386623 bytes
->Flash cache emptied: 16026 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 2072 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Stephen

%systemdrive% .tmp files removed: 6597 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1537 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 47.00 mb

OTL by OldTimer - Version 3.2.12.0 log created on 09152010_135512

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Virus Total Results (both items reanalysed)

File name:
FXSPERF.INI
Submission date:
2010-09-16 02:09:30 (UTC)
Current status:
queued (#1) queued (#1) analysing finished
Result:
0/ 43 (0.0%)

File name:
e100bmsg.dll
Submission date:
2010-09-16 02:13:18 (UTC)
Current status:
queued queued (#1) analysing finished
Result:
0/ 43 (0.0%)

mowman

Post #6September 16, 2010, 12:44 PM UTC

Please re run the OTL fix below.Do not copy the word Code into the Custom Scans/Fixes box,it must start with :Files

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Files

:OTL
MOD - C:\WINDOWS\unoravucuya.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092
O2 - BHO: (no name) - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Lgirovaruyuq] C:\WINDOWS\unoravucuya.DLL ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
[2010/09/11 16:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110}
[2010/09/11 16:16:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Dee\Local Settings\Application Data\uyrbbgjwr
[2010/09/12 08:43:51 | 000,002,838 | —- | C] () – C:\WINDOWS\owivanoqiqurih.dll
[2010/09/11 20:21:39 | 000,002,838 | —- | C] () – C:\WINDOWS\osedokezezocoh.dll
[2004/08/04 05:00:00 | 000,199,168 | —- | C] () – C:\WINDOWS\unoravucuya.dll


:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Please copy/paste the GMER log into as many posts as necessary.

Jcatsmom

Post #7September 17, 2010, 4:44 AM UTC

Mowman, I finally got my ducks in a row on this one. You'd think this was my first time at this.

I hadn't saved Gmer correctly last time. I ran it without devices checked this time to speed it up- takes about 3 hours on this machine. Seems like each time Gmer runs, I end up with a BSOD either during it or after. Here is my first report. Thanks for your patience. -Jcatsmom All processes killed ========== FILES ========== ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully! HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3C060EA2-E6A9-4E49-A530-D4657B8C449A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3C060EA2-E6A9-4E49-A530-D4657B8C449A}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{BA52B914-B692-46c4-B683-905236F6F655} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA52B914-B692-46c4-B683-905236F6F655}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Lgirovaruyuq not found. File C:\WINDOWS\unoravucuya.DLL not found. Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully. C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110}\chrome\content folder moved successfully. C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110}\chrome folder moved successfully. C:\Documents and Settings\Dee\Local Settings\Application Data\{60799329-5010-4EEA-B216-C7A87C230110} folder moved successfully. C:\Documents and Settings\Dee\Local Settings\Application Data\uyrbbgjwr folder moved successfully. C:\WINDOWS\owivanoqiqurih.dll moved successfully. C:\WINDOWS\osedokezezocoh.dll moved successfully. File C:\WINDOWS\unoravucuya.dll not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Dee ->Temp folder emptied: 714774 bytes ->Temporary Internet Files folder emptied: 3615277 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 22264347 bytes ->Flash cache emptied: 456 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 3584 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Stephen %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 56328 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 25.00 mb OTL by OldTimer - Version 3.2.12.0 log created on 09162010_082631 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

Jcatsmom

Post #8September 17, 2010, 4:47 AM UTC

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-16 22:58:45
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Dee\LOCALS~1\Temp\ufldrpow.sys

—- System - GMER 1.0.15 —-

Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateFile [0xF7B0ECA2]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateProcess [0xF7B0EC78]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF7B0EC8C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF7B0ECE2]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xF7B0EC14]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xF7B0EC28]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF7B0ECB6]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetContextThread [0xF7B0EC64]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF7B0EC50]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF7B0ED11]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF7B0ECF8]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xF7B0ECCC]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtCreateFile
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution 804F0EB6 7 Bytes JMP F7B0ECD0 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtCreateFile 8056CF98 5 Bytes JMP F7B0ECA6 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtSetInformationProcess 8056DDD9 5 Bytes JMP F7B0EC54 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenProcess 805719AC 5 Bytes JMP F7B0EC18 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwProtectVirtualMemory 80571E96 7 Bytes JMP F7B0ECBA mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 805738C6 5 Bytes JMP F7B0ECFC mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 80573D41 7 Bytes JMP F7B0ECE6 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcessEx 8057FE4C 7 Bytes JMP F7B0EC90 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 805824CC 5 Bytes JMP F7B0ED15 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenThread 8058E5C4 5 Bytes JMP F7B0EC2C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcess 805B14AC 5 Bytes JMP F7B0EC7C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetContextThread 8062E057 5 Bytes JMP F7B0EC68 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xB98BEF80]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BC0F49
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BC0F64
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BC0F75
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BC0F90
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BC0FBC
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BC0F0C
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BC0F1D
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BC0076
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BC0065
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BC0087
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BC0FA1
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BC0FDE
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BC0F38
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BC0028
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BC0FCD
.text C:\WINDOWS\system32\svchost.exe[280] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BC0EE7
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BB001B
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BB0F9B
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BB0FCA
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BB0FE5
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BB004E
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BB0000
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BB003D
.text C:\WINDOWS\system32\svchost.exe[280] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BB002C
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BA0FA1
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BA0FBC
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BA0022
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BA0000
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BA0FCD
.text C:\WINDOWS\system32\svchost.exe[280] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BA0011
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0007000A
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00070FA2
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 000700A1
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00070FD1
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00070058
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 000700D9
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00070F91
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000700FE
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070F65
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00070F54
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00070073
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0007001B
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 000700BC
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00070047
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00070036
.text C:\WINDOWS\system32\services.exe[688] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070F76
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0006001B
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00060F80
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00060FD4
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0006000A
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00060F9B
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00060FEF
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00060047
.text C:\WINDOWS\system32\services.exe[688] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0006002C
.text C:\WINDOWS\system32\services.exe[688] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00050025
.text C:\WINDOWS\system32\services.exe[688] msvcrt.dll!system 77C293C7 5 Bytes JMP 00050014
.text C:\WINDOWS\system32\services.exe[688] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00050FB5
.text C:\WINDOWS\system32\services.exe[688] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00050FEF
.text C:\WINDOWS\system32\services.exe[688] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00050FA4
.text C:\WINDOWS\system32\services.exe[688] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00050FD2
.text C:\WINDOWS\system32\services.exe[688] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00040FEF
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E50FEF
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E50FA3
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E500A2
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E50087
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E50076
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E5004A
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E500C9
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E50F77
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E50F4B
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E500E4
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E500FF
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E50065
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E5000A
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E50F88
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E50FDE
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E5002F
.text C:\WINDOWS\system32\lsass.exe[724] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E50F66
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E40FD1
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E4008E
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E4002C
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E4001B
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E40073
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E40000
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00E40058
.text C:\WINDOWS\system32\lsass.exe[724] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E4003D
.text C:\WINDOWS\system32\lsass.exe[724] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E30FAD
.text C:\WINDOWS\system32\lsass.exe[724] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E30042
.text C:\WINDOWS\system32\lsass.exe[724] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E3001D
.text C:\WINDOWS\system32\lsass.exe[724] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E30000
.text C:\WINDOWS\system32\lsass.exe[724] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E30FD2
.text C:\WINDOWS\system32\lsass.exe[724] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E30FEF
.text C:\WINDOWS\system32\lsass.exe[724] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00DA0FE5
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00FD0FE5
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00FD0F52
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00FD0047
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00FD0F79
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00FD0036
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00FD0FB9
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00FD0073
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00FD0062
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00FD00BA
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00FD00A9
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00FD00D5
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00FD0F9E
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00FD000A
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00FD0F41
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00FD001B
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00FD0FD4
.text C:\WINDOWS\system32\svchost.exe[884] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00FD0098
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00FC0047
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00FC0062
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00FC0036
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00FC0025
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00FC0FA5
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00FC0000
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00FC0FB6
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [1C, 89] {SBB AL, 0x89}
.text C:\WINDOWS\system32\svchost.exe[884] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00FC0FDB
.text C:\WINDOWS\system32\svchost.exe[884] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FB0FCA
.text C:\WINDOWS\system32\svchost.exe[884] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FB0055
.text C:\WINDOWS\system32\svchost.exe[884] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FB0FEF
.text C:\WINDOWS\system32\svchost.exe[884] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FB0000
.text C:\WINDOWS\system32\svchost.exe[884] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FB003A
.text C:\WINDOWS\system32\svchost.exe[884] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FB001D
.text C:\WINDOWS\system32\svchost.exe[884] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FA0000
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BF008F
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BF0074
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BF004D
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BF0F90
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BF0FBC
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BF0F53
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BF0F64
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BF00F6
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BF00DB
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BF0107
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BF0FAB
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BF0FDE
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BF0F75
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BF001E
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BF0FCD
.text C:\WINDOWS\system32\svchost.exe[960] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BF00B6
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BE0040
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BE007D
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BE001B
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BE0062
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BE0000
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BE0051
.text C:\WINDOWS\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BE0FCA

