[Closed] Vundo - It just won't go!

Vundo is bugging me and kept coming back. I tried using SuperAntiSpyware (free) and it found and removed them (normal and safe mode), but when I restart it appeared again. Firefox won't open when I click on it either. Vundofix found nothing. Malicious Malware found vundo and removed it, but it came back after restart. Both scans were done in safe mode. Combofix does not fun when I ran it - i.e. double click then nothing. Please see below HJT log. I would be very grateful if anyone could help me to remove this once and for all! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:19:50, on 02/07/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe G:\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Kerio\Personal Firewall\persfw.exe C:\Program Files\O2\bin\sprtsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\Explorer.EXE G:\Eset\nod32kui.exe C:\DOCUME~1\moshe\LOCALS~1\Temp\Rar$EX00.843\Firefox Ultimate Optimizer.exe G:\SSC Service Utility\ssc_serv.exe C:\WINDOWS\system32\1042e.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe G:\uTorrent\utorrent.exe C:\WINDOWS\system32\1042e.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\system32\spywarewarning.mht R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = »go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = »go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = »go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = »go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = »www.hotmail.msn.com/cgi-bin/sbox···on=inbox R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: {0a32d3c3-3722-69e9-bb44-d1b867f9e720} - {027e9f76-8b1d-44bb-9e96-22733c3d23a0} - C:\WINDOWS\system32\hxvzys.dll O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\SPYBOT~1\SDHelper.dll (file missing) O2 - BHO: (no name) - {5878308E-5803-49B3-9F20-950A77AEED0D} - C:\WINDOWS\system32\geBsqQJa.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {96F48ED7-7A34-4CE5-BAF7-937DF7810657} - C:\WINDOWS\system32\vtUkjGWo.dll (file missing) O2 - BHO: (no name) - {AD28FA74-4647-44BE-BFF2-F7951705BFF6} - C:\WINDOWS\system32\pmnkLDst.dll (file missing) O2 - BHO: (no name) - {D059FE50-A7C7-4DCD-9C2B-62AE85E991B4} - C:\WINDOWS\system32\mlJBULbb.dll (file missing) O2 - BHO: (no name) - {E7AA34CF-F04D-4605-8B47-AB33C7D03293} - C:\WINDOWS\system32\vtUkiHxX.dll O2 - BHO: (no name) - {F66F8B1D-9C39-4D58-A7D6-D463B8BA9253} - C:\WINDOWS\system32\efcdEwWP.dll (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [nod32kui] "G:\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [winsock32] C:\WINDOWS\system32:winsock32.exe O4 - HKLM\..\Run: [FirefoxUltimateOptimizer] "C:\DOCUME~1\moshe\LOCALS~1\Temp\Rar$EX00.843\Firefox Ultimate Optimizer.exe" O4 - HKLM\..\Run: [SSC Service Utility] G:\SSC Service Utility\ssc_serv.exe /s O4 - HKLM\..\Run: [IEUpdate] C:\WINDOWS\system32\1042e.exe O4 - HKLM\..\Run: [94041dbf] rundll32.exe "C:\WINDOWS\system32\ncakmsbi.dll",b O4 - HKLM\..\Run: [BM97372e23] Rundll32.exe "C:\WINDOWS\system32\xbbjhgpk.dll",s O4 - HKLM\..\RunServices: [IEUpdate] C:\WINDOWS\system32\1042e.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe O4 - HKCU\..\Run: [uTorrent] "G:\uTorrent\utorrent.exe" O4 - HKCU\..\Run: [IEUpdate] C:\WINDOWS\system32\1042e.exe O4 - HKCU\..\RunServices: [IEUpdate] C:\WINDOWS\system32\1042e.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1275210071-1788223648-682003330-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-1275210071-1788223648-682003330-1008\..\Run: [IEUpdate] C:\WINDOWS\system32\1042e.exe (User '?') O4 - HKUS\S-1-5-21-1275210071-1788223648-682003330-1008\..\RunServices: [IEUpdate] C:\WINDOWS\system32\1042e.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User '?') O4 - HKUS\S-1-5-18\..\RunServices: [IEUpdate] C:\WINDOWS\system32\1042e.exe (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunServices: [IEUpdate] C:\WINDOWS\system32\1042e.exe (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: PowerWord - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll (file missing) O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\Tencent\QQ\QQ.EXE (file missing) O9 - Extra 'Tools' menuitem: ÌÚѶQQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\Tencent\QQ\QQ.EXE (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - »messenger.zone.msn.com/binary/ms···1267.cab O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - »zone.msn.com/binFrameWork/v10/St···5579.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - »messenger.zone.msn.com/binary/Mi···1267.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - »zone.msn.com/BinFrameWork/v10/ZB···5579.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - »zone.msn.com/binframework/v10/ZP···5579.cab O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - »messenger.zone.msn.com/binary/So···6986.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - »cdn.scan.onecare.live.com/resour···9563.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - »messenger.zone.msn.com/binary/Me···1267.cab O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - »zone.msn.com/bingame/zpagames/zp···0231.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - »cdn2.zone.msn.com/binFramework/v···6649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - »messenger.zone.msn.com/binary/Me···6907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - »fpdownload2.macromedia.com/get/s···lash.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - »https://signin3.valueactive.com/Register···shax.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - »zone.msn.com/binframework/v10/St···5579.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - »messenger.zone.msn.com/binary/Mi···6986.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: O20 - Winlogon Notify: awtuuUoM - C:\WINDOWS\SYSTEM32\awtuuUoM.dll O20 - Winlogon Notify: ljJYRLCT - ljJYRLCT.dll (file missing) O20 - Winlogon Notify: mlJYonlK - mlJYonlK.dll (file missing) O20 - Winlogon Notify: tuvTklLD - tuvTklLD.dll (file missing) O20 - Winlogon Notify: xxyxYolM - xxyxYolM.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - G:\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing) O23 - Service: Agnitum Update Service (aus) - Unknown owner - G:\Agnitum\OUTPOS~1\COMMAN~1\aus.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.476.exe (file missing) O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - G:\Spyware Doctor\pctsAuxs.exe (file missing) O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - G:\Spyware Doctor\pctsSvc.exe (file missing) O23 - Service: SupportSoft Sprocket Service (O2) (sprtsvc_O2) - SupportSoft, Inc. - C:\Program Files\O2\bin\sprtsvc.exe O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - G:\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing) – End of file - 10855 bytes

Thanks. Here's the log

Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

000 General info
—————-
Computer name : MOSHECOMPUTER
Creation time : 03/07/2008 16:48:23
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 7.0.5730.11
OS : Microsoft Windows XP
OS Build : 2600
OS SP : Service Pack 2
RunScanner Version : 1.6.3.0
User Language : English (United States)
User rights : Administrator
Windows folder : C:\WINDOWS

