SmitFraudFix v2.320 (WinXP, Win2K)

Screen shots - Tutorial Français - English Tutorial - Deutsche Anleitung - Blog

Changelog:

Version 2.320 (May 06, 2008)


%WINDOWS%\spwoqbmv.exe
%WINDOWS%\xbaqktfv.exe
%WINDOWS%\qadovnel.dll

VirusHeat 4.4.exe
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.4.lnk
%STARTMENU%\VirusHeat 4.4.lnk
%STARTMENU%\Programs\VirusHeat 4.4\
%DESKTOP%\VirusHeat 4.4.lnk
%PROGRAMFILES%\VirusHeat 4.4\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DFBA66B-DB48-4292-831A-E7186D8A61AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46F309AE-9D11-4C10-9D20-2C084B1C8BCE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB95561-AF37-4BBD-823C-1E355A744A43}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76157861-4996-4711-90E4-6D868B877B24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{81DA01DB-8100-4865-B9B0-A83F54378435}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{910EF37B-A486-41FC-8A1B-28C5581AB3AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6B2BC38-7F2A-4202-9B43-A28615727FEE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B11DA4C8-52DC-44A2-B21B-02BF7A93EB5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5ADBFCA-C6DE-4E5A-A2DA-70AA2933B696}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5AE5932-F1B3-45E4-842A-59EEA65B13A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA18BA7B-9567-4408-9B87-3D3990C3969E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D56509AB-9821-4DB0-BF2F-115159804140}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DFF203EA-222C-44FA-8B78-ED88B4587AA2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB22B708-E0D3-4FCE-800B-6DD0C5B30D42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EA02F8-E536-4828-BFB7-3DE7FA4D4B09}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6E18622-DFA8-4DBA-B05E-D3D147E16D44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{23624BD0-2A69-4F91-BE6A-9F1F22B72C13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.4.exe 4.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.4]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 4.4"=-



Version 2.319 (April 25, 2008)


%DESKTOP%\IE AntiVirus 3.2.lnk
%STARTMENU%\Programs\IE AntiVirus 3.2.lnk
%PROGRAMFILES%\IEAntiVirus
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE AntiVirus]
[-HKEY_CURRENT_USER\Software\IEAntiVirus]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"antispy"=-



Version 2.318 (April 24, 2008)


Update: VACFix definition

%WINDOWS%\wxvgsdbq.exe
%WINDOWS%\olgdqarf.exe



Version 2.317 (April 22, 2008)


Release: 404Fix v1.0
A new componant to detect and remove 404 Helper BHO



Version 2.316 (April 21, 2008)


%SYSTEM%\814810\
O2 - BHO: 814810 helper - {DC59D6DA-7CDE-4874-9F97-41C82C177069} - C:\WINDOWS\System32\814810\814810.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DC59D6DA-7CDE-4874-9F97-41C82C177069}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DC59D6DA-7CDE-4874-9F97-41C82C177069}]



Version 2.315 (April 18, 2008)


%SYSTEM%\892267\
O2 - BHO: 892267 helper - {25E0128D-AAFC-49FF-AB11-1F12C2FCC391} - C:\WINDOWS\System32\892267\892267.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]



Version 2.314 (April 14, 2008)


%DESKTOP%\Malware Bell 3.2.lnk
%STARTMENU%\Programs\Malware Bell 3.2.lnk
%PROGRAMFILES%\MalwareBell
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Bell]
[-HKEY_CURRENT_USER\Software\MalwareBell]



Version 2.313 (April 14, 2008)


%SYSTEM%\403445\
O2 - BHO: 403445 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\403445\403445.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]



Version 2.312 (April 12, 2008)


Update: IEDFix Signatures



Version 2.311 (April 09, 2008)


%WINDOWS%\config.ini
%WINDOWS%\mywallpaper.bmp
%WINDOWS%\sysabmpmfr.exe
%WINDOWS%\sysahbecjh.exe
%WINDOWS%\sysatjsicj.exe
%WINDOWS%\sysavxjgdu.exe
%WINDOWS%\sysawechod.exe
%WINDOWS%\zysalwhkkw.exe
%WINDOWS%\zysaoxcjiy.exe
%WINDOWS%\zysapghucv.exe
%WINDOWS%\zysaxyczld.exe

[-HKEY_CURRENT_USER\Software\CrystalRealityCleaner]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{DD651081-A909-45ad-BD71-2335B0ADE043}"=- (Already removed)
"{9754B85A-3B34-4969-BE1F-CD03227E9470}"=- (Already removed)
"{7DD4A7AC-A3F1-4495-884A-7947C5B89108}"=-
"{2C70168B-97CE-4f31-B85D-1FEC5002721D}"=-
"{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}"=-



Version 2.310 (April 08, 2008)


%SYSTEM%\215651\
O2 - BHO: 215651 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\215651\215651.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]


O3 - Toolbar: Internet Service - {51D81DD5-55B7-497F-95DB-D356429BB54E} - C:\Program Files\NetProject\wamdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51D81DD5-55B7-497F-95DB-D356429BB54E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{51D81DD5-55B7-497F-95DB-D356429BB54E}"=-



Version 2.309 (March 26, 2008)


dwltqnmx.exe

%SYSTEM%\299914\
O2 - BHO: 299914 helper - {47DF236B-7D10-4C01-9820-50C0D54E7841} - C:\WINDOWS\system32\299914\299914.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47DF236B-7D10-4C01-9820-50C0D54E7841}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47DF236B-7D10-4C01-9820-50C0D54E7841}]

O2 - BHO: (no name) - {7C109800-A5D5-438F-9640-18D17E168B88} - C:\Program Files\NetProject\sbmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}]

%SYSTEM%\375013\
O2 - BHO: 375013 helper - {74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B} - C:\WINDOWS\System32\375013\375013.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]



Version 2.308 (March 24, 2008)


%WINDOWS%\sysqyzwud.exe
%WINDOWS%\config.ini
%WINDOWS%\sysscpmqn.exe
%WINDOWS%\syssngbeh.exe
%WINDOWS%\sysutrnez.exe
%WINDOWS%\syszweuas.exe
%WINDOWS%\xcbhwuq.exe
%WINDOWS%\xewuaqj.exe
%WINDOWS%\xfjzrby.dll
%WINDOWS%\xhbxcnv.exe
%WINDOWS%\mywallpaper.bmp

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}"=-
"{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}"=-
"{DD651081-A909-45ad-BD71-2335B0ADE043}"=-
"{9754B85A-3B34-4969-BE1F-CD03227E9470}"=-



Version 2.307 (March 22, 2008)


%WINDOWS%\norlatmx.exe
%WINDOWS%\fmrcjmdc.exe



Version 2.306 (March 21, 2008)


%SYSTEM%\tdidrv32.sys

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {DF47DD37-AC11-4A93-8E16-2B2364AF0897} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]



Version 2.305 (March 16, 2008)


%USERPROFILE%\Application Data\?????.exe (Awola6 Dropper, Random filename)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Windows Adapter 5.1.3214"=-

%USERPROFILE%\Application Data\Awola6\
%STARTMENU%\Programs\Awola6\

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Awola6"=-

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]



Version 2.304 (March 15, 2008)


%ALLUSERSTARTMENU%\Programs\Startup\msn_0803_upd041807.exe
%ProgramFiles%\tmp0.exe



Version 2.303 (March 14, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow]
"*.securewebinfo.com"=-
"*.safetyincludes.com"=-
"*.securemanaging.com"=-



Version 2.302 (March 14, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {D4FEDE82-C500-4AA4-BB99-A4DAE5A65A46} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4FEDE82-C500-4AA4-BB99-A4DAE5A65A46}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4FEDE82-C500-4AA4-BB99-A4DAE5A65A46}]

%SYSTEM%\jdxah.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1b40d2ad-d237-4544-b1e1-0bf75bf8fcc0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1b40d2ad-d237-4544-b1e1-0bf75bf8fcc0}"="inoperable"

O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - C:\Program Files\NetProject\sbmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}]



Version 2.301 (March 09, 2008)


O4 - HKCU\..\Run: [Pest-Capture] C:\Program Files\PestCapture\PestCapture.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pest-Capture"=-


%SYSTEM%\sysockeu.exe
%SYSTEM%\sysokuaw.exe
%SYSTEM%\sysodkcs.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"[1029BB4B-16A9-4E77-AA3D-96930BD68EEC]"=-
"[2177F056-0AA6-4D6C-A944-13F71F341C29]"=-
"[852EBF20-A95D-4F1F-B9C2-B2CD24350F3E]"=-


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F10DE2B-E923-4548-B524-4D9C5FA80777}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F10DE2B-E923-4548-B524-4D9C5FA80777}