Jcatsmom

Post #9September 17, 2010, 4:48 AM UTC

.text C:\WINDOWS\system32\svchost.exe[960] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BD0FAF .text C:\WINDOWS\system32\svchost.exe[960] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BD0FCA .text C:\WINDOWS\system32\svchost.exe[960] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BD003A .text C:\WINDOWS\system32\svchost.exe[960] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BD000C .text C:\WINDOWS\system32\svchost.exe[960] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BD0FDB .text C:\WINDOWS\system32\svchost.exe[960] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BD0029 .text C:\WINDOWS\system32\svchost.exe[960] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BC000A .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 021D0FE5 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 021D006B .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 021D0F80 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 021D005A .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 021D003D .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 021D0011 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 021D0097 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 021D0086 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 021D0F2A .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 021D00C3 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 021D0F0F .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 021D002C .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 021D0FCA .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 021D0F5B .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 021D0FA5 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 021D0000 .text C:\WINDOWS\System32\svchost.exe[1040] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 021D00A8 .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 021C0FCD .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 021C005B .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 021C0FDE .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 021C0FEF .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 021C004A .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 021C000A .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 021C0FB2 .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [3C, 8A] {CMP AL, 0x8a} .text C:\WINDOWS\System32\svchost.exe[1040] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 021C0039 .text C:\WINDOWS\System32\svchost.exe[1040] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 02120042 .text C:\WINDOWS\System32\svchost.exe[1040] msvcrt.dll!system 77C293C7 5 Bytes JMP 02120027 .text C:\WINDOWS\System32\svchost.exe[1040] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 02120FD2 .text C:\WINDOWS\System32\svchost.exe[1040] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02120FEF .text C:\WINDOWS\System32\svchost.exe[1040] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02120FB7 .text C:\WINDOWS\System32\svchost.exe[1040] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0212000C .text C:\WINDOWS\System32\svchost.exe[1040] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02110FE5 .text C:\WINDOWS\System32\svchost.exe[1040] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 0210000A .text C:\WINDOWS\System32\svchost.exe[1040] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 02100FEF .text C:\WINDOWS\System32\svchost.exe[1040] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 02100FD4 .text C:\WINDOWS\System32\svchost.exe[1040] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 02100FC3 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00650FE5 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00650F6B .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00650F7C .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0065004A .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00650F8D .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00650025 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00650087 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00650F3F .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 006500C7 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00650F24 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 006500D8 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00650F9E .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0065000A .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00650F50 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00650FAF .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00650FD4 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 006500A2 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0064004A .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00640087 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00640FEF .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00640025 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00640076 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00640000 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00640FD4 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [84, 88] .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00640065 .text C:\WINDOWS\system32\svchost.exe[1072] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00630029 .text C:\WINDOWS\system32\svchost.exe[1072] msvcrt.dll!system 77C293C7 5 Bytes JMP 00630018 .text C:\WINDOWS\system32\svchost.exe[1072] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00630FCD .text C:\WINDOWS\system32\svchost.exe[1072] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00630FEF .text C:\WINDOWS\system32\svchost.exe[1072] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00630FA8 .text C:\WINDOWS\system32\svchost.exe[1072] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00630FDE .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00770FEF .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00770F57 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00770F68 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00770F79 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00770F94 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00770FAF .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00770F04 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00770F1F .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00770EC7 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00770ED8 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00770EA2 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00770036 .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0077000A .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00770F3C .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0077001B .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00770FCA .text C:\WINDOWS\system32\svchost.exe[1192] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00770EE9 .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00760FDB .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0076007D .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0076002C .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0076001B .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00760062 .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00760000 .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00760FCA .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [96, 88] .text C:\WINDOWS\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00760051 .text C:\WINDOWS\system32\svchost.exe[1192] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0075004E .text C:\WINDOWS\system32\svchost.exe[1192] msvcrt.dll!system 77C293C7 5 Bytes JMP 00750033 .text C:\WINDOWS\system32\svchost.exe[1192] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00750FCD .text C:\WINDOWS\system32\svchost.exe[1192] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00750FEF .text C:\WINDOWS\system32\svchost.exe[1192] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00750022 .text C:\WINDOWS\system32\svchost.exe[1192] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00750FDE .text C:\WINDOWS\system32\svchost.exe[1192] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00740000 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009C0FEF .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009C0098 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009C0FA3 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009C0087 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009C0076 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009C004A .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009C0F77 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009C00BF .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009C0F4B .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009C0F5C .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009C0F26 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009C0065 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009C000A .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009C0F88 .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009C002F .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009C0FDE .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009C00D0 .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009B0FDE .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009B008A .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009B002F .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009B0FEF .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 009B0FC3 .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 009B0000 .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 009B0065 .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 009B0054 .text C:\WINDOWS\system32\svchost.exe[1236] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 009A0FA6 .text C:\WINDOWS\system32\svchost.exe[1236] msvcrt.dll!system 77C293C7 5 Bytes JMP 009A0031 .text C:\WINDOWS\system32\svchost.exe[1236] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 009A0FC1 .text C:\WINDOWS\system32\svchost.exe[1236] msvcrt.dll!_open 77C2F566 5 Bytes JMP 009A0FEF .text C:\WINDOWS\system32\svchost.exe[1236] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 009A0016 .text C:\WINDOWS\system32\svchost.exe[1236] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 009A0FDE .text C:\WINDOWS\system32\svchost.exe[1236] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00990FE5 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BA0000 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BA008C .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BA0F8D .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BA005B .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BA004A .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BA0FC3 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BA00B8 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BA00A7 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BA0F55 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BA00E4 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BA0109 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BA0FA8 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BA001B .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BA0F7C .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BA0FD4 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BA0FE5 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BA00D3 .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00930FEF .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00930FD4 .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00930036 .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0093001B .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00930091 .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0093000A .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00930076 .text C:\WINDOWS\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00930065 .text C:\WINDOWS\system32\svchost.exe[1380] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00920FD2 .text C:\WINDOWS\system32\svchost.exe[1380] msvcrt.dll!system 77C293C7 5 Bytes JMP 00920053 .text C:\WINDOWS\system32\svchost.exe[1380] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00920027 .text C:\WINDOWS\system32\svchost.exe[1380] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00920FEF .text C:\WINDOWS\system32\svchost.exe[1380] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00920042 .text C:\WINDOWS\system32\svchost.exe[1380] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0092000C .text C:\WINDOWS\system32\svchost.exe[1380] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00900FEF .text C:\WINDOWS\system32\svchost.exe[1380] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00900FDE .text C:\WINDOWS\system32\svchost.exe[1380] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00900FC3 .text C:\WINDOWS\system32\svchost.exe[1380] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00900FB2 .text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00910000 .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1692] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1692] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01F60FEF .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01F60F4E .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01F60F69 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01F60F86 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01F60043 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01F60FA1 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01F60096 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01F6007B .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01F60F18 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01F60F29 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01F600CC .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01F60028 .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01F60FDE .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01F6005E .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01F60FBC .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01F60FCD .text C:\WINDOWS\Explorer.EXE[1952] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01F600A7 .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01F50036 .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01F50F80 .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01F50025 .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01F50014 .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01F50F9B .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01F50FEF .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01F50047 .text C:\WINDOWS\Explorer.EXE[1952] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01F50FC0 .text C:\WINDOWS\Explorer.EXE[1952] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01EF0F95 .text C:\WINDOWS\Explorer.EXE[1952] msvcrt.dll!system 77C293C7 5 Bytes JMP 01EF0FA6 .text C:\WINDOWS\Explorer.EXE[1952] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01EF0FD2 .text C:\WINDOWS\Explorer.EXE[1952] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01EF0000 .text C:\WINDOWS\Explorer.EXE[1952] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01EF0FB7 .text C:\WINDOWS\Explorer.EXE[1952] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01EF0FE3 .text C:\WINDOWS\Explorer.EXE[1952] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01EE0000 .text C:\WINDOWS\Explorer.EXE[1952] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01EE0FEF .text C:\WINDOWS\Explorer.EXE[1952] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01EE0FDE .text C:\WINDOWS\Explorer.EXE[1952] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 01EE0039 .text C:\WINDOWS\Explorer.EXE[1952] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01FC0000