001 Running processes
———————
c:\windows\system32\alg.exe (Microsoft Corporation)
g:\bandwidth monitor\bandmon.exe (Rokario Software)
c:\windows\system32\csrss.exe (Microsoft Corporation)
c:\windows\system32\csrss.exe (Microsoft Corporation)
c:\windows\system32\ctfmon.exe (Microsoft Corporation)
c:\windows\system32\ctfmon.exe (Microsoft Corporation)
c:\docume~1\moshe\locals~1\temp\rar$ex00.843\firefox ultimate optimizer.exe (felipEx [http://felipex.net])
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\program files\kerio\personal firewall\persfw.exe (Kerio Technologies)
g:\lclock\lclock.exe
c:\windows\system32\lsass.exe (Microsoft Corporation)
* c:\program files\nero\nero8\nero backitup\nbservice.exe (Nero AG)
g:\eset\nod32kui.exe (Eset)
g:\eset\nod32kui.exe (Eset)
g:\eset\nod32krn.exe (Eset)
c:\windows\system32\nvsvc32.exe (NVIDIA Corporation)
c:\windows\system32\rundll32.exe (Microsoft Corporation)
c:\windows\system32\rundll32.exe (Microsoft Corporation)
c:\windows\system32\rundll32.exe (Microsoft Corporation)
c:\windows\system32\rundll32.exe (Microsoft Corporation)
* c:\documents and settings\hexiang\desktop\runscanner.exe (Runscanner.net)
c:\windows\system32\services.exe (Microsoft Corporation)
c:\windows\system32\spoolsv.exe (Microsoft Corporation)
c:\program files\microsoft sql server\mssql\binn\sqlservr.exe (Microsoft Corporation)
g:\ssc service utility\ssc_serv.exe (SSC Localization Group)
g:\ssc service utility\ssc_serv.exe (SSC Localization Group)
g:\superantispyware\superantispyware.exe (SUPERAntiSpyware.com)
* c:\program files\o2\bin\sprtsvc.exe (SupportSoft, Inc.)
* g:\utorrent\utorrent.exe
c:\windows\explorer.exe (Microsoft Corporation)
c:\windows\explorer.exe (Microsoft Corporation)
c:\windows\system32\winlogon.exe (Microsoft Corporation)
c:\windows\system32\winlogon.exe (Microsoft Corporation)
c:\windows\system32\smss.exe (Microsoft Corporation)

002 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys)
—————————————————————–
c:\windows\system32\melarjts.dll
c:\windows\system32\xbbjhgpk.dll
c:\docume~1\moshe\locals~1\temp\rar$ex00.843\firefox ultimate optimizer.exe (felipEx [http://felipex.net])
g:\eset\nod32kui.exe (Eset)
c:\windows\system32\nvcpl.dll (NVIDIA Corporation)
g:\ssc service utility\ssc_serv.exe (SSC Localization Group)

003 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys)
—————————————————————–
c:\windows\system32\ctfmon.exe (Microsoft Corporation)
- c:\windows\system32\1042e.exe
- c:\program files\lclock\lclock.exe
* g:\utorrent\utorrent.exe

008 Default user \Software\Microsoft\Windows\CurrentVersion\Run (+subkeys)
————————————————————————–
c:\windows\system32\ctfmon.exe (Microsoft Corporation)
- c:\windows\system32\1042e.exe

009 System user\Software\Microsoft\Windows\CurrentVersion\Run (+subkeys)
————————————————————————
c:\windows\system32\ctfmon.exe (Microsoft Corporation)
- c:\windows\system32\1042e.exe

010 HKLM\SYSTEM\CurrentControlSet\Services (Services)
—————————————————–
- g:\lavasoft\ad-aware 2007\aawservice.exe (Ad-Aware 2007 Service)
- g:\agnitum\outpos~1\comman~1\aus.exe (Agnitum Update Service)
C:\WINDOWS\system32\alg.exe (Application Layer Gateway Service)
C:\WINDOWS\system32\svchost.exe (Application Management)
C:\WINDOWS\system32\svchost.exe (Background Intelligent Transfer Service)
c:\windows\system32\svchost.exe (COM+ Event System)
c:\windows\system32\dllhost.exe (COM+ System Application)
C:\WINDOWS\system32\svchost.exe (Computer Browser)
C:\WINDOWS\system32\svchost.exe (Cryptographic Services)
C:\WINDOWS\system32\svchost.exe (DCOM Server Process Launcher)
C:\WINDOWS\system32\svchost.exe (DHCP Client)
c:\windows\system32\msdtc.exe (Distributed Transaction Coordinator)
C:\WINDOWS\system32\svchost.exe (DNS Client)
C:\WINDOWS\system32\services.exe (Event Log)
C:\WINDOWS\system32\svchost.exe (Fast User Switching Compatibility)
C:\WINDOWS\system32\svchost.exe (Help and Support)
C:\WINDOWS\system32\svchost.exe (HTTP SSL)
C:\WINDOWS\system32\svchost.exe (Human Interface Device Access)
c:\windows\system32\imapi.exe (IMAPI CD-Burning COM Service)
c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe (InstallDriver Table Manager)
C:\WINDOWS\system32\lsass.exe (IPSEC Services)
C:\WINDOWS\system32\svchost.exe (IPv6 Helper Service)
c:\program files\kerio\personal firewall\persfw.exe (Kerio Personal Firewall)
C:\WINDOWS\system32\svchost.exe (Logical Disk Manager)
C:\WINDOWS\system32\dmadmin.exe (Logical Disk Manager Administrative Service)
c:\program files\microsoft sql server\mssql\binn\sqlservr.exe (MSSQLSERVER)
c:\program files\microsoft sql server\80\tools\binn\sqladhlp.exe (MSSQLServerADHelper)
* c:\program files\nero\nero8\nero backitup\nbservice.exe (Nero BackItUp Scheduler 3)
C:\WINDOWS\system32\lsass.exe (Net Logon)
c:\windows\system32\mnmsrvc.exe (NetMeeting Remote Desktop Sharing)
C:\WINDOWS\system32\svchost.exe (Network Location Awareness (NLA))
* c:\program files\common files\nero\lib\nmindexingservice.exe (NMIndexingService)
g:\eset\nod32krn.exe (NOD32 Kernel Service)
C:\WINDOWS\system32\lsass.exe (NT LM Security Support Provider)
C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Display Driver Service)
- g:\spyware doctor\pctsauxs.exe (PC Tools Auxiliary Service)
- g:\spyware doctor\pctssvc.exe (PC Tools Security Service)
C:\WINDOWS\system32\services.exe (Plug and Play)
C:\WINDOWS\system32\spoolsv.exe (Print Spooler)
C:\WINDOWS\system32\svchost.exe (Remote Access Auto Connection Manager)
C:\WINDOWS\system32\svchost.exe (Remote Access Connection Manager)
C:\WINDOWS\system32\svchost.exe (Remote Procedure Call (RPC))
C:\WINDOWS\system32\locator.exe (Remote Procedure Call (RPC) Locator)
C:\WINDOWS\system32\svchost.exe (Removable Storage)
C:\WINDOWS\system32\lsass.exe (Security Accounts Manager)
C:\WINDOWS\system32\svchost.exe (Security Center)
C:\WINDOWS\system32\svchost.exe (Server)
C:\WINDOWS\system32\svchost.exe (SSDP Discovery Service)
* c:\program files\common files\supportsoft\bin\ssrc.exe (SupportSoft RemoteAssist)
* c:\program files\o2\bin\sprtsvc.exe (SupportSoft Sprocket Service (O2))
C:\WINDOWS\system32\svchost.exe (System Event Notification)
C:\WINDOWS\system32\svchost.exe (System Restore Service)
C:\WINDOWS\system32\svchost.exe (TCP/IP NetBIOS Helper)
C:\WINDOWS\system32\svchost.exe (Telephony)
C:\WINDOWS\system32\svchost.exe (Terminal Services)
C:\WINDOWS\system32\svchost.exe (Themes)
- g:\tuneup utilities 2006\winstylerthemesvc.exe (TuneUp WinStyler Theme Service)
C:\WINDOWS\system32\ups.exe (Uninterruptible Power Supply)
C:\WINDOWS\system32\svchost.exe (Universal Plug and Play Device Host)
C:\WINDOWS\system32\svchost.exe (Windows Audio)
C:\WINDOWS\system32\svchost.exe (Windows Firewall/Internet Connection Sharing (ICS))
C:\WINDOWS\system32\svchost.exe (Windows Image Acquisition (WIA))
c:\windows\system32\msiexec.exe (Windows Installer)
C:\WINDOWS\system32\svchost.exe (Windows Time)
C:\WINDOWS\system32\svchost.exe (Workstation)