Version 2.300 (March 02, 2008)


%SYSTEM%\mgmrwmrv.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,



Version 2.299 (February 29, 2008)


Update: IEDFix.exe 1.5
O2 - BHO: Windows Media Player - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\wmpdxm.dll


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {03B902B1-9B25-4173-9468-56775C85A8D4} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03B902B1-9B25-4173-9468-56775C85A8D4}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B902B1-9B25-4173-9468-56775C85A8D4}



Version 2.298 (February 28, 2008)


Update: VAC Fix 0.5



Version 2.297 (February 27, 2008)


%ProgramFiles%\tmp???????.exe
%ProgramFiles%\antiviirus.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"antiviirus"=-

%WINDIR%\Installer\{c6e9c531-af10-4639-bcd8-21e3520441a1}\KbdBoot.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6e9c531-af10-4639-bcd8-21e3520441a1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"KbdBoot"=-

%WINDIR%\Installer\{29b1075d-6c05-4cda-83aa-24d3777753c9}\CheckDrv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29b1075d-6c05-4cda-83aa-24d3777753c9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"CheckDrv"=-

%WINDIR%\Installer\{ee12547f-4a79-494f-be6d-14fc2f037713}\PrxDrive.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee12547f-4a79-494f-be6d-14fc2f037713}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PrxDrive"=-

%WINDIR%\Installer\{1d64c57d-091f-4aa8-8bb6-06543a8bc431}\WinCD.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d64c57d-091f-4aa8-8bb6-06543a8bc431}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WinCD"=-



Version 2.296 (February 23, 2008)


C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\RomAvp.dll
C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"RomAvp"=-



Version 2.295 (February 23, 2008)


%WINDIR%\ptlg.exe
%SYSTEM%\ptlg.exe
%WINDIR%\sprmvr.exe
%WINDIR%\ IEXPLORE.EXE

Remove ptlg Service

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msptlg"=-


%DESKTOP%\SpywareRemover.lnk
%STARTMENU%\Programs\SpywareRemover\
%PROGRAMFILES%\SpywareRemover\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DEA7D6F2-B8AB-4BB1-9422-86DC0B0F30E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\F497E0474CEB5344881F2C415C9D1736]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F497E0474CEB5344881F2C415C9D1736]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E74CD248E0D574C45A52FE6888496A3F]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{DEA7D6F2-B8AB-4BB1-9422-86DC0B0F30E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DisabledBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\E74CD248E0D574C45A52FE6888496A3F]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07E0FCEBD42BCAF4DA6E95F920A401FA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BE82F9C43A7DB343BA14C4279932C11]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CDA2C4C86C554043A1880B057FBFEDA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D00C99486D42224B9FA246AD3CC04E9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71B0EAD83CAD5924AB8E2DB01B911761]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CF08193722DAB9C4AB3218602F23C1F2]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F47680D455FCC574D8F56727A9E694D5]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F497E0474CEB5344881F2C415C9D1736]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{740E794F-BEC4-4435-88F1-C214C5D97163}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DisabledRun]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DisabledUninstall]
[-HKEY_CURRENT_USER\Software\SpywareRemover]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareRemover"=-


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {A3D76B96-30B9-4DCC-9B3D-D12E31280D29} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3D76B96-30B9-4DCC-9B3D-D12E31280D29}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3D76B96-30B9-4DCC-9B3D-D12E31280D29}


%SYSTEM%\wbchha.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ee9f7cf5-cd49-4cd8-8ba6-1514e7a5c22c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ee9f7cf5-cd49-4cd8-8ba6-1514e7a5c22c}"="djuka"



Version 2.294 (February 22, 2008)


Update: VACFix 0.4

%WINDOWS%\fkxvkns.exe



Version 2.293 (February 21, 2008)

%WINDOWS%\764.exe
%WINDOWS%\7search.dll
%WINDOWS%\absolute key logger.lnk
%WINDOWS%\aconti.exe
%WINDOWS%\aconti.ini
%WINDOWS%\aconti.log
%WINDOWS%\aconti.sdb
%WINDOWS%\acontidialer.txt
%WINDOWS%\adbar.dll
%WINDOWS%\cbinst$.exe
%WINDOWS%\daxtime.dll
%WINDOWS%\default.htm
%WINDOWS%\dp0.dll
%WINDOWS%\eventlowg.dll
%WINDOWS%\fhfmm-Uninstaller.exe
%WINDOWS%\fhfmm.exe
%WINDOWS%\flt.dll
%WINDOWS%\hcwprn.exe
%WINDOWS%\hotporn.exe
%WINDOWS%\iexplorr23.dll
%WINDOWS%\ie_32.exe
%WINDOWS%\jd2002.dll
%WINDOWS%\kkcomp$.exe
%WINDOWS%\kkcomp.dll
%WINDOWS%\kkcomp.exe
%WINDOWS%\kvnab$.exe
%WINDOWS%\kvnab.dll
%WINDOWS%\kvnab.exe
%WINDOWS%\liqad$.exe
%WINDOWS%\liqad.dll
%WINDOWS%\liqad.exe
%WINDOWS%\liqui-Uninstaller.exe
%WINDOWS%\liqui.dll
%WINDOWS%\liqui.exe
%WINDOWS%\ngd.dll
%WINDOWS%\pbar.dll
%WINDOWS%\pbsysie.dll
%WINDOWS%\settn.dll
%WINDOWS%\spredirect.dll
%WINDOWS%\vxddsk.exe
%WINDOWS%\wbeCheck.exe
%WINDOWS%\wbeInst$.exe
%WINDOWS%\wml.exe
%WINDOWS%\xadbrk.dll
%WINDOWS%\xadbrk.exe
%WINDOWS%\xadbrk_.exe
%WINDOWS%\xxxvideo.exe
%SYSTEM%\ace16win.dll
%SYSTEM%\acespy\
%SYSTEM%\ESHOPEE.exe
%SYSTEM%\msole32.exe
%SYSTEM%\rxjddnvj.exe
%SYSTEM%\vxddsk.exe
%SYSTEM%\winfrun32.bin
%SYSTEM%\wml.exe
%PROGRAMFILES%\3721\
%PROGRAMFILES%\Accoona\
%PROGRAMFILES%\akl\
%PROGRAMFILES%\amsys\
%PROGRAMFILES%\e-zshopper\
%PROGRAMFILES%\p2pnetworks\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12F02779-6D88-4958-8AD3-83C12D86ADC7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Cleaning Userinit or deleting if empty

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Cleaning Userinit



Version 2.292 (February 19, 2008)


%SYSTEM%\txdkfh.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}"="arborize"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.3.lnk
%STARTMENU%\VirusHeat 4.3.lnk
%STARTMENU%\Programs\VirusHeat 4.3\
%DESKTOP%\VirusHeat 4.3.lnk
%PROGRAMFILES%\VirusHeat 4.3\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EC085A8-9818-43B7-B975-EC7555EDA4D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1A74C41C-0837-4FBE-BA50-621EB70F01CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25297614-1B76-4C2C-82C6-62738AA0E8F0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37F89457-1208-4670-9245-58C62BD6D870}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45477032-ABD0-454D-9CE4-EA34C10322F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69E34747-0B27-4B30-AE20-1023BF29E246}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79BE5B3B-80B2-4B77-A042-EFC90F6E0DE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C0EC6BF-81B9-4FE0-9447-4ED29A36BF5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EBB34CF-1728-4136-A968-48F231DAD1B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88DAA291-B413-4C46-B378-3BE66F65369E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{936A2F4A-53F8-4D2F-92AA-2F9DE889841C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AFCC3FA7-82A9-42D5-A405-78711E97A5D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC05A4A3-7B28-488F-AB02-6AAEDB86ACCF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E80114AA-6653-4952-9E97-5F1DC63BEE0F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9109A2A-432B-4ADD-A6FA-06BA22DCD2D9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FCA3958A-8D38-4D14-8B81-CCD7F68A8A01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CBD02E9B-37EF-47D2-96B0-3ABBB2EB92BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.3.exe 4.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.3]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 4.3"=-



Version 2.291 (February 19, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}

%STARTMENU%\Programs\SearchVideo\
%Programs%\SearchVideo
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchVideo]
[-HKEY_CURRENT_USER\Software\SearchVideo]

%SYSTEM%\svxmhpz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67dc0736-075a-4647-95f5-d5421b838fed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{67dc0736-075a-4647-95f5-d5421b838fed}"="esperantido"



Version 2.290 (February 16, 2008)


%STARTMENU%\Programs\SearchPorn\
%Programs%\SearchPorn
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchPorn]
[-HKEY_CURRENT_USER\Software\SearchPorn]