Jcatsmom

Post #10September 17, 2010, 4:49 AM UTC

—- Registry - GMER 1.0.15 —- Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\InprocServer32@ C:\WINDOWS\system32\devenum.dll Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\InprocServer32@ThreadingModel Both Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{01002B17-5D93-4551-81E4-831FEF780A53} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{01002B17-5D93-4551-81E4-831FEF780A53}@FriendlyName WMT MuxDeMux Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{01002B17-5D93-4551-81E4-831FEF780A53}@CLSID {01002B17-5D93-4551-81E4-831FEF780A53} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{01002B17-5D93-4551-81E4-831FEF780A53}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{07167665-5011-11CF-BF33-00AA0055595A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}@FriendlyName Full Screen Renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}@CLSID {07167665-5011-11CF-BF33-00AA0055595A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{0DF28BF3-48C0-45B3-9539-D4AA969CF0EB} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{0DF28BF3-48C0-45B3-9539-D4AA969CF0EB}@FriendlyName WAV Dest Trial Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{0DF28BF3-48C0-45B3-9539-D4AA969CF0EB}@CLSID {0DF28BF3-48C0-45B3-9539-D4AA969CF0EB} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{0DF28BF3-48C0-45B3-9539-D4AA969CF0EB}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42}@FriendlyName DV Muxer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42}@CLSID {129D7E40-C10D-11D0-AFB9-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}@FriendlyName Color Space Converter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}@CLSID {1643E180-90F5-11CE-97D5-00AA0055595A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{187463A0-5BB7-11D3-ACBE-0080C75E246E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{187463A0-5BB7-11D3-ACBE-0080C75E246E}@FriendlyName WM ASF Reader Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{187463A0-5BB7-11D3-ACBE-0080C75E246E}@CLSID {187463A0-5BB7-11D3-ACBE-0080C75E246E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{187463A0-5BB7-11D3-ACBE-0080C75E246E}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1A56451B-1315-4012-861E-8587333DD631} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1A56451B-1315-4012-861E-8587333DD631}@FriendlyName Screen Capture filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1A56451B-1315-4012-861E-8587333DD631}@CLSID {1A56451B-1315-4012-861E-8587333DD631} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1A56451B-1315-4012-861E-8587333DD631}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}@FriendlyName AVI Splitter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}@CLSID {1B544C20-FD0B-11CE-8C63-00AA0044B51E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C}@FriendlyName WMT AudioAnalyzer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C}@CLSID {1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}@FriendlyName VGA 16 Color Ditherer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}@CLSID {1DA08500-9EDC-11CF-BC10-00AA00AC74F6} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}@FriendlyName Indeo? video 5.10 Compression Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}@CLSID {1F73E9B1-8C3A-11D0-A3BE-00A0C9244436} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{22E24591-49D0-11D2-BB50-006008320064} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{22E24591-49D0-11D2-BB50-006008320064}@FriendlyName Windows Media Audio Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{22E24591-49D0-11D2-BB50-006008320064}@CLSID {22E24591-49D0-11D2-BB50-006008320064} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{22E24591-49D0-11D2-BB50-006008320064}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2618EA8E-3396-49A2-A532-84E6EA80C3B0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2618EA8E-3396-49A2-A532-84E6EA80C3B0}@FriendlyName Photo Story 2 Trial Source Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2618EA8E-3396-49A2-A532-84E6EA80C3B0}@CLSID {2618EA8E-3396-49A2-A532-84E6EA80C3B0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2618EA8E-3396-49A2-A532-84E6EA80C3B0}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{280A3020-86CF-11D1-ABE6-00A0C905F375} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{280A3020-86CF-11D1-ABE6-00A0C905F375}@FriendlyName AC3 Parser Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{280A3020-86CF-11D1-ABE6-00A0C905F375}@CLSID {280A3020-86CF-11D1-ABE6-00A0C905F375} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{280A3020-86CF-11D1-ABE6-00A0C905F375}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26}@FriendlyName WMT Format Conversion Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26}@CLSID {2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4}@FriendlyName StreamBufferSink Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4}@CLSID {2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2EA10031-0033-450E-8072-E27D9E768142} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2EA10031-0033-450E-8072-E27D9E768142}@FriendlyName WMT Black Frame Generator Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2EA10031-0033-450E-8072-E27D9E768142}@CLSID {2EA10031-0033-450E-8072-E27D9E768142} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{2EA10031-0033-450E-8072-E27D9E768142}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}@FriendlyName MJPEG Decompressor Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}@CLSID {301056D0-6DFF-11D2-9EEB-006008039E37} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{30355649-0000-0010-8000-00AA00389B71} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{30355649-0000-0010-8000-00AA00389B71}@FriendlyName Indeo? video 5.10 Decompression Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{30355649-0000-0010-8000-00AA00389B71}@CLSID {30355649-0000-0010-8000-00AA00389B71} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{30355649-0000-0010-8000-00AA00389B71}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{31087270-D348-432C-899E-2D2F38FF29A0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{31087270-D348-432C-899E-2D2F38FF29A0}@FriendlyName WMT Screen Capture filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{31087270-D348-432C-899E-2D2F38FF29A0}@CLSID {31087270-D348-432C-899E-2D2F38FF29A0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{31087270-D348-432C-899E-2D2F38FF29A0}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3301A7C4-0A8D-11D4-914D-00C04F610D24} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3301A7C4-0A8D-11D4-914D-00C04F610D24}@FriendlyName Microsoft Screen Video Decompressor Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3301A7C4-0A8D-11D4-914D-00C04F610D24}@CLSID {3301A7C4-0A8D-11D4-914D-00C04F610D24} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3301A7C4-0A8D-11D4-914D-00C04F610D24}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}@FriendlyName MPEG-I Stream Splitter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}@CLSID {336475D0-942A-11CE-A870-00AA002FEAB5} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}@FriendlyName SAMI (CC) Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}@CLSID {33FACFE0-A9BE-11D0-A520-00A0D10129C0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{38BE3000-DBF4-11D0-860E-00A024CFEF6D} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}@FriendlyName MPEG Layer-3 Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}@CLSID {38BE3000-DBF4-11D0-860E-00A024CFEF6D} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{38BE3000-DBF4-11D0-860E-00A024CFEF6D}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375}@FriendlyName MPEG-2 Splitter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375}@CLSID {3AE86B20-7BE8-11D1-ABE6-00A0C905F375} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4009F700-AEBA-11D1-8344-00C04FB92EB7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4009F700-AEBA-11D1-8344-00C04FB92EB7}@FriendlyName ACELP.net Sipro Lab Audio Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4009F700-AEBA-11D1-8344-00C04FB92EB7}@CLSID {4009F700-AEBA-11D1-8344-00C04FB92EB7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4009F700-AEBA-11D1-8344-00C04FB92EB7}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{48025243-2D39-11CE-875D-00608CB78066} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{48025243-2D39-11CE-875D-00608CB78066}@FriendlyName Internal Script Command Renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{48025243-2D39-11CE-875D-00608CB78066}@CLSID {48025243-2D39-11CE-875D-00608CB78066} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{48025243-2D39-11CE-875D-00608CB78066}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}@FriendlyName MPEG Audio Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}@CLSID {4A2286E0-7BEF-11CE-9BD9-0000E202599C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4B428940-263C-11D1-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4B428940-263C-11D1-A520-000000000000}@FriendlyName File Source (Netshow URL) Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4B428940-263C-11D1-A520-000000000000}@CLSID {4B428940-263C-11D1-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4B428940-263C-11D1-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB}@FriendlyName WMT Import Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB}@CLSID {4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}@FriendlyName DV Splitter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}@CLSID {4EB31670-9FC6-11CF-AF6E-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4F3E50BD-A9D7-4721-B0E1-00CB42A0A747} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4F3E50BD-A9D7-4721-B0E1-00CB42A0A747}@FriendlyName Bitmap Generate Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4F3E50BD-A9D7-4721-B0E1-00CB42A0A747}@CLSID {4F3E50BD-A9D7-4721-B0E1-00CB42A0A747} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4F3E50BD-A9D7-4721-B0E1-00CB42A0A747}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4FACBBA1-FFD8-4CD7-8228-61E2F65CB1AE} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4FACBBA1-FFD8-4CD7-8228-61E2F65CB1AE}@FriendlyName Windows Media Video Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4FACBBA1-FFD8-4CD7-8228-61E2F65CB1AE}@CLSID {4FACBBA1-FFD8-4CD7-8228-61E2F65CB1AE} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{4FACBBA1-FFD8-4CD7-8228-61E2F65CB1AE}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}@FriendlyName Video Mixing Renderer 9 Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}@CLSID {51B4ABF3-748F-4E3B-A276-C828330E926A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{521FB373-7654-49F2-BDB1-0C6E6660714F} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{521FB373-7654-49F2-BDB1-0C6E6660714F}@FriendlyName Windows Media Video Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{521FB373-7654-49F2-BDB1-0C6E6660714F}@CLSID {521FB373-7654-49F2-BDB1-0C6E6660714F} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{521FB373-7654-49F2-BDB1-0C6E6660714F}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{586FB486-5560-4FF3-96DF-1118C96AF456} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{586FB486-5560-4FF3-96DF-1118C96AF456}@FriendlyName WMT VIH2 Fix Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{586FB486-5560-4FF3-96DF-1118C96AF456}@CLSID {586FB486-5560-4FF3-96DF-1118C96AF456} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{586FB486-5560-4FF3-96DF-1118C96AF456}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{5B4B05EB-1F63-446B-AAD1-E10A34D650E0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{5B4B05EB-1F63-446B-AAD1-E10A34D650E0}@FriendlyName Record Queue Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{5B4B05EB-1F63-446B-AAD1-E10A34D650E0}@CLSID {5B4B05EB-1F63-446B-AAD1-E10A34D650E0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{5B4B05EB-1F63-446B-AAD1-E10A34D650E0}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{63F8AA94-E2B9-11D0-ADF6-00C04FB66DAD} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{63F8AA94-E2B9-11D0-ADF6-00C04FB66DAD}@FriendlyName Windows Media Multiplexer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{63F8AA94-E2B9-11D0-ADF6-00C04FB66DAD}@CLSID {63F8AA94-E2B9-11D0-ADF6-00C04FB66DAD} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{63F8AA94-E2B9-11D0-ADF6-00C04FB66DAD}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A0-A946-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A0-A946-11D0-A520-000000000000}@FriendlyName ASX file Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A0-A946-11D0-A520-000000000000}@CLSID {640999A0-A946-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A0-A946-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A1-A946-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A1-A946-11D0-A520-000000000000}@FriendlyName ASX v.2 file Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A1-A946-11D0-A520-000000000000}@CLSID {640999A1-A946-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A1-A946-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A2-A946-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A2-A946-11D0-A520-000000000000}@FriendlyName NSC file Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A2-A946-11D0-A520-000000000000}@CLSID {640999A2-A946-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{640999A2-A946-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}@FriendlyName ACM Wrapper Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}@CLSID {6A08CF80-0E18-11CF-A24D-0020AFD79767} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6B6D0800-9ADA-11D0-A520-00A0D10129C0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6B6D0800-9ADA-11D0-A520-00A0D10129C0}@FriendlyName Windows Media source filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6B6D0800-9ADA-11D0-A520-00A0D10129C0}@CLSID {6B6D0800-9ADA-11D0-A520-00A0D10129C0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6B6D0800-9ADA-11D0-A520-00A0D10129C0}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}@FriendlyName Video Renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}@CLSID {6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6C68955E-F965-4249-8E18-F0977B1D2899} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6C68955E-F965-4249-8E18-F0977B1D2899}@FriendlyName Frame Eater Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6C68955E-F965-4249-8E18-F0977B1D2899}@CLSID {6C68955E-F965-4249-8E18-F0977B1D2899} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6C68955E-F965-4249-8E18-F0977B1D2899}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}@FriendlyName MPEG-2 Video Stream Analyzer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}@CLSID {6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6E8D4A20-310C-11D0-B79A-00AA003767A7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6E8D4A20-310C-11D0-B79A-00AA003767A7}@FriendlyName Line 21 Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6E8D4A20-310C-11D0-B79A-00AA003767A7}@CLSID {6E8D4A20-310C-11D0-B79A-00AA003767A7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6E8D4A20-310C-11D0-B79A-00AA003767A7}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}@FriendlyName Video Port Manager Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}@CLSID {6F26A6CD-967B-47FD-874A-7AED2C9D25A2} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70BC06E0-5666-11D3-A184-00105AEF9F33} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70BC06E0-5666-11D3-A184-00105AEF9F33}@FriendlyName WST Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70BC06E0-5666-11D3-A184-00105AEF9F33}@CLSID {70BC06E0-5666-11D3-A184-00105AEF9F33} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70BC06E0-5666-11D3-A184-00105AEF9F33}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}@FriendlyName Video Renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}@CLSID {70E102B0-5556-11CE-97C0-00AA0055595A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7C23220E-55BB-11D3-8B16-00C04FB6BD3D} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7C23220E-55BB-11D3-8B16-00C04FB6BD3D}@FriendlyName WM ASF Writer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7C23220E-55BB-11D3-8B16-00C04FB6BD3D}@CLSID {7C23220E-55BB-11D3-8B16-00C04FB6BD3D} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7C23220E-55BB-11D3-8B16-00C04FB6BD3D}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7F1232EE-44D7-4494-AB8B-CC61B10E21A5} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7F1232EE-44D7-4494-AB8B-CC61B10E21A5}@FriendlyName WMT Sample Information Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7F1232EE-44D7-4494-AB8B-CC61B10E21A5}@CLSID {7F1232EE-44D7-4494-AB8B-CC61B10E21A5} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{7F1232EE-44D7-4494-AB8B-CC61B10E21A5}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A}@FriendlyName VBI Surface Allocator Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A}@CLSID {814B9800-1C88-11D1-BAD9-00609744111A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}@FriendlyName Microsoft MPEG-4 Video Decompressor Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}@CLSID {82CCD3E0-F71A-11D0-9FE5-00609778EA66} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{8596E5F0-0DA5-11D0-BD21-00A0C911CE86} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{8596E5F0-0DA5-11D0-BD21-00A0C911CE86}@FriendlyName File writer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{8596E5F0-0DA5-11D0-BD21-00A0C911CE86}@CLSID {8596E5F0-0DA5-11D0-BD21-00A0C911CE86} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{8596E5F0-0DA5-11D0-BD21-00A0C911CE86}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{92883667-E95C-443D-AC96-4CACA27BEB6E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{92883667-E95C-443D-AC96-4CACA27BEB6E}@FriendlyName WMT Log Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{92883667-E95C-443D-AC96-4CACA27BEB6E}@CLSID {92883667-E95C-443D-AC96-4CACA27BEB6E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{92883667-E95C-443D-AC96-4CACA27BEB6E}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6}@FriendlyName WMT Virtual Renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6}@CLSID {930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48}@FriendlyName DVD Navigator Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48}@CLSID {9B8C4620-2C1A-11D0-8493-00A02438AD48} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A0025E90-E45B-11D1-ABE9-00A0C905F375} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A0025E90-E45B-11D1-ABE9-00A0C905F375}@FriendlyName Overlay Mixer2 Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A0025E90-E45B-11D1-ABE9-00A0C905F375}@CLSID {A0025E90-E45B-11D1-ABE9-00A0C905F375} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A0025E90-E45B-11D1-ABE9-00A0C905F375}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}@FriendlyName AVI Draw Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}@CLSID {A888DF60-1E90-11CF-AC98-00AA004C0FA9} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A98C8400-4181-11D1-A520-00A0D10129C0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A98C8400-4181-11D1-A520-00A0D10129C0}@FriendlyName .RAM file Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A98C8400-4181-11D1-A520-00A0D10129C0}@CLSID {A98C8400-4181-11D1-A520-00A0D10129C0} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{A98C8400-4181-11D1-A520-00A0D10129C0}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AECF5D2E-7A18-4DD2-BDCD-29B6F615B448} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AECF5D2E-7A18-4DD2-BDCD-29B6F615B448}@FriendlyName WMT DirectX Transform Wrapper Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AECF5D2E-7A18-4DD2-BDCD-29B6F615B448}@CLSID {AECF5D2E-7A18-4DD2-BDCD-29B6F615B448} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AECF5D2E-7A18-4DD2-BDCD-29B6F615B448}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AF7D8180-A8F9-11CF-9A46-00AA00B7DAD1} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AF7D8180-A8F9-11CF-9A46-00AA00B7DAD1}@FriendlyName G.711 Codec Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AF7D8180-A8F9-11CF-9A46-00AA00B7DAD1}@CLSID {AF7D8180-A8F9-11CF-9A46-00AA00B7DAD1} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AF7D8180-A8F9-11CF-9A46-00AA00B7DAD1}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AFB6C280-2C41-11D3-8A60-0000F81E0E4A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AFB6C280-2C41-11D3-8A60-0000F81E0E4A}@FriendlyName MPEG-2 Demultiplexer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AFB6C280-2C41-11D3-8A60-0000F81E0E4A}@CLSID {AFB6C280-2C41-11D3-8A60-0000F81E0E4A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{AFB6C280-2C41-11D3-8A60-0000F81E0E4A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}@FriendlyName DV Video Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}@CLSID {B1B77C00-C3E4-11CF-AF79-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}@FriendlyName Indeo? audio software Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}@CLSID {B4CA2970-DD2B-11D0-9DFA-00AA00AF3494} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B6353564-96C4-11D2-8DDB-006097C9A2B2} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B6353564-96C4-11D2-8DDB-006097C9A2B2}@FriendlyName Windows Media Update Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B6353564-96C4-11D2-8DDB-006097C9A2B2}@CLSID {B6353564-96C4-11D2-8DDB-006097C9A2B2} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B6353564-96C4-11D2-8DDB-006097C9A2B2}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F320-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F320-C401-11D0-A520-000000000000}@FriendlyName ASF DIB Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F320-C401-11D0-A520-000000000000}@CLSID {B9D1F320-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F320-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F321-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F321-C401-11D0-A520-000000000000}@FriendlyName ASF ACM Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F321-C401-11D0-A520-000000000000}@CLSID {B9D1F321-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F321-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F322-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F322-C401-11D0-A520-000000000000}@FriendlyName ASF ICM Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F322-C401-11D0-A520-000000000000}@CLSID {B9D1F322-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F322-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F323-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F323-C401-11D0-A520-000000000000}@FriendlyName ASF URL Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F323-C401-11D0-A520-000000000000}@CLSID {B9D1F323-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F323-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F324-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F324-C401-11D0-A520-000000000000}@FriendlyName ASF JPEG Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F324-C401-11D0-A520-000000000000}@CLSID {B9D1F324-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F324-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F325-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F325-C401-11D0-A520-000000000000}@FriendlyName ASF DJPEG Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F325-C401-11D0-A520-000000000000}@CLSID {B9D1F325-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F325-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F32E-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F32E-C401-11D0-A520-000000000000}@FriendlyName ASF embedded stuff Handler Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F32E-C401-11D0-A520-000000000000}@CLSID {B9D1F32E-C401-11D0-A520-000000000000} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{B9D1F32E-C401-11D0-A520-000000000000}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC0D69A8-0923-4EEE-9375-9239F5A38B92} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC0D69A8-0923-4EEE-9375-9239F5A38B92}@FriendlyName 9x8Resize Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC0D69A8-0923-4EEE-9375-9239F5A38B92}@CLSID {BC0D69A8-0923-4EEE-9375-9239F5A38B92} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC0D69A8-0923-4EEE-9375-9239F5A38B92}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC7ACB90-622B-11D2-829D-00C04F8EC183} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC7ACB90-622B-11D2-829D-00C04F8EC183}@FriendlyName WIA Stream Snapshot Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC7ACB90-622B-11D2-829D-00C04F8EC183}@CLSID {BC7ACB90-622B-11D2-829D-00C04F8EC183} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{BC7ACB90-622B-11D2-829D-00C04F8EC183}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C0D076C5-E4C6-4561-8BF4-80DA8DB819D7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C0D076C5-E4C6-4561-8BF4-80DA8DB819D7}@FriendlyName Allocator Fix Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C0D076C5-E4C6-4561-8BF4-80DA8DB819D7}@CLSID {C0D076C5-E4C6-4561-8BF4-80DA8DB819D7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C0D076C5-E4C6-4561-8BF4-80DA8DB819D7}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A0-3F08-11D3-9F0B-006008039E37} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A0-3F08-11D3-9F0B-006008039E37}@FriendlyName SampleGrabber Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A0-3F08-11D3-9F0B-006008039E37}@CLSID {C1F400A0-3F08-11D3-9F0B-006008039E37} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A0-3F08-11D3-9F0B-006008039E37}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37}@FriendlyName Null Renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37}@CLSID {C1F400A4-3F08-11D3-9F0B-006008039E37} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C44C65C7-FDF1-453D-89A5-BCC28F5D69F9} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C44C65C7-FDF1-453D-89A5-BCC28F5D69F9}@FriendlyName