011 HKLM\SYSTEM\CurrentControlSet\Services (drivers)
—————————————————-
- c:\windows\system32\drivers\a2onij29.sys (a2onij29)
c:\windows\system32\drivers\afd.sys (AFD Networking Support Environment)
* c:\windows\system32\drivers\amon.sys (AMON)
C:\WINDOWS\system32\drivers\atmarpc.sys (ATM ARP Client Protocol)
C:\WINDOWS\system32\drivers\audstub.sys (Audio Stub Driver)
C:\WINDOWS\system32\drivers\hsf_bsc2.sys (basic2)
C:\WINDOWS\system32\drivers\streamip.sys (BDA IPSink)
C:\WINDOWS\system32\drivers\slip.sys (BDA Slip De-Framer)
- g:\softwin\bitdefender10\bdfdll.sys (bdfdll)
c:\windows\system32\drivers\beep.sys (Beep)
C:\WINDOWS\system32\drivers\tosrfsnd.sys (Bluetooth Audio Device (WDM) from TOSHIBA)
C:\WINDOWS\system32\drivers\blueletaudio.sys (Bluetooth Audio Service)
C:\WINDOWS\system32\drivers\vbtenum.sys (Bluetooth HID Enumerator)
C:\WINDOWS\system32\drivers\bthidmgr.sys (Bluetooth HID Manager Service)
C:\WINDOWS\system32\drivers\btnetdrv.sys (Bluetooth PAN Network Adapter)
C:\WINDOWS\system32\drivers\tosrfnds.sys (Bluetooth Personal Area Network from TOSHIBA)
C:\WINDOWS\system32\drivers\tosporte.sys (Bluetooth Port Driver from Toshiba)
C:\WINDOWS\system32\drivers\tosrfbnp.sys (Bluetooth RFBNEP from TOSHIBA)
C:\WINDOWS\system32\drivers\tosrfbd.sys (Bluetooth RFBUS from TOSHIBA)
C:\WINDOWS\system32\drivers\tosrfcom.sys (Bluetooth RFCOMM from TOSHIBA)
C:\WINDOWS\system32\drivers\tosrfhid.sys (Bluetooth RFHID from TOSHIBA)
- c:\windows\system32\drivers\blueletscoaudio.sys (Bluetooth SCO Audio Service)
C:\WINDOWS\system32\drivers\tosrfusb.sys (Bluetooth USB Controller)
C:\WINDOWS\system32\drivers\btcusb.sys (Bluetooth USB For Bluetooth Service)
C:\WINDOWS\system32\drivers\vcommmgr.sys (Bluetooth VComm Manager Service)
c:\windows\system32\drivers\cdaudio.sys (Cdaudio)
C:\WINDOWS\system32\drivers\imapi.sys (CD-Burning Filter Driver)
C:\WINDOWS\system32\drivers\cdrom.sys (CD-ROM Driver)
- c:\windows\system32\drivers\changer.sys (Changer)
C:\WINDOWS\system32\drivers\ccdecode.sys (Closed Caption Decoder)
C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative OS Services Driver)
C:\WINDOWS\system32\drivers\p16x.sys (Creative SB Live! Series (WDM))
C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative SoundFont Management Device Driver)
C:\WINDOWS\system32\drivers\redbook.sys (Digital CD Audio Playback Filter Driver)
C:\WINDOWS\system32\drivers\raspti.sys (Direct Parallel)
C:\WINDOWS\system32\drivers\ptilink.sys (Direct Parallel Link Driver)
C:\WINDOWS\system32\drivers\disk.sys (Disk Driver)
C:\WINDOWS\system32\drivers\dmload.sys (dmload)
C:\WINDOWS\system32\drivers\hsf_fall.sys (Fallback)
- c:\windows\system32\drivers\ikfilesec.sys (File Security Driver)
c:\windows\system32\drivers\fips.sys (Fips)
C:\WINDOWS\system32\drivers\fdc.sys (Floppy Disk Controller Driver)
C:\WINDOWS\system32\drivers\flpydisk.sys (Floppy Disk Driver)
C:\WINDOWS\system32\drivers\hsf_fsks.sys (Fsks)
C:\WINDOWS\system32\drivers\gameenum.sys (Game Port Enumerator)
C:\WINDOWS\system32\drivers\msgpc.sys (Generic Packet Classifier)
c:\windows\system32\giveio.sys (giveio)
c:\windows\system32\drivers\gvcpldrv.sys (GVCplDrv)
* C:\WINDOWS\system32\drivers\hamachi.sys (Hamachi Network Interface)
C:\WINDOWS\system32\drivers\sfloppy.sys (High-Capacity Floppy Disk Drive)
C:\WINDOWS\system32\drivers\hsfdpsp2.sys (HSF_DP)
C:\WINDOWS\system32\drivers\hsf_msft.sys (hsf_msft)
C:\WINDOWS\system32\drivers\hsfbs2s2.sys (HSFHWBS2)
C:\WINDOWS\system32\drivers\http.sys (HTTP)
- c:\windows\system32\drivers\i2omgmt.sys (i2omgmt)
C:\WINDOWS\system32\drivers\i8042prt.sys (i8042 Keyboard and PS/2 Mouse Port Driver)
C:\WINDOWS\system32\drivers\agp440.sys (Intel AGP Bus Filter)
C:\WINDOWS\system32\drivers\intelppm.sys (Intel Processor Driver)
C:\WINDOWS\system32\drivers\e100b325.sys (Intel® PRO Adapter Driver)
C:\WINDOWS\system32\drivers\intelide.sys (IntelIde)
C:\WINDOWS\system32\drivers\ipinip.sys (IP in IP Tunnel Driver)
C:\WINDOWS\system32\drivers\ipnat.sys (IP Network Address Translator)
C:\WINDOWS\system32\drivers\ipfltdrv.sys (IP Traffic Filter Driver)
C:\WINDOWS\system32\drivers\ipsec.sys (IPSEC driver)
C:\WINDOWS\system32\drivers\ip6fw.sys (IPv6 Windows Firewall Driver)
C:\WINDOWS\system32\drivers\nwlnkflt.sys (IPX Traffic Filter Driver)
C:\WINDOWS\system32\drivers\nwlnkfwd.sys (IPX Traffic Forwarder Driver)
C:\WINDOWS\system32\drivers\irenum.sys (IR Enumerator Service)
C:\WINDOWS\system32\drivers\fwdrv.sys (Kerio Personal Firewall Driver)
C:\WINDOWS\system32\drivers\kvpndrv.sys (Kerio VPN adapter)
- c:\windows\system32\drivers\kwflower.sys (Kerio WinRoute Firewall Driver - Lower Layer)
C:\WINDOWS\system32\drivers\kbdclass.sys (Keyboard Class Driver)
C:\WINDOWS\system32\drivers\kbdhid.sys (Keyboard HID Driver)
c:\windows\system32\drivers\ksecdd.sys (KSecDD)
- c:\windows\system32\drivers\lbrtfdc.sys (lbrtfdc)
C:\WINDOWS\system32\drivers\dmio.sys (Logical Disk Manager Driver)
C:\WINDOWS\system32\drivers\wmbenum.sys (Logitech Virtual Bus Enumerator Driver)
C:\WINDOWS\system32\drivers\wmvirhid.sys (Logitech Virtual Hid Device Driver)
C:\WINDOWS\system32\drivers\wmfilter.sys (Logitech WingMan HID Filter Driver)
C:\WINDOWS\system32\drivers\wmxlcore.sys (Logitech WingMan Translation Layer Driver)
C:\WINDOWS\system32\drivers\mdmxsdk.sys (mdmxsdk)
C:\WINDOWS\system32\drivers\update.sys (Microcode Update Driver)
C:\WINDOWS\system32\drivers\acpi.sys (Microsoft ACPI Driver)
C:\WINDOWS\system32\drivers\hidusb.sys (Microsoft HID Class Driver)
C:\WINDOWS\system32\drivers\aec.sys (Microsoft Kernel Acoustic Echo Canceller)
C:\WINDOWS\system32\drivers\dmusic.sys (Microsoft Kernel DLS Syntheiszer)
C:\WINDOWS\system32\drivers\drmkaud.sys (Microsoft Kernel DRM Audio Descrambler)
C:\WINDOWS\system32\drivers\swmidi.sys (Microsoft Kernel GS Wavetable Synthesizer)
C:\WINDOWS\system32\drivers\sysaudio.sys (Microsoft Kernel System Audio Device)
C:\WINDOWS\system32\drivers\rootmdm.sys (Microsoft Legacy Modem Driver)
C:\WINDOWS\system32\drivers\mspclock.sys (Microsoft Streaming Clock Proxy)
C:\WINDOWS\system32\drivers\mspqm.sys (Microsoft Streaming Quality Manager Proxy)
C:\WINDOWS\system32\drivers\mskssrv.sys (Microsoft Streaming Service Proxy)
C:\WINDOWS\system32\drivers\mstee.sys (Microsoft Streaming Tee/Sink-to-Sink Converter)