Version 2.289 (February 14, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {8BD4438C-2511-4B93-AD34-2BDCD0FF78D2} - C:\Program Files\Helper\1203020309.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}


%STARTMENU%\Programs\ChristmasPorn\
%Programs%\ChristmasPorn
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChristmasPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ChristmasPorn]
[-HKEY_CURRENT_USER\Software\ChristmasPorn]


%SYSTEM%\eeioq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{917f93bf-6714-4e11-8982-59db2e0f88fc}"="epistylar"



Version 2.288 (February 12, 2008)


%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1202750081.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]



Version 2.287 (February 10, 2008)


%SYSTEM%\ofcpi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7265100a-17e1-41bf-bd08-63b95a25a9c3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7265100a-17e1-41bf-bd08-63b95a25a9c3}"="cured"

O2 - BHO: Sotfone Tracker Class - {10C52A42-DB8B-4ade-AA4A-CED6A8282B67} - C:\Program Files\Sotfone\1202480950.dll
%PROGRAMFILES%\Sotfone\ (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10C52A42-DB8B-4ade-AA4A-CED6A8282B67}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{499B8A53-5949-4625-A8BF-A4D934AFC9DA}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E85F6AA5-7A0C-49A5-9E5E-936FED62347D}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10C52A42-DB8B-4ade-AA4A-CED6A8282B67}]



Version 2.286 (February 10, 2008)


%PROGRAMFILES%\NetProject\
[-HKEY_CURRENT_USER\Software\NetProject]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Service]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"some"=- (Already removed)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Secure Browsing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"start"=- (Already removed)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81705D67-3F73-4983-859B-97D0922E5ABE}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"=- (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Web Application]



Version 2.285 (February 9, 2008)


%SYSTEM%\wupeng.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Winupdate Engine"=-

%SYSTEM%\ssa.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0391AAD0-AB5A-4338-B6DC-BB8405EB1C58}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F5D238F-ACC6-4089-9487-E2CD74E54954}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8EB51E2D-5F1A-4473-BD53-9B353C19A5A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gln.GLNBho]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gln.GLNBho.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0391AAD0-AB5A-4338-B6DC-BB8405EB1C58}]


%SYSTEM%\febcbcfdcececacc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"passwordexpirywarninghash"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\febcbcfdcececacc]


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareCrush 3.7.lnk
%STARTMENU%\MalwareCrush 3.7.lnk
%STARTMENU%\Programs\MalwareCrush\
%DESKTOP%\MalwareCrush.lnk
%PROGRAMFILES%\MalwareCrush\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E4D71E45-94E1-A19A-A939-B7D2A756F719}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{28621188-61C7-4829-A54B-3B73D055E982}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3544568D-D586-4746-84B9-84C7706AD597}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F2A5211-53B6-4C07-9A6D-959BF989528F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{535841D3-F4E1-4D3A-B506-CBC7F4E14913}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58035C9E-9A00-42FE-8F38-B380704F8EBA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C6D3658-833B-4E33-8BF4-77C4173770CF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D1595CE-B92A-47C5-9CC3-AE11E5A9AAFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{83481BE4-117A-4BB4-87B1-2B14528B64A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{878BF64D-DA3B-417C-A957-19662D5331C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A5B98B5-6CC9-49D4-967C-BB6AAA04E7E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C55CF0F-FD4A-4B03-9365-906B0BFA86CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B216377D-994C-4555-B44F-35F64D586833}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2105722-4ECC-48E8-866A-BF166CA967C4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4585709-B01D-4EE5-9274-3E34EA56E4B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCCC68A6-7114-423A-B9A5-7110EB925EDD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E04407F5-F6B9-495D-A767-4D860E42DBE2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A4C66FB-4B04-478C-B855-FCA385797DB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareCrush.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareCrush]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareCrush]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareCrush"=-



Version 2.284 (February 8, 2008)


Update: VACFix

%WINDOWS%\fsxloqf.exe

[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{81705D67-3F73-4983-859B-97D0922E5ABE}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"=-



Version 2.283 (February 8, 2008)


%SYSTEM%\iinqyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27cb634d-c84e-4c00-9b53-f5523601dbad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27cb634d-c84e-4c00-9b53-f5523601dbad}"="cariniana"


%SYSTEM%\wuuawkz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{747e1fbe-b70f-441d-bbca-6e536c04924a}"="didact"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk
%STARTMENU%\VirusHeat 3.9.lnk
%STARTMENU%\Programs\VirusHeat 3.9\
%DESKTOP%\VirusHeat 3.9.lnk
%PROGRAMFILES%\VirusHeat 3.9\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0979850F-6C3E-4294-B225-B3D3C4A6F2A1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BB2DA5F-B78F-44EA-BDA1-771CBE1DEC68}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A4E73C5-BA3C-4391-B7E5-FFE8D3BD6245}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44A923CA-F430-4F85-9F84-5153ECDB882E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E6E21EC-9D72-4164-8A53-74786A467872}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{631E9E48-B066-43DA-92AC-6DADF61B173B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{65C1361C-E696-4AF0-9E21-81910193F352}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DCE805-C8CE-48AA-A47F-BFA6CC7704B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D42769F-07D8-494D-AAB4-AA1652C541FA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1922071-390C-418D-916D-91209E95D286}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1F8CD95-CFB3-43D1-A956-63441CC058C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A63B46AD-96A7-4A2C-BD8F-8CD097E1593A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A65F98DD-2360-468C-B76E-B1B84C0D547C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE2AEED0-BE1B-4BA2-826E-20D1991081B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7F73787-6206-4BBA-BDC0-7CFA9940DBCB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E770F739-2968-4ED9-A63C-DC1938DC82A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CFAFA83C-855B-4E3D-92B9-A587995B675A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 3.9.exe 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 3.9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 3.9"=-



Version 2.282 (February 8, 2008)


Update: VACFix, IEDFix


%WINDOWS%\frplprg.exe


%PROGRAMFILES%\Helper\ (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-ABCD-7DD20B862223}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B862223}]



Version 2.281 (February 4, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132E4218-F960-4E17-B3F6-0F05431D81C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{435DEA43-7D14-47F0-8223-B416BD296464}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82FC6E1B-7C32-4144-B95D-22D757327778}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D604E3C4-21ED-43D4-8CDF-759954DE7E88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{132E4218-F960-4E17-B3F6-0F05431D81C6}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB41490A-2B8A-414F-BFFB-D3527364EE25}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19C93F79-69BC-4994-B6C6-8D9CCCD9C454}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CB7E3AA3-D273-428B-A0DD-579689D26EC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bsdw]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AB41490A-2B8A-414F-BFFB-D3527364EE25}"=-


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DD6CD4E-6AAA-44DC-A804-88EB672341D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE78CF65-D188-487A-9A39-5DBFC77BF015}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15EE94F8-5660-47F1-8358-0D386BC64247}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AB01356-C318-4E73-998C-8E54C8EB5E64}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA97E13E-1DED-4851-B684-BAD36D8E29B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.brgk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}"=-


%SYSTEM%\ctfmona.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmona"=-


%PROGRAMFILES%\IECodec\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F27B120-0DED-4701-85B4-4CC58D92534C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9D18326E-AD27-4757-8564-79929B2F6363}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45490C66-3E2A-46cb-880B-547D69157450}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VSCHelp]

[-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL] (Already removed)
[-HKEY_CURRENT_USER\Software\Classes\AppID\{A45C8C0C-E056-4892-A589-E389355E1E31}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{45490C66-3E2A-46cb-880B-547D69157450}]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO] (Already removed)
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1] (Already removed)



Version 2.280 (February 3, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3D4A580B-E7C5-4FF1-BC30-C0EE8E043122}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EC2CAD4-02C2-4E99-8C8B-0A235EA96848}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B69341AE-B50E-40FF-A407-8A6C6B9C6805}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{61F79A78-BC2E-476A-AB37-E5016C2269B1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D4A580B-E7C5-4FF1-BC30-C0EE8E043122}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB1966D0-076C-49FD-A0DE-E142EAE25C57}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE8FE16A-8EC4-4763-B1B8-C1FD49813A2E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE61A031-F76D-4F3C-8AC5-59DBC0372BB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bxgk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{BB1966D0-076C-49FD-A0DE-E142EAE25C57}"=-


[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F05D6CDA-C88F-47A3-A264-A00B3EE1676C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BAE4E0D0-1EA3-43CE-ACF5-F157376F57A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E69B5A50-7137-473A-98EB-CC2F855044B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CCEDFB8D-8C05-4A8E-8226-BCBF107798DE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F05D6CDA-C88F-47A3-A264-A00B3EE1676C}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{673E33A6-D87B-40DC-B0DC-C9C5B8F5A461}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C5CF283-48AE-4961-8C07-379D18217E3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{91CCF0B9-7CB2-4070-ADFE-7C66D673E8EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bwos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{673E33A6-D87B-40DC-B0DC-C9C5B8F5A461}"=-



Version 2.279 (February 3, 2008)


%STARTMENU%\Programs\XXXHoliday\
%PROGRAMFILES%\XXXHoliday\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXHoliday]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XXXHoliday]
[-HKEY_CURRENT_USER\Software\XXXHoliday]


%PROGRAMFILES%\Helper\1201990766.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}]

%PROGRAMFILES%\Sotfone\1201990769.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10C52A42-DB8B-4ade-AA4A-CED6A8282B85}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{499B8A53-5949-4625-A8BF-A4D934AFC9DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E85F6AA5-7A0C-49A5-9E5E-936FED62347D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Tracker.TrackerObj.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10C52A42-DB8B-4ade-AA4A-CED6A8282B85}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MultiMedia Software]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\multimediaControls.chl]



Version 2.278 (February 2, 2008)


Added: VACFix.exe tool to remove VideoAccessCodec generic files & keys.