WMT Virtual Source Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C44C65C7-FDF1-453D-89A5-BCC28F5D69F9}@CLSID {C44C65C7-FDF1-453D-89A5-BCC28F5D69F9} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C44C65C7-FDF1-453D-89A5-BCC28F5D69F9}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F}@FriendlyName WMT Interlacer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F}@CLSID {C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}@FriendlyName StreamBufferSource Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}@CLSID {C9F5FE02-F851-4EB5-99EE-AD602AF1E619} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CC58E280-8AA1-11D1-B3F1-00AA003761C5} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CC58E280-8AA1-11D1-B3F1-00AA003761C5}@FriendlyName Smart Tee Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CC58E280-8AA1-11D1-B3F1-00AA003761C5}@CLSID {CC58E280-8AA1-11D1-B3F1-00AA003761C5} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CC58E280-8AA1-11D1-B3F1-00AA003761C5}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CD8743A1-3736-11D0-9E69-00C04FD7C15B} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CD8743A1-3736-11D0-9E69-00C04FD7C15B}@FriendlyName Overlay Mixer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CD8743A1-3736-11D0-9E69-00C04FD7C15B}@CLSID {CD8743A1-3736-11D0-9E69-00C04FD7C15B} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CD8743A1-3736-11D0-9E69-00C04FD7C15B}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}@FriendlyName AVI Decompressor Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}@CLSID {CF49D4E0-1115-11CE-B03A-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F20-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F20-77FE-4192-A59F-95CA43BD04BA}@FriendlyName Ulead MPEG Splitter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F20-77FE-4192-A59F-95CA43BD04BA}@CLSID {CF957F20-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F30-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F30-77FE-4192-A59F-95CA43BD04BA}@FriendlyName Ulead MPEG Audio Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F30-77FE-4192-A59F-95CA43BD04BA}@CLSID {CF957F30-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F30-77FE-4192-A59F-95CA43BD04BA}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F40-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F40-77FE-4192-A59F-95CA43BD04BA}@FriendlyName Ulead MPEG Video Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F40-77FE-4192-A59F-95CA43BD04BA}@CLSID {CF957F40-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F40-77FE-4192-A59F-95CA43BD04BA}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F50-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F50-77FE-4192-A59F-95CA43BD04BA}@FriendlyName Ulead MPEG Encoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F50-77FE-4192-A59F-95CA43BD04BA}@CLSID {CF957F50-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F50-77FE-4192-A59F-95CA43BD04BA}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F80-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F80-77FE-4192-A59F-95CA43BD04BA}@FriendlyName Ulead MPEG Muxer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CF957F80-77FE-4192-A59F-95CA43BD04BA}@CLSID {CF957F80-77FE-4192-A59F-95CA43BD04BA} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CFFB1FC7-270D-4986-B299-FECF3F0E42DB} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CFFB1FC7-270D-4986-B299-FECF3F0E42DB}@FriendlyName Uncompressed Domain Shot Detection Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CFFB1FC7-270D-4986-B299-FECF3F0E42DB}@CLSID {CFFB1FC7-270D-4986-B299-FECF3F0E42DB} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{CFFB1FC7-270D-4986-B299-FECF3F0E42DB}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}@FriendlyName AVI/WAV File Source Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}@CLSID {D3588AB0-0781-11CE-B03A-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}@FriendlyName QuickTime Movie Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}@CLSID {D51BD5A0-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}@FriendlyName Wave Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}@CLSID {D51BD5A1-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}@FriendlyName MIDI Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}@CLSID {D51BD5A2-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}@FriendlyName Multi-file Parser Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}@CLSID {D51BD5A3-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}@FriendlyName File stream renderer Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}@CLSID {D51BD5A5-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5AE-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5AE-7548-11CF-A520-0080C77EF58A}@FriendlyName XML Playlist Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5AE-7548-11CF-A520-0080C77EF58A}@CLSID {D51BD5AE-7548-11CF-A520-0080C77EF58A} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{D51BD5AE-7548-11CF-A520-0080C77EF58A}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E2510970-F137-11CE-8B67-00AA00A3F1A6} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E2510970-F137-11CE-8B67-00AA00A3F1A6}@FriendlyName AVI Mux Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E2510970-F137-11CE-8B67-00AA00A3F1A6}@CLSID {E2510970-F137-11CE-8B67-00AA00A3F1A6} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E2510970-F137-11CE-8B67-00AA00A3F1A6}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}@FriendlyName Line 21 Decoder 2 Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}@CLSID {E4206432-01A1-4BEE-B3E1-3702C8EDC574} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}@FriendlyName File Source (Async.) Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}@CLSID {E436EBB5-524F-11CE-9F53-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}@FriendlyName File Source (URL) Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}@CLSID {E436EBB6-524F-11CE-9F53-0020AF0BA770} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E476CBFF-E229-4524-B6B7-228A3129D1C7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E476CBFF-E229-4524-B6B7-228A3129D1C7}@FriendlyName WMT DV Extract Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E476CBFF-E229-4524-B6B7-228A3129D1C7}@CLSID {E476CBFF-E229-4524-B6B7-228A3129D1C7} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{E476CBFF-E229-4524-B6B7-228A3129D1C7}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EF105BC3-C064-45F1-AD53-6D8A8578D01B} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EF105BC3-C064-45F1-AD53-6D8A8578D01B}@FriendlyName WMT Switch Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EF105BC3-C064-45F1-AD53-6D8A8578D01B}@CLSID {EF105BC3-C064-45F1-AD53-6D8A8578D01B} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EF105BC3-C064-45F1-AD53-6D8A8578D01B}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C}@FriendlyName WMT Volume Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C}@CLSID {EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F44BB2D0-F070-463E-9433-B0CCF3CFD627} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F44BB2D0-F070-463E-9433-B0CCF3CFD627}@FriendlyName Stretch Video Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F44BB2D0-F070-463E-9433-B0CCF3CFD627}@CLSID {F44BB2D0-F070-463E-9433-B0CCF3CFD627} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F44BB2D0-F070-463E-9433-B0CCF3CFD627}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F8388A40-D5BB-11D0-BE5A-0080C706568E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F8388A40-D5BB-11D0-BE5A-0080C706568E}@FriendlyName Infinite Pin Tee Filter Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F8388A40-D5BB-11D0-BE5A-0080C706568E}@CLSID {F8388A40-D5BB-11D0-BE5A-0080C706568E} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{F8388A40-D5BB-11D0-BE5A-0080C706568E}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}@FriendlyName QT Decompressor Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}@CLSID {FDFE9681-74A3-11D0-AFA7-00AA00B67A42} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}@FriendlyName MPEG Video Decoder Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}@CLSID {FEB50740-7BEF-11CE-9BD9-0000E202599C} Reg HKLM\SOFTWARE\Classes\CLSID\{31E3FC97-DFA6-BD2D-E982-A7B9DBD87050}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}@FilterData 0x02 0x00 0x00 0x00 … Reg HKLM\SOFTWARE\Classes\CLSID\{77F8D6E9-F0A7-8D50-B905-CAC75B2E221B}\InprocServer32@ C:\WINDOWS\system32\quartz.dll Reg HKLM\SOFTWARE\Classes\CLSID\{77F8D6E9-F0A7-8D50-B905-CAC75B2E221B}\InprocServer32@ThreadingModel Both —- EOF - GMER 1.0.15 —-