C:\WINDOWS\system32\drivers\mssmbios.sys (Microsoft System Management BIOS Driver)
C:\WINDOWS\system32\drivers\ndisip.sys (Microsoft TV/Video Connection)
C:\WINDOWS\system32\drivers\usbehci.sys (Microsoft USB 2.0 Enhanced Host Controller Miniport Driver)
C:\WINDOWS\system32\drivers\usbohci.sys (Microsoft USB Open Host Controller Miniport Driver)
C:\WINDOWS\system32\drivers\usbprint.sys (Microsoft USB PRINTER Class)
C:\WINDOWS\system32\drivers\usbhub.sys (Microsoft USB Standard Hub Driver)
C:\WINDOWS\system32\drivers\usbuhci.sys (Microsoft USB Universal Host Controller Miniport Driver)
c:\windows\system32\drivers\mnmdd.sys (mnmdd)
c:\windows\system32\drivers\modem.sys (Modem)
c:\windows\system32\drivers\mountmgr.sys (Mount Point Manager)
C:\WINDOWS\system32\drivers\mouclass.sys (Mouse Class Driver)
C:\WINDOWS\system32\drivers\mouhid.sys (Mouse HID Driver)
C:\WINDOWS\system32\drivers\mrxsmb.sys (MRXSMB)
c:\windows\system32\drivers\msfs.sys (Msfs)
c:\windows\system32\drivers\mup.sys (Mup)
C:\WINDOWS\system32\drivers\nabtsfec.sys (NABTS/FEC VBI Codec)
c:\windows\system32\drivers\ndproxy.sys (NDIS Proxy)
c:\windows\system32\drivers\ndis.sys (NDIS System Driver)
C:\WINDOWS\system32\drivers\ndisuio.sys (NDIS Usermode I/O Protocol)
C:\WINDOWS\system32\drivers\netbios.sys (NetBIOS Interface)
C:\WINDOWS\system32\drivers\netbt.sys (NetBios over Tcpip)
* c:\windows\system32\drivers\nod32drv.sys (nod32drv)
c:\windows\system32\drivers\npfs.sys (Npfs)
- g:\tencent\qq\npkcrypt.sys (npkcrypt)
c:\windows\system32\drivers\null.sys (Null)
C:\WINDOWS\system32\drivers\nv4_mini.sys (nv)
c:\windows\system32\drivers\omci.sys (OMCI)
C:\WINDOWS\system32\drivers\parport.sys (Parallel port driver)
c:\windows\system32\drivers\partmgr.sys (Partition Manager)
c:\windows\system32\drivers\parvdm.sys (ParVdm)
C:\WINDOWS\system32\drivers\pci.sys (PCI Bus Driver)
- c:\windows\system32\drivers\pcidump.sys (PCIDump)
c:\windows\system32\drivers\pciide.sys (PCIIde)
- c:\windows\system32\drivers\pdcomp.sys (PDCOMP)
- c:\windows\system32\drivers\pdframe.sys (PDFRAME)
- c:\windows\system32\drivers\pdreli.sys (PDRELI)
- c:\windows\system32\drivers\pdrframe.sys (PDRFRAME)
c:\windows\system32\drivers\pfmodnt.sys (PfModNT)
C:\WINDOWS\system32\drivers\isapnp.sys (PnP ISA/EISA Bus Driver)
c:\windows\system32\drivers\pqntdrv.sys (PQNTDrv)
C:\WINDOWS\system32\drivers\processr.sys (Processor Driver)
- c:\windows\system32\drivers\protowall.sys (ProtoWall Network Service)
C:\WINDOWS\system32\drivers\psched.sys (QoS Packet Scheduler)
C:\WINDOWS\system32\drivers\sntnlusb.sys (Rainbow USB SuperPro)
C:\WINDOWS\system32\drivers\asyncmac.sys (RAS Asynchronous Media Driver)
C:\WINDOWS\system32\drivers\rdbss.sys (Rdbss)
C:\WINDOWS\system32\drivers\rdpcdd.sys (RDPCDD)
c:\windows\system32\drivers\rdpwd.sys (RDPWD)
C:\WINDOWS\system32\drivers\rasacd.sys (Remote Access Auto Connection Driver)
C:\WINDOWS\system32\drivers\wanarp.sys (Remote Access IP ARP Driver)
C:\WINDOWS\system32\drivers\ndistapi.sys (Remote Access NDIS TAPI Driver)
C:\WINDOWS\system32\drivers\ndiswan.sys (Remote Access NDIS WAN Driver)
C:\WINDOWS\system32\drivers\raspppoe.sys (Remote Access PPPOE Driver)
C:\WINDOWS\system32\drivers\hsf_samp.sys (Rksample)
g:\superantispyware\sasdifsv.sys (SASDIFSV)
g:\superantispyware\sasenum.sys (SASENUM)
g:\superantispyware\saskutil.sys (SASKUTIL)
C:\WINDOWS\system32\drivers\secdrv.sys (Secdrv)
c:\windows\system32\drivers\sentinel.sys (Sentinel)
C:\WINDOWS\system32\drivers\serenum.sys (Serenum Filter Driver)
C:\WINDOWS\system32\drivers\serial.sys (Serial port driver)
C:\WINDOWS\system32\drivers\sis162u.sys (SiS 162 usb Wireless LAN Adapter Driver)
C:\WINDOWS\system32\drivers\hsf_faxx.sys (SoftFax)
C:\WINDOWS\system32\drivers\swenum.sys (Software Bus Driver)
C:\WINDOWS\system32\drivers\k750bus.sys (Sony Ericsson 750 driver (WDM))
C:\WINDOWS\system32\drivers\k750mgmt.sys (Sony Ericsson 750 USB WMC Device Management Drivers)
C:\WINDOWS\system32\drivers\sonypvd2.sys (sonypvd2)
c:\windows\system32\drivers\sonypvf2.sys (sonypvf2)
c:\windows\system32\drivers\sonypvl2.sys (sonypvl2)
c:\windows\system32\drivers\sonypvt2.sys (sonypvt2)
C:\WINDOWS\system32\drivers\hsf_spkp.sys (SpeakerPhone)
C:\WINDOWS\system32\drivers\alcaudsl.sys (SpeedTouch ADSL Modem ATM Transport)
C:\WINDOWS\system32\drivers\alcan5wn.sys (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN))
C:\WINDOWS\system32\drivers\sptd.sys (sptd)
C:\WINDOWS\system32\drivers\atapi.sys (Standard IDE/ESDI Hard Disk Controller)
- c:\windows\system32\drivers\iksysflt.sys (System Filter Driver)
- c:\windows\system32\drivers\iksyssec.sys (System Security Driver)
C:\WINDOWS\system32\drivers\tcpip.sys (TCP/IP Protocol Driver)
c:\windows\system32\drivers\tdpipe.sys (TDPIPE)
c:\windows\system32\drivers\tdtcp.sys (TDTCP)
C:\WINDOWS\system32\drivers\termdd.sys (Terminal Device Driver)
C:\WINDOWS\system32\drivers\rdpdr.sys (Terminal Server Device Redirector Driver)
C:\WINDOWS\system32\drivers\hsf_tone.sys (Tones)
C:\WINDOWS\system32\drivers\toshidpt.sys (TOSHIBA Bluetooth HID port driver)
c:\windows\system32\drivers\uicparallel.sys (UICParallel)
C:\WINDOWS\system32\drivers\modemcsa.sys (Unimodem Streaming Filter Device)
g:\unlocker\unlockerdriver5.sys (UnlockerDriver5)
C:\WINDOWS\system32\drivers\usbstor.sys (USB Mass Storage Driver)
C:\WINDOWS\system32\drivers\usbscan.sys (USB Scanner Driver)
C:\WINDOWS\system32\drivers\usbscan.sys (USB USB FlatBed Scanner Driver)
C:\WINDOWS\system32\drivers\hsf_v124.sys (V124)
c:\windows\system32\drivers\vga.sys (VGA Display Controller.)
C:\WINDOWS\system32\drivers\vcomm.sys (Virtual Serial port driver)
c:\windows\system32\drivers\volsnap.sys (VolSnap)
C:\WINDOWS\system32\drivers\ftdisk.sys (Volume Manager Driver)
C:\WINDOWS\system32\drivers\rasl2tp.sys (WAN Miniport (L2TP))
C:\WINDOWS\system32\drivers\raspptp.sys (WAN Miniport (PPTP))
- c:\windows\system32\drivers\wdica.sys (WDICA)
C:\WINDOWS\system32\drivers\mrxdav.sys (WebDav Client Redirector)
C:\WINDOWS\system32\drivers\hsfcxts2.sys (winachsf)
c:\windows\system32\drivers\ws2ifsl.sys (Windows Socket 2.0 Non-IFS Service Provider Support Environment)
C:\WINDOWS\system32\drivers\wstcodec.sys (World Standard Teletext Codec)