Version 2.277 (January 28, 2008)


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8113B5DE-F7EB-4154-A311-497FB80D8BD0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"=-


O2 - BHO: SXG Advisor - {EF39E67B-8383-4A49-AAC6-29349FA7F623} - C:\WINDOWS\dntpkwodpx.dll
O3 - Toolbar: ekxdvft - {F25117E3-2A27-4A0C-88EE-D9307F678DD0} - C:\WINDOWS\ekxdvft.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F25117E3-2A27-4A0C-88EE-D9307F678DD0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27DBACCC-358C-4C2A-98FB-C79AFD3691C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6A74AFE4-24A0-49E7-9FC9-2A603F486441}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8323182A-2264-4A99-B9F8-40F3A425FCD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1385D09E-8B2D-45E1-B235-49E12B248AD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A98CC268-6435-4453-8DB5-A31C3DEB74BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bwtn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F25117E3-2A27-4A0C-88EE-D9307F678DD0}"=-


%WINDOWS%\fxtqdrl.exe
%WINDOWS%\agrlmvp.dll
%WINDOWS%\bmlvqkn.dll
O21 - SSODL: agrlmvp - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\agrlmvp.dll
O21 - SSODL: bmlvqkn - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bmlvqkn.dll



Version 2.276 (January 27, 2008)


O2 - BHO: SXG Advisor - {AF7FCB20-E32A-41D8-B2ED-BC1EA8C11E90} - C:\WINDOWS\dntpkwo???.dll
O3 - Toolbar: ekxdvft - {C87444C3-8B83-4A48-91DE-95F9A3D61070} - C:\WINDOWS\ekxdvft.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF7FCB20-E32A-41D8-B2ED-BC1EA8C11E90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C87444C3-8B83-4A48-91DE-95F9A3D61070}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18788028-95D6-4315-80E5-ABC50E05B30C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46EBFEF3-EE46-4CCD-8566-F2D8AA3FAE8B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69B6FEFD-172B-4AB7-BC58-BE851921C80E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{789D7229-B05F-4627-A9A7-32B1690C5158}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7C4A844A-EAE0-4497-8035-18F531056C15}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.btod]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF7FCB20-E32A-41D8-B2ED-BC1EA8C11E90}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{C87444C3-8B83-4A48-91DE-95F9A3D61070}"=-

%WINDOWS%\ffvrdgt.exe
%WINDOWS%\dntpkwo???.dll
%WINDOWS%\ekxdvft.dll
%WINDOWS%\bgrlsmn.dll
%WINDOWS%\adsoowf.dll
O2 - BHO: SXG Advisor - {A2190857-2B7C-46E1-851B-F8919A2DE836} - C:\WINDOWS\dntpkwo???.dll
O3 - Toolbar: ekxdvft - {D7257984-3F99-4D51-87C6-4D5E111DEBA9} - C:\WINDOWS\ekxdvft.dll
O21 - SSODL: bgrlsmn - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bgrlsmn.dll
O21 - SSODL: adsoowf - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\adsoowf.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2190857-2B7C-46E1-851B-F8919A2DE836}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7257984-3F99-4D51-87C6-4D5E111DEBA9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1258A10B-5AE3-45FB-B7A5-6CACF8E5B91F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{83B1D400-F36B-4D87-8B18-172DDED5D02F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0F229D7-ADA0-468A-98A6-1640440C1757}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{051BD7AE-DEA2-47FE-B2E7-9541500BF4D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B83F4525-ADF4-4711-BC51-11D7E07CA0F4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.blgx]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2190857-2B7C-46E1-851B-F8919A2DE836}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D7257984-3F99-4D51-87C6-4D5E111DEBA9}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bgrlsmn"=-
"adsoowf"=-



Version 2.275 (January 27, 2008)


Update: IEDFix v1.3



Version 2.274 (December 19, 2007)


Update: IEDFix v1.1. The tool will now detected new generic files and registry keys/subkeys without updates.



Version 2.273 (December 19, 2007)


%WINDOWS%\pdswin.dll




Version 2.272 (December 18, 2007)


%WINDOWS%\binret.exe
%WINDOWS%\ttvbon???.dll
%WINDOWS%\leosrv.dll
%WINDOWS%\hjoqor.dll
%WINDOWS%\xcvwer.dll
O2 - BHO: BDEX System - {7875DBFF-6B8A-4B74-B8A2-E2DBF657CA03} - C:\WINDOWS\ttvbonfvm.dll
O3 - Toolbar: The leosrv - {14E52265-CCA3-4F78-A21B-88F4EE6E78C1} - C:\WINDOWS\leosrv.dll
O21 - SSODL: hjoqor - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hjoqor.dll
O21 - SSODL: xcvwer - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\xcvwer.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14E52265-CCA3-4F78-A21B-88F4EE6E78C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7875DBFF-6B8A-4B74-B8A2-E2DBF657CA03}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E9078DA-0C69-47B0-9637-2734104BD217}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8EBAAB89-A5CD-40C4-A0AB-3275317351D1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8AD62-3D64-4F7B-B24D-2C785AE5449B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{372685AA-9F61-43F5-BEBA-A60900E228EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5328D226-7057-4B06-9E4A-7829BFA7CA78}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\leosrv.bkwo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\leosrv.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7875DBFF-6B8A-4B74-B8A2-E2DBF657CA03}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{14E52265-CCA3-4F78-A21B-88F4EE6E78C1}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hjoqor"=-
"xcvwer"=-


%WINDOWS%\mscfg32.dll


%SYSTEM%\gnjsjc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c770fbc-cc2f-4acd-93e8-e6f0594307fd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5c770fbc-cc2f-4acd-93e8-e6f0594307fd}"="cariniana"



Version 2.271 (December 17, 2007)


%WINDOWS%\websrc32.dll



Version 2.270 (December 17, 2007)


%SYSTEM%\cjuvwa.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0123eb75-964c-4cb3-b796-431cc9099570}"="disgorging"

%WINDOWS%\corpol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E330678D-C3B1-4AC1-AD7B-2F9CAC58F889}]



Version 2.269 (December 15, 2007)


%WINDOWS%\pmspl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38583F22-1B12-4893-9D7A-BD3FA2A114C7}]



Version 2.268 (December 14, 2007)


%SYSTEM%\wowlze.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{c0ca766d-060c-48e1-b536-205e321bd174}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c0ca766d-060c-48e1-b536-205e321bd174}"="geosphere"


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtect 3.9.lnk
%STARTMENU%\VirusProtect 3.9.lnk
%STARTMENU%\Programs\VirusProtect 3.9\
%DESKTOP%\VirusProtect 3.9.lnk
%PROGRAMFILES%\VirusProtect 3.9\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BD06CA9-D39D-470C-AD69-40B2D20ED44E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1FCE299D-2509-4156-8F35-737685DA33D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{477C7CD6-CAAD-43F5-96FB-C8F0F580F7E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A878A6E-E373-4F79-9B72-F6E3B6573FA4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{559FB885-1610-4359-B22F-CE0A0C7B1220}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{582ECCC8-C5BC-4EC4-8B0A-40274533088F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7060E07A-79A7-492E-8716-685840C41D3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D93B305-D932-45FF-B484-B96BAF433B18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90E25318-2612-48DB-AD52-4D64B1E79368}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91335813-BFA8-493C-9ED5-E76A4F65F093}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A44471D-1B69-4834-881C-E8E85D198186}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A71C08E5-E038-4672-943F-B386DE479944}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B20B249C-97C3-43F4-A560-A2C5239FBC50}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BD94CBD6-0B47-4327-8192-23BA274F7FD3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F761F695-FD28-42D3-A669-C3FC8309A6F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE2D4E30-10F9-4F16-B2D9-4D7A02F0AF34}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D2F6E4C0-349A-4A64-A773-C14661D5A9E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtect 3.9.exe 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtect 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtect 3.9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtect 3.9"=-