mowman

Post #11September 17, 2010, 12:53 PM UTC

You already have Combofix installed on your computer,please delete the copy you have and download a fresh one from the links below.Post the log please.

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

Also please tell me how the computer is running now.

Jcatsmom

Post #12September 17, 2010, 4:27 PM UTC

Hi, Mowman. Combofix ran successfully. I'm including the log. Computer is running well at the moment. No BSOD

in the last few times I've been on the computer. One weirdness: I'm unable to type text into the Whatthetech reply box when using Firefox. As that normal? Thanks! -Jcatsmom

ComboFix 10-09-16.07 - Dee 09/17/2010 11:07:16.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1664 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AT&T; Internet Security Suite AT&T; Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: AT&T; Internet Security Suite AT&T; Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Dee\My Documents\regis bkup1.reg

.
((((((((((((((((((((((((( Files Created from 2010-08-17 to 2010-09-17 )))))))))))))))))))))))))))))))
.

2010-09-15 18:55 . 2010-09-15 18:55 ——– d—–w- C:\_OTL
2010-09-12 21:17 . 2010-09-12 21:17 444 —-a-w- c:\windows\system32\d3d8caps.dat
2010-09-04 04:42 . 2010-09-04 04:42 ——– d—–w- c:\program files\Common Files\Java
2010-09-04 04:40 . 2010-09-04 04:40 79488 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\jre1.6.0_21\gtapi.dll
2010-09-04 04:40 . 2010-09-04 04:40 152576 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\jre1.6.0_21\lzma.dll
2010-09-03 18:51 . 2010-09-03 18:51 ——– d—–w- c:\program files\Eusing Free Registry Cleaner
2010-09-03 02:14 . 2010-09-03 02:14 ——– d—–w- c:\windows\system32\scripting
2010-09-03 02:14 . 2010-09-03 02:14 ——– d—–w- c:\windows\system32\en
2010-09-03 02:14 . 2010-09-03 02:14 ——– d—–w- c:\windows\system32\bits
2010-09-03 02:14 . 2010-09-03 02:14 ——– d—–w- c:\windows\l2schemas
2010-09-03 02:06 . 2010-09-03 02:06 ——– d—–w- c:\windows\EHome
2010-09-03 01:51 . 2010-09-03 23:24 ——– d—–w- c:\windows\ie8updates
2010-09-02 23:23 . 2010-09-02 23:23 503808 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1e937b63-n\msvcp71.dll
2010-09-02 23:23 . 2010-09-02 23:23 499712 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1e937b63-n\jmc.dll
2010-09-02 23:23 . 2010-09-02 23:23 348160 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1e937b63-n\msvcr71.dll
2010-09-02 23:23 . 2010-09-02 23:23 61440 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5eec6c57-n\decora-sse.dll
2010-09-02 23:23 . 2010-09-02 23:23 12800 —-a-w- c:\documents and settings\Dee\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5eec6c57-n\decora-d3d.dll
2010-09-02 23:22 . 2010-09-04 04:41 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-08-31 03:11 . 2010-08-31 03:11 388096 —-a-r- c:\documents and settings\Dee\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-30 13:05 . 2010-08-30 13:05 ——– d—–w- c:\program files\Trend Micro
2010-08-30 12:24 . 2010-08-30 12:24 ——– d—–w- c:\program files\HD Tune
2010-08-30 12:21 . 2010-06-24 12:22 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-08-30 12:21 . 2010-06-24 12:21 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2010-08-30 12:21 . 2010-06-24 12:21 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-08-30 04:12 . 2010-08-30 04:12 ——– d—–w- C:\found.001
2010-08-30 02:22 . 2010-08-30 02:22 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2010-08-30 02:21 . 2010-08-30 02:21 ——– d-sh–w- c:\documents and settings\Dee\PrivacIE
2010-08-29 15:48 . 2010-08-29 15:48 ——– d-sh–w- c:\documents and settings\Guest\IECompatCache
2010-08-29 15:47 . 2010-08-29 15:47 ——– d-sh–w- c:\documents and settings\Guest\PrivacIE
2010-08-29 03:02 . 2010-08-29 03:02 ——– d-sh–w- c:\documents and settings\Dee\IECompatCache
2010-08-29 02:54 . 2010-08-29 02:54 ——– d-sh–w- c:\documents and settings\Dee\IETldCache
2010-08-29 02:48 . 2010-08-29 02:48 ——– d-sh–w- c:\documents and settings\Guest\IETldCache
2010-08-29 02:33 . 2010-08-29 02:35 ——– dc-h–w- c:\windows\ie8
2010-08-28 17:41 . 2010-08-28 17:41 ——– d—–w- c:\documents and settings\Dee\Application Data\Malwarebytes
2010-08-28 17:41 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-28 17:41 . 2010-08-28 17:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-28 17:41 . 2010-08-28 17:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-28 17:41 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-16 01:35 . 2010-07-28 23:16 452104 —-a-w- c:\documents and settings\Dee\Application Data\Real\Update\setup3.12\setup.exe
2010-09-12 13:48 . 2010-01-08 14:46 ——– d—–w- c:\program files\McAfee
2010-09-06 21:57 . 2005-05-08 18:17 58080 -c–a-w- c:\documents and settings\Dee\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-03 16:15 . 2009-11-24 00:21 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2010-09-03 02:16 . 2004-08-10 18:13 77423 —-a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-09-03 01:55 . 2009-03-20 15:12 ——– d—–w- c:\program files\Microsoft Silverlight
2010-08-17 13:17 . 2004-08-04 10:00 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-05 16:24 . 2010-07-25 19:58 ——– d—–w- c:\program files\Advanced Registry Optimizer
2010-08-04 17:01 . 2010-08-04 17:01 ——– d—–w- c:\documents and settings\Guest\Application Data\Sammsoft
2010-08-03 18:26 . 2010-08-03 18:26 ——– d—–w- c:\documents and settings\Dee\Application Data\Sammsoft
2010-07-24 15:53 . 2008-04-22 13:48 ——– d—–w- c:\program files\Creative
2010-07-24 15:53 . 2005-04-14 04:55 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-24 15:49 . 2005-04-27 22:23 ——– d—–w- c:\program files\V5385 Digital Camera
2010-07-24 15:46 . 2009-03-06 18:44 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-07-24 15:46 . 2009-03-06 18:44 ——– d—–w- c:\program files\NOS
2010-07-24 15:46 . 2008-12-28 20:16 ——– d—–w- c:\program files\Coupons
2010-07-24 15:44 . 2005-04-14 04:55 ——– d—–w- c:\program files\Common Files\InstallShield
2010-07-24 15:42 . 2005-06-05 01:07 ——– d—–w- c:\documents and settings\Dee\Application Data\Ulead Systems