030 HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
——————————————
C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {733AC4CB-F1A4-11d0-B951-00A0C90312E1}

031 HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
——————————————-
c:\windows\system32\msvidctl.dll (Microsoft Corporation) {12D51199-0DB5-46FE-A120-47A3D7D937CC}
c:\windows\wc98pp.dll {BBCA9F81-8F4F-11D2-90FF-0080C83D3571}
c:\windows\system32\itss.dll (Microsoft Corporation) {9D148291-B9C8-11D0-A4CC-0000F80149F6}
c:\windows\system32\itss.dll (Microsoft Corporation) {9D148291-B9C8-11D0-A4CC-0000F80149F6}
c:\windows\system32\msvidctl.dll (Microsoft Corporation) {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E}
c:\windows\system32\wiascr.dll (Microsoft Corporation) {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE}

032 HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
———————————————————————————–
C:\WINDOWS\system32\rdpclip.exe (Microsoft Corporation)

033 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
———————————————————————–
c:\windows\system32\userinit.exe (Microsoft Corporation)

034 HKLM-HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
————————————————————————-
C:\WINDOWS\explorer.exe (Microsoft Corporation)

035 HKLM-HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
——————————————————————
C:\Program Files\outlook express\setup50.exe (Microsoft Corporation) {7790769C-0471-11d2-AF11-00C04FA35D02}
c:\windows\system32\mscories.dll (Microsoft Corporation) {89B4C1CD-B018-4511-B0A1-5476DBF70820}
C:\Program Files\outlook express\setup50.exe (Microsoft Corporation) {44BBA840-CC51-11CF-AAFA-00AA00B6015C}
C:\WINDOWS\system32\shmgrate.exe (Microsoft Corporation) >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
C:\WINDOWS\system32\regsvr32.exe (Microsoft Corporation) {2C7339CF-2B09-4501-B3F3-F3508C9228ED}
C:\WINDOWS\system32\regsvr32.exe (Microsoft Corporation) {89820200-ECBD-11cf-8B85-00AA005B4340}

042 HKLM\Software\Microsoft\Internet Explorer\Extensions
——————————————————–
c:\program files\messenger\msmsgs.exe (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}
- g:\tencent\qq\qq.exe {c95fe080-8f5d-11d2-a20b-00aa003c157b}

050 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
—————————————————————————–
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {AEB6717E-7E19-11d0-97EE-00C04FD91972}
- c:\windows\system32\wvumkhig.dll {4E3E60F5-F691-475F-AFBA-CF9FCAB47C15}

052 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
———————————————————————————-
- c:\windows\system32\cbxpjjdb.dll {71964165-56E8-497A-839D-1436BE3B4716}
- c:\windows\system32\efcdewwp.dll {F66F8B1D-9C39-4D58-A7D6-D463B8BA9253}
- c:\windows\system32\gebsqqja.dll {5878308E-5803-49B3-9F20-950A77AEED0D}
c:\windows\system32\mfyqaw.dll {94e65bdb-5ee1-4b57-8d53-6891d96fdb66}
- c:\windows\system32\mljbulbb.dll {D059FE50-A7C7-4DCD-9C2B-62AE85E991B4}
- c:\windows\system32\pmnkldst.dll {AD28FA74-4647-44BE-BFF2-F7951705BFF6}
- g:\spybot~1\sdhelper.dll {53707962-6F74-2D53-2644-206D7942484F}
- c:\windows\system32\vtukihxx.dll {39E3562B-F16B-4F8D-AC57-01F265223D63}
- c:\windows\system32\vtukjgwo.dll {96F48ED7-7A34-4CE5-BAF7-937DF7810657}
- c:\windows\system32\wvumkhig.dll {4E3E60F5-F691-475F-AFBA-CF9FCAB47C15}

060 HKLM-HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
———————————————————————————–
c:\windows\system32\stobject.dll (Microsoft Corporation) {35CEC8A3-2BE6-11D2-8773-92E220524153}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {7849596a-48ea-486e-8937-a2a3009f31a9}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {fbeb8a05-beee-4442-804e-409d6c4515e9}