O2 - BHO: (no name) - {69B98C68-D2B8-4A4E-9CB7-E85B6F3A7014} - C:\Program Files\Online Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69B98C68-D2B8-4A4E-9CB7-E85B6F3A7014}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69B98C68-D2B8-4A4E-9CB7-E85B6F3A7014}]


O3 - Toolbar: IE Custom Tools - {F2BADA0D-FD61-45EF-A994-64A073FD6613} - C:\Program Files\Online Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2BADA0D-FD61-45EF-A994-64A073FD6613}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F2BADA0D-FD61-45EF-A994-64A073FD6613}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{F2BADA0D-FD61-45EF-A994-64A073FD6613}=-


%PROGRAMFILES%\Helper\
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - C:\Program Files\Helper\mattsearch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684BB}]



Version 2.267 (December 13, 2007)

Added: IEDFix.exe tool to remove IE Defender keys and BHO from registry.

%SYSTEM%\sysvideo32.dll



Version 2.266 (December 13, 2007)


%WINDOWS%\msvideo.dll
O2 - BHO: Video - {80590BC5-F4BA-4AD1-B216-C19EE86E2A77} - C:\WINDOWS\msvideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\msvideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msvideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]



Version 2.265 (December 12, 2007)


%WINDOWS%\windivx.dll
O2 - BHO: Video - {F5E81149-92B2-47D2-A12B-1B966AB46EA7} - C:\WINDOWS\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]



Version 2.264 (December 12, 2007)


%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]



Version 2.263 (December 11, 2007)


%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{BC462E4B-C520-4CA9-B1EC-A7DD36FD6D0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BC462E4B-C520-4CA9-B1EC-A7DD36FD6D0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BC462E4B-C520-4CA9-B1EC-A7DD36FD6D0A}]



Version 2.262 (December 11, 2007)


%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]



Version 2.261 (December 11, 2007)


%WINDOWS%\jokvip.exe
%WINDOWS%\blopenv???.dll
%WINDOWS%\retnsrp.dll
%WINDOWS%\nopzet.dll
%WINDOWS%\leorop.dll
O2 - BHO: OFK System - {29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A} - C:\WINDOWS\blopenvtlv.dll
O3 - Toolbar: The retnsrp - {5FCD26F2-55C1-40F3-838A-FB4FD8833A53} - C:\WINDOWS\retnsrp.dll
O21 - SSODL: nopzet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopzet.dll
O21 - SSODL: leorop - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\leorop.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A914309-35E8-4A15-A175-56F7C7631A5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4E7132F-BC0F-4464-81AC-25F677AA7500}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18A7928B-2F6D-4B65-8DBB-96579CE0702D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D2CF7C5-E65C-470A-86FE-56C68CF07CBD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31820FB5-5CBD-49FF-92AD-795165A01C92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D7FDFC0-2192-4150-B573-DEE0661876C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F48D75B5-D574-4059-8D6B-6FA61DC0EAE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{88BB4245-F609-48CF-9C95-FAE9735037F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E8C85D6-5E9F-467B-896E-7127AED75504}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DD0501B8-8D05-446E-A510-EDCC0E43618D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.blos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"nopzet"=-
"leorop"=-


%ProgramFiles%\IECodec\
O2 - BHO: IECodecBHO - {4507C219-24AA-4813-9561-A2003F9920C3} - C:\Program Files\IECodec\IECodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA5EAB81-9E79-4751-8E06-3E68FF0CFFB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7C12A866-F10B-43B4-A9D0-8857C318AF17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4507C219-24AA-4813-9561-A2003F9920C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec]
[-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL]
[-HKEY_CURRENT_USER\Software\Classes\AppID\{9F264A67-6126-451A-8D14-D6EE64364CD0}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{4507C219-24AA-4813-9561-A2003F9920C3}]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1]



Version 2.260 (December 10, 2007)


%SYSTEM%\uglgs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76fbb79c-2ec6-4962-a324-fd4362588e1c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{76fbb79c-2ec6-4962-a324-fd4362588e1c}"="graphologists"

%SYSTEM%\ncrjf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}"="caribi"

%SYSTEM%\tvtpwp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}"="eaton"

O2 - BHO: (no name) - {E8249E69-A809-4544-832F-64EB65747A92} - C:\Program Files\Online Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E8249E69-A809-4544-832F-64EB65747A92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8249E69-A809-4544-832F-64EB65747A92}]

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}]



Version 2.259 (December 09, 2007)


%WINDOWS%\stream32a.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\stream32a.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D23D68-9E03-4FF0-8035-C6184C8784EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{60B18D81-366A-4156-83B9-CF310ED9A8B7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stream32a.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]


%WINDOWS%\vipext???.dll (Already removed)
O2 - BHO: OFK System - {014F04C1-4440-4901-9A39-D08B116C1BA0} - C:\WINDOWS\vipextgpk.dll
O3 - Toolbar: The voipwet - {476B38B7-6E7C-46B4-8080-F61ED0E814F2} - C:\WINDOWS\voipwet.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{014F04C1-4440-4901-9A39-D08B116C1BA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{476B38B7-6E7C-46B4-8080-F61ED0E814F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7ADB274-7419-4788-906D-C880FBAD11B9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEEEB14B-DB9F-48BB-B56D-CCDA3B942592}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{209A3C3B-B2C9-4451-9DD8-7B1C585ACC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25474AF2-E3DE-4E68-8DE8-0B0786735E01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5846BDF0-1EBB-4112-B601-2DA11EEF610E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CE5A74B-1E8B-4FD5-8C10-F49A2092FF8A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF809BE5-B8E2-4CD1-92DB-68129F895A64}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{13FD02D1-7E01-4CEA-B81D-595847E04645}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4795C864-D705-4009-B0A2-5F432FE6B61B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5383337F-EEC2-4B25-9C42-8992B49C7AFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bmrl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{014F04C1-4440-4901-9A39-D08B116C1BA0}]




Version 2.258 (December 04, 2007)


%SYSTEM%\ymmzwd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{075a465d-0af2-4b79-8db3-2fda0fd8d74c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{075a465d-0af2-4b79-8db3-2fda0fd8d74c}"="arsenicism"

%SYSTEM%\zcwlnic.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d66c22b6-2217-4d1a-9a90-1a54de1fc706}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d66c22b6-2217-4d1a-9a90-1a54de1fc706}"="edgers"


%WINDOWS%\vipext???.dll
O2 - BHO: MSVPS System - {00A00BA9-9D58-4B56-8FC6-C280650A8BD7} - C:\WINDOWS\vipextpnk.dll
O3 - Toolbar: The voipwet - {167F6405-019D-4F32-8FBE-23B3C63CD8FD} - C:\WINDOWS\voipwet.dll
O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll (Already removed)
O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{167F6405-019D-4F32-8FBE-23B3C63CD8FD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EB24324-3394-4C5F-B69C-744A74797952}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C37AC-F6DC-4C75-B61A-8F86BC5A9E9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{133621C3-9F52-4497-A814-97D268F8CACE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{36009226-067D-47C0-A497-7B2E5D3FAF03}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63115489-CFBF-4B7F-8B2F-EC1811041239}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A98BEE2D-F5D8-4BBB-B041-077CEFF0CA41}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE58E4D5-E8E1-4F59-AC3F-6315810A7889}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{603C15E0-CC27-45BB-82FD-8B2B6143E574}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A930694-495D-4C93-A483-D72FEF0EF1CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EFD7B225-FD88-40C7-931F-1FEEA9585D5C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bros]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{167F6405-019D-4F32-8FBE-23B3C63CD8FD}"=-



Version 2.257 (December 02, 2007)


%SYSTEM%\sysdivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\sysdivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609F107D-88EE-4D19-B56F-6C21A3E9DC1F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F94E2B67-3D7A-4F94-AF35-5BBEDAAD3AC4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sysdivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]