2010-07-24 15:40 . 2005-04-14 05:04 ——– d—–w- c:\program files\Common Files\Intuit
2010-07-24 15:35 . 2005-04-14 04:53 ——– d—–w- c:\program files\Java
2010-07-24 15:15 . 2006-04-12 23:59 ——– d—–w- c:\program files\Dell
2010-07-24 15:08 . 2008-04-22 14:01 ——– d—–w- c:\program files\Audible
2010-07-22 15:49 . 2004-08-04 10:00 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-04-17 14:56 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-15 20:18 . 2010-01-08 14:49 120136 —-a-w- c:\windows\system32\drivers\Mpfp.sys
2010-07-02 14:03 . 2010-03-15 02:55 439816 —-a-w- c:\documents and settings\Dee\Application Data\Real\Update\setup3.10\setup.exe
2010-06-30 12:31 . 2004-08-04 10:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2004-08-04 10:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 10:00 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 10:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2008-07-24 19:21 . 2008-07-24 19:20 10420936 -c–a-w- c:\program files\xlviewer.exe
2008-01-10 19:50 . 2005-04-27 21:44 848 –sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-23 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-30 417792]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk]
backup=c:\windows\pss\ymetray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-12 04:16 39792 -c–a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 16:09 460784 —-a-w- c:\program files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HelpCenter4.1]
2007-04-13 01:59 198184 -c–a-w- c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 21:24 54840 —-a-w- c:\program files\HP1610\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hplampc]
2002-01-17 15:40 40448 —-a-w- c:\windows\SYSTEM32\hplampc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 15:32 77824 —-a-w- c:\windows\SYSTEM32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 15:36 114688 —-a-w- c:\windows\SYSTEM32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-09-20 15:35 94208 —-a-w- c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-30 14:16 417792 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2004-10-14 19:42 1404928 -c–a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-08-23 17:23 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
2003-11-18 22:20 45056 -c—-w- c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-04 00:20 866584 —-a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [5/11/2010 3:04 PM 203280]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 hp4200c;%usbscan.SvcDesc%;c:\windows\SYSTEM32\DRIVERS\hp4200c.sys [8/23/2005 10:43 AM 9312]
S3 SAUSBHW;%SAUSBHW.SvcDesc%;c:\windows\system32\Drivers\sausb.sys –> c:\windows\system32\Drivers\sausb.sys [?]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\windows\SYSTEM32\DRIVERS\rt2500usb.sys [8/3/2005 11:01 AM 79616]
.
Contents of the 'Scheduled Tasks' folder

2005-04-18 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\system32\OOBE\OOBEBALN.EXE [2004-08-04 00:12]

2010-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-05-11 17:22]

2010-05-11 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-05-11 17:22]

2010-09-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/mywaybiz
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: kaspersky.com\www
FF - ProfilePath - c:\documents and settings\Dee\Application Data\Mozilla\Firefox\Profiles\psq040np.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true);user_pref(general.useragent.extra.zencast, c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Lgirovaruyuq - c:\windows\unoravucuya.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-17 11:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-09-17 11:16:55
ComboFix-quarantined-files.txt 2010-09-17 16:16

Pre-Run: 62,686,556,160 bytes free
Post-Run: 62,644,072,448 bytes free

- - End Of File - - A53CE0B1DD2C8A38CE4097C3E57C151A

mowman

Post #13September 18, 2010, 1:07 AM UTC

Try refreshing the page a couple of times in Firefox if you are unable to type text into the Whatthetech reply box

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Another update on how your computer is running also please.

Jcatsmom

Post #14September 18, 2010, 3:17 AM UTC

Mowman, we are in good shape.

Both scans came back clean. You did not indicate whether to have ESET scan archives or not, so I ran it a second time with archives checked. I like ESET better than Kaspersky Online Scanner because it loads and scans so much quicker. I hope that it is as effective. I need to get spyware blaster or something like that onto this computer to help prevent another infection. McAfee doesn't seem to be adequate.-Jcatsmom

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4641

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/17/2010 8:40:10 PM
mbam-log-2010-09-17 (20-40-10).txt
Scan type: Quick scan
Objects scanned: 155101
Time elapsed: 13 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=56c75a541c37bb48a71dba061904d005
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-09-18 02:26:25
# local_time=2010-09-17 09:26:25 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 680053 680053 0 0
# compatibility_mode=5121 16776869 100 96 3872547 36780311 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=55438
# found=0
# cleaned=0
# scan_time=1601
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=56c75a541c37bb48a71dba061904d005
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-09-18 03:04:46
# local_time=2010-09-17 10:04:46 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 681918 681918 0 0
# compatibility_mode=5121 16776869 100 96 3874412 36782176 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0

mowman

Post #15September 19, 2010, 4:44 PM UTC

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

SecCenter::
AV: AT&T Internet Security Suite AT&T Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: AT&T Internet Security Suite AT&T Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

✨ Ask AI

Ask AI