061 HKLM-HCKU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
———————————————————————————
C:\WINDOWS\system32\photowiz.dll (Microsoft Corporation) {60fd46de-f830-4894-a628-6fa81bc0190d}
C:\WINDOWS\system32\cabview.dll (Microsoft Corporation) {0CD7A5C0-9F37-11CE-AE65-08002B2E1262}
C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) {875CB1A1-0F29-45de-A1AE-CFB4950D0B78}
C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) {87D62D94-71B3-4b9a-9489-5FE6850DC73E}
C:\WINDOWS\system32\syncui.dll (Microsoft Corporation) {85BBD920-42A0-1069-A2E4-08002B30309D}
C:\WINDOWS\system32\slayerxp.dll (Microsoft Corporation) {513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}
C:\WINDOWS\system32\zipfldr.dll (Microsoft Corporation) {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}
C:\WINDOWS\system32\zipfldr.dll (Microsoft Corporation) {BD472F60-27FA-11cf-B8B4-444553540000}
C:\WINDOWS\system32\zipfldr.dll (Microsoft Corporation) {888DCA60-FC0A-11CF-8F0F-00C04FD7D062}
c:\windows\system32\cryptext.dll (Microsoft Corporation) {7444C717-39BF-11D1-8CD9-00C04FC29D45}
c:\windows\system32\cryptext.dll (Microsoft Corporation) {7444C719-39BF-11D1-8CD9-00C04FC29D45}
C:\WINDOWS\system32\appwiz.cpl (Microsoft Corporation) {CFCCC7A0-A282-11D1-9082-006008059382}
c:\windows\system32\nvshell.dll (NVIDIA Corporation) {1CDB2949-8F65-4355-8456-263E7C208A5D}
c:\windows\system32\nvshell.dll (NVIDIA Corporation) {1E9B04FB-F9E5-4718-997B-B8DA88302A47}
c:\windows\system32\dfsshlex.dll (Microsoft Corporation) {ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}
C:\WINDOWS\system32\dsuiext.dll (Microsoft Corporation) {62AE1F9A-126A-11D0-A14B-0800361B1103}
C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) {163FDC20-2ABC-11d0-88F0-00A024AB2DBB}
C:\WINDOWS\system32\dsuiext.dll (Microsoft Corporation) {0D45D530-764B-11d0-A1CA-00AA00C16E65}
C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) {8A23E65E-31C2-11d0-891C-00A024AB2DBB}
C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) {F020E586-5264-11d1-A532-0000F8757D7E}
C:\WINDOWS\system32\diskcopy.dll (Microsoft Corporation) {59099400-57FF-11CE-BD94-0020AF85B590}
C:\WINDOWS\system32\dskquoui.dll (Microsoft Corporation) {7988B573-EC89-11cf-9C00-00AA00A14F56}
C:\WINDOWS\system32\deskadp.dll (Microsoft Corporation) {42071712-76d4-11d1-8b24-00a0c9068ff3}
C:\WINDOWS\system32\deskmon.dll (Microsoft Corporation) {42071713-76d4-11d1-8b24-00a0c9068ff3}
C:\WINDOWS\system32\deskperf.dll (Microsoft Corporation) {f92e8c40-3d33-11d2-b1aa-080036a75b03}
C:\WINDOWS\system32\dssec.dll (Microsoft Corporation) {4E40F770-369C-11d0-8922-00A024AB2DBB}
C:\WINDOWS\system32\fontext.dll (Microsoft Corporation) {BD84B380-8CA2-1069-AB1D-08000948F534}
c:\program files\outlook express\wabfind.dll (Microsoft Corporation) {32714800-2E5F-11d0-8B85-00AA0044F941}
c:\windows\system32\msieftp.dll (Microsoft Corporation) {63da6ec0-2e98-11cf-8d82-444553540000}
c:\windows\system32\mscoree.dll (Microsoft Corporation) {1D2680C9-0E2A-469d-B787-065558BC7D43}
c:\windows\system32\shimgvw.dll (Microsoft Corporation) {3F30C968-480A-4C6C-862D-EFC0897BB84B}
C:\WINDOWS\system32\netplwiz.dll (Microsoft Corporation) {58f1f272-9240-4f51-b6d4-fd63d1618591}
c:\windows\system32\shellext\gmailfs.dll (Bjarke Viksoe) {2B3453E4-49DF-11D3-8229-0080BE509050}
c:\windows\system32\shellext\gmailfs.dll (Bjarke Viksoe) {2B3453E4-49DF-11D3-8229-0080BE509056}
c:\windows\system32\shellext\gmailfs.dll (Bjarke Viksoe) {2B3453E4-49DF-11D3-8229-0080BE509054}
c:\windows\system32\shellext\gmailfs.dll (Bjarke Viksoe) {2B3453E4-49DF-11D3-8229-0080BE509052}
c:\windows\system32\shimgvw.dll (Microsoft Corporation) {EAB841A0-9550-11cf-8C16-00805F1408F3}
c:\windows\system32\hticons.dll (Hilgraeve, Inc.) {88895560-9AA2-1069-930E-00AA0030EBC8}
C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) {DBCE2480-C732-101B-BE72-BA78E9AD5B27}
C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) {5DB2625A-54DF-11D0-B6C4-0800091AA605}
C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) {675F097E-4C4D-11D0-B6C1-0800091AA605}
C:\WINDOWS\system32\icmui.dll (Microsoft Corporation) {176d6597-26d3-11d1-b350-080036a75b03}
C:\WINDOWS\system32\appwiz.cpl (Microsoft Corporation) {0B124F8F-91F0-11D1-B8B5-006008059382}
c:\windows\msagent\agentpsh.dll (Microsoft Corporation) {143A62C8-C33B-11D1-84FE-00C04FA34A14}
c:\program files\common files\system\ole db\oledb32.dll (Microsoft Corporation) {2206CDB2-19C1-11D1-89E0-00C04FD7A829}
c:\windows\system32\docprop2.dll (Microsoft Corporation) {6A205B57-2567-4A2C-B881-F787FAB579A3}
c:\windows\system32\docprop2.dll (Microsoft Corporation) {0EEA25CC-4362-4A12-850B-86EE61B0D3EB}
c:\windows\system32\docprop2.dll (Microsoft Corporation) {A9CF0EAE-901A-4739-A481-E35B73E47F6D}
c:\windows\system32\docprop2.dll (Microsoft Corporation) {8EE97210-FD1F-4B19-91DA-67914005F020}
c:\windows\system32\docprop2.dll (Microsoft Corporation) {28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}
c:\windows\system32\docprop2.dll (Microsoft Corporation) {883373C3-BF89-11D1-BE35-080036B11A03}
C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) {A6FD9E45-6E44-43f9-8644-08598F5A74D9}
C:\WINDOWS\system32\mmcshext.dll (Microsoft Corporation) {7A80E4A8-8005-11D2-BCF8-00C04F72C717}
C:\WINDOWS\system32\mmsys.cpl (Microsoft Corporation) {00022613-0000-0000-C000-000000000046}
C:\WINDOWS\system32\mydocs.dll (Microsoft Corporation) {ECF03A33-103D-11d2-854D-006008059367}
C:\WINDOWS\system32\mydocs.dll (Microsoft Corporation) {ECF03A32-103D-11d2-854D-006008059367}
C:\WINDOWS\system32\mydocs.dll (Microsoft Corporation) {4a7ded0a-ad25-11d0-98a8-0800361b1103}
* c:\program files\nero\nero8\nero coverdesigner\coveredextension.dll (Nero AG) {97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}
c:\windows\system32\netshell.dll (Microsoft Corporation) {7007ACC7-3202-11D1-AAD2-00805FC1270E}
c:\windows\system32\netshell.dll (Microsoft Corporation) {992CFFA0-F557-101A-88EC-00DD010CCC48}
g:\eset\nodshex.dll {B089FE88-FB52-11D3-BDF1-0050DA34150D}
C:\WINDOWS\system32\rshx32.dll (Microsoft Corporation) {1F2E5C40-9550-11CE-99D2-00AA006E086C}
c:\windows\system32\nvcpl.dll (NVIDIA Corporation) {A70C977A-BF00-412C-90B7-034C51DA2439}
c:\windows\system32\nvshell.dll (NVIDIA Corporation) {1E9B04FB-F9E5-4718-997B-B8DA88302A48}
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {10CFC467-4392-11d2-8DB4-00C04FA31A66}
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {750fdf0e-2a26-11d1-a3ea-080036587f03}
C:\WINDOWS\system32\docprop.dll (Microsoft Corporation) {3EA48300-8CF6-101B-84FB-666CCB9BCD32}
c:\windows\system32\nvcpl.dll (NVIDIA Corporation) {FFB699E0-306A-11d3-8BD1-00104B6F7516}
C:\WINDOWS\system32\themeui.dll (Microsoft Corporation) {41E300E0-78B6-11ce-849B-444553540000}
c:\windows\system32\twext.dll (Microsoft Corporation) {9DB7A13C-F208-4981-8353-73CC61AE2783}
c:\windows\system32\twext.dll (Microsoft Corporation) {596AB062-B4D2-4215-9F74-E9109B0A8153}
C:\WINDOWS\system32\netplwiz.dll (Microsoft Corporation) {add36aa8-751a-4579-a266-d66f5202ccbb}
C:\WINDOWS\system32\rshx32.dll (Microsoft Corporation) {F37C5810-4D3F-11d0-B4BF-00AA00BBB723}
c:\windows\system32\remotepg.dll (Microsoft Corporation) {F0152790-D56E-4445-850E-4F3117DB740C}
C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) {3F953603-1008-4f6e-A73A-04AAC7A992F1}
C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) {83bbcbf3-b28a-4919-a5aa-73027445d672}
C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) {905667aa-acd6-11d2-8080-00805f6596d2}
C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) {E211B736-43FD-11D1-9EFB-0000F8757FCD}
C:\WINDOWS\system32\wiashext.dll (Microsoft Corporation) {FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}
c:\windows\system32\mstask.dll (Microsoft Corporation) {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
c:\windows\system32\sendmail.dll (Microsoft Corporation) {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}
c:\windows\system32\sendmail.dll (Microsoft Corporation) {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}
C:\WINDOWS\system32\appwiz.cpl (Microsoft Corporation) {352EC2B7-8B9A-11D1-B8AE-006008059382}
C:\WINDOWS\system32\ntlanui2.dll (Microsoft Corporation) {59be4990-f85c-11ce-aff7-00aa003ca9f6}
* c:\program files\real\realplayer\rpshell.dll (RealNetworks, Inc.) {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}
C:\WINDOWS\system32\ntshrui.dll (Microsoft Corporation) {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
C:\WINDOWS\system32\ntshrui.dll (Microsoft Corporation) {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}
c:\windows\system32\wshext.dll (Microsoft Corporation) {60254CA5-953B-11CF-8C96-00AA00B8708C}
c:\windows\system32\dfshim.dll (Microsoft Corporation) {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}
C:\WINDOWS\system32\shimgvw.dll (Microsoft Corporation) {66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}
C:\WINDOWS\system32\shimgvw.dll (Microsoft Corporation) {eb9b1153-3b57-4e68-959a-a3266bc3d7fe}
C:\WINDOWS\system32\shimgvw.dll (Microsoft Corporation) {e84fda7c-1d6a-45f6-b725-cb260c236066}
C:\WINDOWS\system32\dsquery.dll (Microsoft Corporation) {9E51E0D0-6E0F-11d2-9601-00C04FA31A86}
C:\WINDOWS\system32\netplwiz.dll (Microsoft Corporation) {6b33163c-76a5-4b6c-bf21-45de9cd503a1}
C:\WINDOWS\system32\shscrap.dll (Microsoft Corporation) {56117100-C0CD-101B-81E2-00AA004AE837}
c:\windows\system32\dfshim.dll (Microsoft Corporation) {e82a2d71-5b2f-43a0-97b8-81be15854de8}
c:\windows\system32\shimgvw.dll (Microsoft Corporation) {9DBD2C50-62AD-11d0-B806-00C04FD706EC}
c:\windows\system32\mstask.dll (Microsoft Corporation) {DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}
c:\windows\system32\mstask.dll (Microsoft Corporation) {797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}
* g:\tuneup utilities 2007\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
* C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH) {44440D00-FF19-4AFC-B765-9A0970567D97}
g:\unlocker\unlockercom.dll {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}
C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) {40C3D757-D6E4-4b49-BB41-0E5BBEA28817}
C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) {c5a40261-cd64-4ccf-84cb-c394da41d590}
C:\WINDOWS\system32\shmedia.dll (Microsoft Corporation) {E4B29F9D-D390-480b-92FD-7DDB47101D71}
C:\WINDOWS\system32\printui.dll (Microsoft Corporation) {77597368-7b15-11d0-a0c2-080036af3f03}
C:\WINDOWS\system32\netplwiz.dll (Microsoft Corporation) {CC6EEFFB-43F6-46c5-9619-51D571967F7D}
g:\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