%WINDOWS%\nretcip.exe
%WINDOWS%\vipextoxn.dll
%WINDOWS%\voipwet.dll
%WINDOWS%\jetctrl.dll
%WINDOWS%\kopmet.dll
O2 - BHO: MSVPS System - {5EF40AC5-1BBE-4436-A9E3-F129C0D605D8} - C:\WINDOWS\vipextoxn.dll
O3 - Toolbar: The voipwet - {D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C} - C:\WINDOWS\voipwet.dll
O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll
O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C5B3552-E18F-45BE-BEA8-78ACEC1F2C6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D79308A2-F924-4CD6-A52A-158C68EF41F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{602F5204-5CD4-4160-9506-2CA8266FAC4D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60C84877-62D8-4996-88E5-BAF3D115F09F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AEA32A1-63D2-4DE6-A1F8-C2132972C15F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9924DC07-F8D2-4A19-A396-9871B55612D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B039EF74-B33F-468E-BE93-2A4F0D61DF59}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{212B4E0F-BEA8-4894-800D-2C7E2EF097AD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3DD88B10-20E4-4085-BB2C-5A58B49910A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5216FD0F-3915-4F95-95CF-4F09659F58C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.btgn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"jetctrl"=-
"kopmet"=-


%WINDOWS%\oprevpfm.dll
O2 - BHO: MSVPS System - {3CE12841-9438-48A0-9DA9-D3D2D3D562CC} - C:\WINDOWS\oprevpfm.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]

%WINDOWS%\werbetpwg.dll (already removed)
O2 - BHO: MSVPS System - {7EB8B2AC-28EE-45F1-9834-418FC9D72DDF} - C:\Windows\werbetpwg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]

%WINDOWS%\hdtip.dll (already removed)
O3 - Toolbar: The hdtip - {E3E087D3-CA1D-4ECA-9960-D85944C2554C} - C:\Windows\hdtip.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3E087D3-CA1D-4ECA-9960-D85944C2554C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E3E087D3-CA1D-4ECA-9960-D85944C2554C}"=-




Version 2.256 (November 26, 2007)


%SYSTEM%\ivrllc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b585105c-0e84-4ef0-9c6a-fbe134a72945}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b585105c-0e84-4ef0-9c6a-fbe134a72945}"="ineffulgent"


%SYSTEM%\PowerVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]


O3 - Toolbar: IE Custom Tools - {EFAF6EA3-615D-4F83-8748-2F7A576FCEA6} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}=-



Version 2.255 (November 26, 2007)


%WINDOWS%\monhop.exe
%WINDOWS%\werbet???.dll
%WINDOWS%\hdtip.dll
%WINDOWS%\gormet.dll
%WINDOWS%\pmkret.dll
O2 - BHO: MSVPS System - {A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE} - C:\WINDOWS\werbetdqw.dll
O3 - Toolbar: The hdtip - {85B2F289-7128-4C5A-A330-F9FC01432D3A} - C:\WINDOWS\hdtip.dll
O21 - SSODL: gormet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\gormet.dll
O21 - SSODL: pmkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\pmkret.dll

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F25839C-CB93-4394-A938-2194851C544F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85B2F289-7128-4C5A-A330-F9FC01432D3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9024FB63-4FBA-4A65-B607-5D13B76CF13F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19D21F2D-455C-4AAA-8DF0-58F3D76962B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D78A01B-FD57-464B-B5F2-BFC1702F26DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A5ED75E-2562-4266-A85D-4D66E33C50FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B983DE8B-60CD-4F7F-B09A-F8A33B26845C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA978B5D-E354-47FD-9E95-ACE61FC665DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7AAFD5DA-55D0-4FAB-8AEF-9643707042F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE73C3E4-88F7-41A0-AF79-87BE6826B8DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F7A3BB37-D5C6-4946-AF22-DFCF804C67AB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.bpnv]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.ToolBar.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{85B2F289-7128-4C5A-A330-F9FC01432D3A}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gormet"=-
"pmkret"=-


%WINDOWS%\oprevxlw.dll
O2 - BHO: MSVPS System - {27A5292F-0C87-4E81-A34E-3131DBFCE994} - C:\WINDOWS\oprevxlw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]

%WINDOWS%\bonsws.dll
O3 - Toolbar: The bonsws - {2181E54F-274D-48B7-9E51-BC374933CD24} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2181E54F-274D-48B7-9E51-BC374933CD24}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2181E54F-274D-48B7-9E51-BC374933CD24}"=-

%WINDOWS%\oprevgkx.dll
O2 - BHO: MSVPS System - {1658DABA-FC4C-46C6-BC48-246CFEA0C436} - C:\WINDOWS\oprevgkx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]

O3 - Toolbar: The bonsws - {3FDA21ED-312C-44DD-9030-A2DC90FD1CCD} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}"=-

%WINDOWS%\oprevnpx.dll
O2 - BHO: MSVPS System - {F675EED8-4A4B-4A11-801B-08297749B83D} - C:\WINDOWS\oprevnpx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F675EED8-4A4B-4A11-801B-08297749B83D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F675EED8-4A4B-4A11-801B-08297749B83D}]

O3 - Toolbar: The bonsws - {05E9894E-9C5F-454B-A6E1-7BEF518EC87E} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}"=-

%WINDOWS%\ddkret.dll
O21 - SSODL: ddkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ddkret.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ddkret"=-

%WINDOWS%\nopctrl.dll
O21 - SSODL: nopctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"nopctrl"=-

%WINDOWS%\sawkip.exe
%WINDOWS%\jokwmp.dll
O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BA27973-068D-4F85-BE84-1251E0B20FD3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6BA27973-068D-4F85-BE84-1251E0B20FD3}"=-

%WINDOWS%\popnetmtq.dll
O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A78E352-B1FA-4C18-9C48-96DD03979770}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A78E352-B1FA-4C18-9C48-96DD03979770}]

%WINDOWS%\rmvgor.dll
O21 - SSODL: rmvgor - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\rmvgor.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rmvgor"=-

%WINDOWS%\sapnet.dll
O21 - SSODL: sapnet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\sapnet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"sapnet"=-

O3 - Toolbar: The jokwmp - {AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34} - C:\WINDOWS\jokwmp.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}"=-

%WINDOWS%\popnetkqw.dll
O2 - BHO: MSVPS System - {A4D00A75-F69A-49FD-9058-AB925712CCFF} - C:\WINDOWS\popnetkqw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]

%WINDOWS%\popnetnlf.dll
O2 - BHO: MSVPS System - {AEAAD087-D66D-4FA3-A366-8F47C32E9E5F} - C:\WINDOWS\popnetnlf.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]



Version 2.254 (November 25, 2007)


%SYSTEM%\PowerVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]


O2 - BHO: (no name) - {23B760D6-C98B-450B-9B32-26C7775CDF83} - C:\Program Files\Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23B760D6-C98B-450B-9B32-26C7775CDF83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23B760D6-C98B-450B-9B32-26C7775CDF83}]

O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70CC76D5-A4EE-4F25-9931-B109A63E298E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{70CC76D5-A4EE-4F25-9931-B109A63E298E}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{70CC76D5-A4EE-4F25-9931-B109A63E298E}=-

%SYSTEM%\bubbj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}"="exegeses"

%SYSTEM%\ijftc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}"="bigfeet"

%SYSTEM%\fftktmk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}"="doglike"

%SYSTEM%\moywh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"="haeckel"

%SYSTEM%\ucmbegr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d653e105-3e53-480a-b129-54d957d174bb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d653e105-3e53-480a-b129-54d957d174bb}"="groutiest"

%SYSTEM%\rldyt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0883848-1466-4470-a418-3fe7d36694b9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b0883848-1466-4470-a418-3fe7d36694b9}"="bemocked"



Version 2.253 (November 14, 2007)


%ProgramFiles%\RichVideoCodec

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtect 3.8.lnk
%STARTMENU%\VirusProtect 3.8.lnk
%STARTMENU%\Programs\VirusProtect 3.8\
%DESKTOP%\VirusProtect 3.8.lnk
%PROGRAMFILES%\VirusProtect 3.8\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21688E5D-A895-4B60-B127-B76607420334}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{40E563B2-61B2-4215-819A-A7E24CF8AA3E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45FBEFBF-E8B6-44A5-B0A1-A143E1A74816}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5146B43E-B36D-4A2A-B617-CC05CC500150}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B8BED0F-5F18-4051-9908-C5C569A1AAE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63667718-EBF2-4CAB-B1E8-994D41589C24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{972F0BE3-976F-40B8-8EB4-88A25987416E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F80EA2D-53CF-4AA5-A154-F4FBF1EF6A5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A35F8FAC-755D-4F90-A5D3-F7E18D9EB100}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C269F4C1-7558-4DFC-9FB6-4C149B482586}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE92A296-3142-493C-B64E-6ED73EAFB9AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7C0DF6C-91FF-48BD-AD98-E35769394138}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8EC2704-B249-4495-A7A4-A90857BDDF4D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D91E9F36-9E44-44AB-803C-0D941FDA7988}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0757BDD-69BE-4C3F-AFC6-50D6524FA9B6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2F8C877-B06C-4B5E-95E7-AACFC9E8219D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3B8E549E-0C73-4AAB-8939-5EA2ED102CC6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtect 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtect 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtect 3.8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtect 3.8"=-