062 HKLM-HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
————————————————————
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {0D2E74C4-3C34-11d2-A27E-00C04FC30871}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {24F14F01-7B1C-11d1-838f-0000F80461CF}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {24F14F02-7B1C-11d1-838f-0000F80461CF}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {66742402-F9B9-11D1-A202-0000F81FEDEE}

063 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
———————————————————————
C:\WINDOWS\system32\lsdelete.exe

064 HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
——————————————————————-
C:\WINDOWS\system32\advapi32.dll (Microsoft Corporation)
C:\WINDOWS\system32\comdlg32.dll (Microsoft Corporation)
C:\WINDOWS\system32\gdi32.dll (Microsoft Corporation)
C:\WINDOWS\system32\imagehlp.dll (Microsoft Corporation)
C:\WINDOWS\system32\kernel32.dll (Microsoft Corporation)
C:\WINDOWS\system32\lz32.dll (Microsoft Corporation)
C:\WINDOWS\system32\ole32.dll (Microsoft Corporation)
C:\WINDOWS\system32\oleaut32.dll (Microsoft Corporation)
C:\WINDOWS\system32\olecli32.dll (Microsoft Corporation)
C:\WINDOWS\system32\olecnv32.dll (Microsoft Corporation)
C:\WINDOWS\system32\olesvr32.dll (Microsoft Corporation)
C:\WINDOWS\system32\olethk32.dll (Microsoft Corporation)
C:\WINDOWS\system32\rpcrt4.dll (Microsoft Corporation)
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
C:\WINDOWS\system32\user32.dll (Microsoft Corporation)
C:\WINDOWS\system32\version.dll (Microsoft Corporation)
C:\WINDOWS\system32\wldap32.dll (Microsoft Corporation)

066 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost
———————————————————————
C:\WINDOWS\system32\logonui.exe (Microsoft Corporation)

067 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
———————————————————————
- awtuuuom.dll
C:\WINDOWS\system32\crypt32.dll (Microsoft Corporation)
C:\WINDOWS\system32\cryptnet.dll (Microsoft Corporation)
C:\WINDOWS\system32\cscdll.dll (Microsoft Corporation)
- ljjyrlct.dll
- mljyonlk.dll
C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
C:\WINDOWS\system32\sclgntfy.dll (Microsoft Corporation)
C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
- tuvtklld.dll
C:\WINDOWS\system32\wlnotify.dll (Microsoft Corporation)
- wvumkhig.dll
- xxyxyolm.dll

068 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
——————————————————————————–
C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

069 HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
——————————————————–
C:\WINDOWS\system32\cnbjmon.dll (Microsoft Corporation)
C:\WINDOWS\system32\e_sl2352.dll (SEIKO EPSON CORPORATION)
C:\WINDOWS\system32\ebpmon3.dll (SEIKO EPSON CORPORATION)
C:\WINDOWS\system32\localspl.dll (Microsoft Corporation)
C:\WINDOWS\system32\pjlmon.dll (Microsoft Corporation)
C:\WINDOWS\system32\primomonnt.dll
C:\WINDOWS\system32\tcpmon.dll (Microsoft Corporation)
C:\WINDOWS\system32\usbmon.dll (Microsoft Corporation)

070 HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
———————————————————————
- c:\windows\system32\cbxpjjdb
C:\WINDOWS\system32\msv1_0.dll (Microsoft Corporation)

071 HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
——————————————————————-
C:\WINDOWS\system32\scecli.dll (Microsoft Corporation)

072 HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
—————————————————————
C:\WINDOWS\system32\kerberos.dll (Microsoft Corporation)
C:\WINDOWS\system32\msv1_0.dll (Microsoft Corporation)
C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)

073 %windir%\Tasks
——————
1-Click Maintenance.job : g:\tuneup utilities 2007\systemoptimizer.exe (TuneUp Software GmbH)

100 Internet Explorer settings
——————————
ShellNext HKCU : http://www.hotmail.msn.com/cgi-bin/sbox?action=inbox
Start Page HKCU : http://www.google.co.uk/