Version 2.252 (November 10, 2007)


%WINDOWS%\qdertu.exe

%WINDOWS%\ipwypkmg.dll
O2 - BHO: MSVPS System - {7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2} - C:\WINDOWS\ipwypkmg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19A236AD-F37B-40A8-A11A-7E9ABFD56CB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8955B427-6C0C-413E-A0A7-0DC2948ADA3D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE1A8EBF-5AC3-488E-8226-F38C167B6C5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]

%WINDOWS%\bonrep.dll (Already removed)
O3 - Toolbar: The bonrep - {2357FC16-D8FC-4BF6-AFCA-573F9BD52644}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2357FC16-D8FC-4BF6-AFCA-573F9BD52644}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0E1B3BA-3D8E-456B-BCC5-163B09308240}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F575BBB6-A0A5-42C1-8406-CEDC8579FD75}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7586FC82-2EF8-4731-BAE1-22607AC0CC4A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E317C0F8-81DD-4AE8-87C7-B575A64B3696}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02A78E77-525D-4AF0-A822-CD04678CD638}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B141181-E967-42FD-AD64-52F283E12AAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7B0446D3-68BB-4A03-B907-EEE372655460}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichVideoCodec]

%WINDOWS%\advrepkon.dll
O2 - BHO: MSVPS System - {6BE306E6-555D-41B1-98FF-6453622F4F4B} - C:\WINDOWS\advrepkon.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]

%WINDOWS%\advrepgds.dll
O2 - BHO: MSVPS System - {FC91E698-C4BA-4564-9B85-659E38FCE154} - C:\WINDOWS\advrepgds.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC91E698-C4BA-4564-9B85-659E38FCE154}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC91E698-C4BA-4564-9B85-659E38FCE154}]

%WINDOWS%\ipwypwpk.dll
O2 - BHO: MSVPS System - {1BD6031F-BD9B-4DDF-A164-1D3A6701F374} - C:\WINDOWS\ipwypwpk.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]



Version 2.251 (November 10, 2007)


%SYSTEM%\VideoMP3.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\VideoMP3.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64130BE8-2B67-4A65-9CA5-1CC6948C1471}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E54D728-1FA3-4125-B468-C8B43C123E65}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoMP3.MP3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]

%SYSTEM%\fnczfh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6fddce1-36ae-41c1-87d3-f49e514273d4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6fddce1-36ae-41c1-87d3-f49e514273d4}"="citrinous"

%SYSTEM%\xovdzz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1977ce08-a38f-43db-a856-f4aa6122131b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1977ce08-a38f-43db-a856-f4aa6122131b}"="bothrops"

%SYSTEM%\vtewupi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{831b4681-6ab9-436c-b2f1-6139158e3a91}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{831b4681-6ab9-436c-b2f1-6139158e3a91}"="eulalia"



Version 2.250 (November 05, 2007)


O2 - BHO: (no name) - {D1BD315B-8706-4C47-B443-A0784865CD04} - C:\Program Files\Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1BD315B-8706-4C47-B443-A0784865CD04}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1BD315B-8706-4C47-B443-A0784865CD04}]

%WINDOWS%\advreprwd.dll
O2 - BHO: MSVPS System - {7A22D62B-562F-4D55-8B1E-3AAA6C2BA688} - C:\WINDOWS\advreprwd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]

%WINDOWS%\advrepvto.dll
O2 - BHO: MSVPS System - {E6E59F48-7BF8-4BEE-B906-273526C25DA4} - C:\WINDOWS\advrepvto.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]

%WINDOWS%\movctrlknq.dll
O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC546B33-036A-41DA-B1CC-C1D15659520E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC546B33-036A-41DA-B1CC-C1D15659520E}]

%WINDOWS%\ipwypktx.dll
O2 - BHO: MSVPS System - {9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E} - C:\WINDOWS\ipwypktx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27B9F7C0-3728-48DB-BEEE-FA1279B7E62C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC9A032C-651A-41C7-AA02-781AF6F0B132}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FB301567-C982-4C81-A21A-BDAF829299D0}]

%WINDOWS%\bonrep.dll
O3 - Toolbar: The bonrep - {6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86B93136-309C-4763-8F63-DD95DA7D4A91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F3EEF4B8-F62A-471A-8565-48BDF3BFE163}]

%PROGRAMFILES%\VideoAccessCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55C68B1E-8FE7-46FE-8269-FBDE29BF6300}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B98015-F9F4-4B36-A9D8-EE9BCA7C2AC6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C14EEF3C-32F1-47DF-AFE1-ED8EEC9F0C0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD2D9F83-5761-4291-B713-A2C5044DD722}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BCF3C064-B623-4934-A025-56F151FA3778}]

%WINDOWS%\neobus.dll
O21 - SSODL: neobus - {5D1C9A4F-438B-4C5C-BE66-FAAA08D4BF49} - C:\WINDOWS\neobus.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"neobus"=-

%WINDOWS%\kbdctrl.dll
O21 - SSODL: kbdctrl - {A3023D18-B93F-4892-B89B-56FB36382B8F} - C:\WINDOWS\kbdctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"kbdctrl"=-



Version 2.249 (November 05, 2007)


%SYSTEM%\eulbn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{48a7a70a-e118-4506-a373-c9d4e8a212a1}"="arturo"

%WINDOWS%\advrepnok.dll
O2 - BHO: MSVPS System - {CFF8726A-9262-441C-8163-C6371E9EDE47} - C:\WINDOWS\advrepnok.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF8726A-9262-441C-8163-C6371E9EDE47}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFF8726A-9262-441C-8163-C6371E9EDE47}]

%SYSTEM%\mp3avi.dll
O2 - BHO: Mp3 Video - {D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF} - C:\WINDOWS\system32\mp3avi.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\mp3avi.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mp3avi.MP3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]



Version 2.248 (November 04, 2007)


%SYSTEM%\bqrcr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2dcea392-ea10-4e6d-aba4-329ac377119c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2dcea392-ea10-4e6d-aba4-329ac377119c}"="brachypyramid"

%PROGRAMFILES%\EZVideo\
%STARTMENU%\Programs\EZVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EZVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZVideo]
[-HKEY_CURRENT_USER\Software\EZVideo]

%SYSTEM%\a3gpcodec.dll
O2 - BHO: 3GP - {5D67E2E7-0C2B-4491-87C4-37F2AC6033D2} - C:\WINDOWS\system32\a3gpcodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\a3gpcodec.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\a3gpcodec.a3GP]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]

%DESKTOP%\IE Defender 2.3.lnk
%STARTMENU%\Programs\IE Defender 2.3.lnk
%PROGRAMFILES%\IE Defender
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Defender]
[-HKEY_CURRENT_USER\Software\IEDefender]



Version 2.247 (November 03, 2007)


Update, due to legit software (XunLei, a Chinese downloader) , using the same CLSID as the infection, this one is not removed anymore:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]



%SYSTEM%\dx50codec.dll
O2 - BHO: RealMedia - {87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95} - C:\WINDOWS\system32\dx50codec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\dx50codec.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dx50codec.RealMedia]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]



%SYSTEM%\yneid.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41591d7f-9e25-4bd0-af53-9908fcf3a738}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{41591d7f-9e25-4bd0-af53-9908fcf3a738}"="complacential"



%PROGRAMFILES%\Image Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image Add-on]

O2 - BHO: (no name) - {43BF8E0C-886D-4103-8DDB-2DFE0E8A0168} - C:\Program Files\Image Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]



%WINDOWS%\bndsrpfn.dll

%WINDOWS%\advrepdow.dll
O2 - BHO: MSVPS System - {CF368FC4-3241-409B-B1D6-0EA4FE33A555} - C:\WINDOWS\advrepdow.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]

%WINDOWS%\advrepgpd.dll
O2 - BHO: MSVPS System - {93205C3F-1221-43F4-847F-007C6A4CE9A5} - C:\WINDOWS\advrepgpd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]

%WINDOWS%\sdrmod.dll
O3 - Toolbar: The sdrmod - {210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.ToolBar.1]

%WINDOWS%\hupsrv.dll
O21 - SSODL: hupsrv - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hupsrv.dll

%WINDOWS%\bindmod.dll
O21 - SSODL: bindmod - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bindmod.dll



%SYSTEM%\proper.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\proper.exe

%SYSTEM%\bronto.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\System32\bronto.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D27987B8-7244-4DE0-AE10-39B826B492F1}]