102 HKLM - HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
——————————————————————
GUID / CLSID not found {32683183-48a0-441b-a342-7c2a440a9478}

104 HKLM\Software\Microsoft\Code Store Database\Distribution Units
——————————————————————
* c:\windows\downloaded program files\msgrchkr.dll (Microsoft Corporation) {00B71CFB-6864-4346-A978-C0A14556272C}
* c:\windows\downloaded program files\minesweeper.dll (Microsoft Corporation) {2917297F-F02B-4B9D-81DF-494B6333150B}
GUID / CLSID not found {33564D57-9980-0010-8000-00AA00389B71}
* c:\windows\downloaded program files\messengerstatsclient.dll (Microsoft Corporation) {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
GUID / CLSID not found {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
c:\program files\java\jre1.5.0_06\bin\npjpi150_06.dll (Sun Microsystems, Inc.) {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
* c:\windows\system32\flashax\flashax.ocx {D8089245-3211-40F6-819B-9E5E92CD61A2}

105 HKCU\Software\Microsoft\Internet Explorer\MenuExt
—————————————————–
E&xport to Microsoft Excel : res://G:\MICROS~2\Office12\EXCEL.EXE/3000

107 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5
———————————————————————————
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

145 HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters
—————————————————————————————————
C:\WINDOWS\system32\drivers\kbdclass.sys (Microsoft Corporation)

146 HKLM\System\CurrentControlSet\Control\SafeBoot\AlternateShell
—————————————————————–
C:\WINDOWS\system32\cmd.exe (Microsoft Corporation)

147 HKLM\System\CurrentControlSet\Control\SecurityProviders\SecurityProviders
—————————————————————————–
C:\WINDOWS\system32\digest.dll (Microsoft Corporation)
C:\WINDOWS\system32\msapsspc.dll (Microsoft Corporation)
C:\WINDOWS\system32\msnsspc.dll (Microsoft Corporation)
C:\WINDOWS\system32\schannel.dll (Microsoft Corporation)

148 HKLM\System\CurrentControlSet\Control\WOW\cmdline
—————————————————–
C:\WINDOWS\system32\ntvdm.exe (Microsoft Corporation)

149 HKLM\System\CurrentControlSet\Control\WOW\wowcmdline
——————————————————–
C:\WINDOWS\system32\krnl386.exe (Microsoft Corporation)

153 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
—————————————————————
C:\WINDOWS\system32\midimap.dll (Microsoft Corporation)
C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation)
C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation)

170 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
————————————————————————
{b34f0e2f-2c9d-11dc-8aec-001060d2b4a7} : I:\wd_windows_tools\setup.exe

171 HKCU\Control Panel\Desktop\SCRNSAVE.EXE
——————————————-
c:\windows\system32\logon.scr (Microsoft Corporation)

172 HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
—————————————————————
C:\WINDOWS\system32\ntlanman.dll (Microsoft Corporation)
C:\WINDOWS\system32\drprov.dll (Microsoft Corporation)
C:\WINDOWS\system32\davclnt.dll (Microsoft Corporation)

173 HKCR\*\shellex\ContextMenuHandlers
————————————–
* c:\program files\nero\nero8\nero coverdesigner\coveredextension.dll (Nero AG) {73FCA462-9BD5-4065-A73F-A8E5F6904EF7}
* c:\program files\nero\nero8\nero backitup\nbshell.dll (Nero AG)
g:\eset\nodshex.dll {B089FE88-FB52-11D3-BDF1-0050DA34150D}
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {750fdf0e-2a26-11d1-a3ea-080036587f03}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {09799AFB-AD67-11d1-ABCD-00C04FC30936}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {A470F8CF-A1E8-4f65-8335-227475AA5C46}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) Start Menu Pin
* g:\tuneup utilities 2007\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
g:\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

176 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
———————————————————————-
C:\WINDOWS\system32\drwtsn32.exe (Microsoft Corporation)

210 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath
———————————————————————————
C:\WINDOWS\system32\ntbackup.exe (Microsoft Corporation)

211 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\Cleanuppath
———————————————————————————-
C:\WINDOWS\system32\cleanmgr.exe (Microsoft Corporation)

212 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath
———————————————————————————
C:\WINDOWS\system32\dfrg.msc

213 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\Magnifier
—————————————————————————————-
C:\WINDOWS\system32\magnify.exe (Microsoft Corporation)

214 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\Narrator
—————————————————————————————
C:\WINDOWS\system32\narrator.exe (Microsoft Corporation)

215 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager\On-Screen Keyboard
————————————————————————————————-
C:\WINDOWS\system32\osk.exe (Microsoft Corporation)

221 HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers
——————————————————-
* c:\program files\nero\nero8\nero coverdesigner\coveredextension.dll (Nero AG) {73FCA462-9BD5-4065-A73F-A8E5F6904EF7}
* c:\program files\nero\nero8\nero backitup\nbshell.dll (Nero AG)
g:\eset\nodshex.dll {B089FE88-FB52-11D3-BDF1-0050DA34150D}
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {750fdf0e-2a26-11d1-a3ea-080036587f03}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {09799AFB-AD67-11d1-ABCD-00C04FC30936}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {A470F8CF-A1E8-4f65-8335-227475AA5C46}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) Start Menu Pin
* g:\tuneup utilities 2007\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
g:\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

223 HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers
————————————————————————–
- c:\documents and settings\moshe\desktop\malwarebytes' anti-malware\mbamext.dll {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {7BA4C740-9E81-11CF-99D3-00AA004AE837}
g:\unlocker\unlockercom.dll {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}

225 HKCU\Software\Classes\Folder\ShellEx\ContextMenuHandlers
————————————————————
- c:\documents and settings\moshe\desktop\malwarebytes' anti-malware\mbamext.dll {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
- c:\documents and settings\moshe\desktop\malwarebytes' anti-malware\mbamext.dll {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
* c:\program files\nero\nero8\nero backitup\nbshell.dll (Nero AG)
* c:\program files\nero\nero8\nero backitup\nbshell.dll (Nero AG)
g:\eset\nodshex.dll {B089FE88-FB52-11D3-BDF1-0050DA34150D}
g:\eset\nodshex.dll {B089FE88-FB52-11D3-BDF1-0050DA34150D}
g:\unlocker\unlockercom.dll {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}
g:\unlocker\unlockercom.dll {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}
g:\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
g:\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

227 HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
—————————————————————
GUID / CLSID not found {BED4C38B-F765-45AC-8C56-613F76BBF43E}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {A470F8CF-A1E8-4f65-8335-227475AA5C46}
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {750fdf0e-2a26-11d1-a3ea-080036587f03}
C:\WINDOWS\system32\ntshrui.dll (Microsoft Corporation) {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}
* g:\tuneup utilities 2007\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
g:\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

229 HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
————————————————————————–
c:\windows\system32\nvshell.dll (NVIDIA Corporation) {1E9B04FB-F9E5-4718-997B-B8DA88302A48}
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) {D969A300-E7FF-11d0-A93B-00A0C90F2719}
c:\windows\system32\nvcpl.dll (NVIDIA Corporation) {A70C977A-BF00-412C-90B7-034C51DA2439}

231 HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
——————————————————-
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

241 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
—————————————————————————————
C:\WINDOWS\system32\cscui.dll (Microsoft Corporation) {750fdf0e-2a26-11d1-a3ea-080036587f03}

Please follow my instructions exactly. I asked you to send me the .run file from Beginner mode not Expert mode

Download the zipped attachment at the end of this post (this will be your runscanner file fixed by me)

• Unzip it to your desktop then double click the runscanner icon this will run the program.
• You will notice several entries in red.
• Click the button at the top called Fix selected items
• Accept the warning(s) and repeat until they are all gone.
• Reboot your PC

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.