%SYSTEM%\winter.exe
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe

%USERPROFILE%\StartMenu\Program\Startup\infos.exe
O4 - Startup: infos.exe

%AllUsers%\StartMenu\Program\Startup\autos.exe
O4 - Global Startup: autos.exe

%SYSTEM%\skuns.dat
O20 - AppInit_DLLs: C:\WINDOWS\System32\skuns.dat



Version 2.246 (October 31, 2007)


%SYSTEM%\XunLeiBHO_Now.dll
O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\WINDOWS\system32\XunLeiBHO_Now.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\XunLeiBHO_Now.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xunleiBHO_Now.XunLei]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]



Version 2.245 (October 30, 2007)


%WINDIR%\movctrlqtn.dll
O2 - BHO: MSVPS System - {24038BE3-4EF2-41E2-A603-4CE3BDD9E874} - C:\WINDOWS\movctrlqtn.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]

O3 - Toolbar: The nssfrch - {1699137C-B90E-4488-97BC-575C896C2B5C} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1699137C-B90E-4488-97BC-575C896C2B5C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1699137C-B90E-4488-97BC-575C896C2B5C}"=-

%WINDIR%\movctrlnkd.dll
O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]

O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}"=-

%WINDIR%\movctrlwxq.dll
O2 - BHO: MSVPS System - {90CF5384-7C70-4CD6-A30D-B2F14537B5C3} - C:\WINDOWS\movctrlwxq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]

O3 - Toolbar: The nssfrch - {7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}"=-



Version 2.244 (October 30, 2007)


%SYSTEM%\IntelVideo.dll
%SYSTEM%\sysinit32.exe
O2 - BHO: IntelVideoCodec - {04F7FAC5-F506-4F29-9094-9CB9144B192C} - C:\WINDOWS\system32\IntelVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IntelVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IntelVideo.IntelVideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]



Version 2.243 (October 29, 2007)


O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B}"=-

%SYSTEM%\tkosvv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{837d024d-e0fb-44e8-acb1-24ec2309c487}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{837d024d-e0fb-44e8-acb1-24ec2309c487}"="frumps"

%SYSTEM%\fwzozx.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{c74f7434-a6e7-46c3-bf60-62a005074fe5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c74f7434-a6e7-46c3-bf60-62a005074fe5}"="barysilite"

%SYSTEM%\fqgwiw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3aea41ad-3ce4-48d9-acab-be40ad329e40}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3aea41ad-3ce4-48d9-acab-be40ad329e40}"="curing"



Version 2.242 (October 26, 2007)


%PROGRAMFILES%\Video Add-on\
%PROGRAMFILES%\Video Add-on Setup\

O3 - Toolbar: IE Custom Tools - {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}=-

O3 - Toolbar: IE Custom Tools - {062F3F8B-CB94-4D76-A98A-EF800A438F01} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{062F3F8B-CB94-4D76-A98A-EF800A438F01}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{062F3F8B-CB94-4D76-A98A-EF800A438F01}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{062F3F8B-CB94-4D76-A98A-EF800A438F01}=-

O3 - Toolbar: IE Custom Tools - {23ED2206-856D-461A-BBCF-1C2466AC5AE3} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23ED2206-856D-461A-BBCF-1C2466AC5AE3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{23ED2206-856D-461A-BBCF-1C2466AC5AE3}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{23ED2206-856D-461A-BBCF-1C2466AC5AE3}=-

O2 - BHO: (no name) - {B499D34E-58EF-4927-AB9F-7AF52B2C4C82} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]


%SYSTEM%\ugbtna.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}"="boardwalk"


%WINDIR%\bndsrfst.dll
%WINDIR%\bndsrsvk.dll
%WINDIR%\bndsrdkq.dll
%WINDIR%\bndsrgxt.dll
%WINDIR%\bndsrkwm.dll
%WINDIR%\bndsrtvd.dll
%WINDIR%\bndsrvnl.dll
%WINDIR%\bndsrwlq.dll
%WINDIR%\movctrlswd.dll
%WINDIR%\movctrlfqd.dll
%WINDIR%\ntspknlg.dll
%WINDIR%\ntspklqs.dll
%WINDIR%\ntspkfnd.dll

O2 - BHO: MSVPS System - {15272B08-F6FE-4E71-B2BD-A59AD23EBE3C} - C:\WINDOWS\bndsrfst.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]

O2 - BHO: MSVPS System - {05F79890-CFA6-4D53-87BC-2F390DA6645E} - C:\WINDOWS\bndsrsvk.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]

O2 - BHO: MSVPS System - {480598DD-AE28-48B7-82F7-6ADDA1AA6B66} - C:\WINDOWS\ntspknlg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]

O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]

O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]

O3 - Toolbar: The netadv - {D1413F77-5B69-4562-84E1-78F997794E9D} - C:\WINDOWS\netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1413F77-5B69-4562-84E1-78F997794E9D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D1413F77-5B69-4562-84E1-78F997794E9D}"=-

O3 - Toolbar: The netadv - {899B0EF2-E0BE-41BA-BB41-0ABFB232813C} - C:\WINDOWS\netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}"=-

%WINDOWS%\kthemup.exe
%WINDOWS%\nssfrch.dll
O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.ToolBar.1]

O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
O21 - SSODL: hstsys - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hstsys.dll
O21 - SSODL: bxsbang - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ocgrep.dll



Version 2.241 (October 24, 2007)


%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusRay 3.8.lnk
%STARTMENU%\VirusRay 3.8.lnk
%STARTMENU%\Programs\VirusRay 3.8\
%DESKTOP%\VirusRay 3.8.lnk
%PROGRAMFILES%\VirusRay 3.8\

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97C6E0E9-1D24-48CA-11E7-DC22C5308ABA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D723C81-2C9F-44DD-8F94-A2D3A06845E9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41FC2EBD-79F5-4FE0-8558-708DCB7FE255}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45DB217B-965D-4917-A653-C2A871534B4C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48A95844-A761-4D96-8191-0913D493823E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60FD2747-818B-4242-A041-4C1209F3D3A6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70F731FD-6C5F-4D46-A29C-6B97FABEF0D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77F6ABAA-C14B-4E0C-975E-0CFFA568B0BE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78AA9209-DED5-4F37-93A0-89FBEE57E4FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{869B656B-142E-47E6-B4F6-973D17E80BBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89F84A04-F5EF-4F4A-AF97-7DA43DD0371F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F9C1393-41D7-4BE1-8752-098BC97514D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9097FA96-8EFD-4D04-8024-C920AB56BBEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACD5D550-4481-4F05-B6D8-A78566BD81D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE096ECD-D62E-4B2D-BBA5-CBF9BFA4AB23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DDA20808-84A0-48C3-902A-7E31FF47EA6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9C4CBEB-7BDF-47FF-8EDF-D72B50BB50EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1AE427B0-E3B7-4D2E-A6B9-36605B0F214E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusRay 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRay 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRay 3.8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusRay 3.8"=-


%SYSTEM%\beahahl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb4c6870-721f-4989-9c90-8cbfa46d0298}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb4c6870-721f-4989-9c90-8cbfa46d0298}"="anomuran"

%SYSTEM%\dfrep.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab75cc7d-2751-4144-a278-5462d5a5884c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ab75cc7d-2751-4144-a278-5462d5a5884c}"="bokard"

%SYSTEM%\mxhfjy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7999c5e2-b500-4ba5-8e9a-99639eca65fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7999c5e2-b500-4ba5-8e9a-99639eca65fc}"="celtiberi"

%system%\gaaplp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}"="forayer"

%SYSTEM%\nczupfw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6d478c6-7961-4fe9-be4b-e621dd640112}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6d478c6-7961-4fe9-be4b-e621dd640112}"="benzaldoxime"

%SYSTEM%\clbrcek.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}"="inquisitionist"

%SYSTEM%\siiyal.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1adb94e-0dc6-487c-b274-981bee6301a1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e1adb94e-0dc6-487c-b274-981bee6301a1}"="armillifer"

%SYSTEM%\sttwrd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}"="designers"

%SYSTEM%\rrtrit.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}"="eurymus"



Version 2.240 (October 10, 2007)


%WINDIR%\bndsrvqt.dll

%SYSTEM%\flirek.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34ec76b6-53c4-4686-822f-910c790683fb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{34ec76b6-53c4-4686-822f-910c790683fb}"="evangeliarium"

%SYSTEM%\gdrtul.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a47e7ce0-263d-40aa-86bc-27c1f6433143}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a47e7ce0-263d-40aa-86bc-27c1f6433143}"="chinned"

%SYSTEM%\hteogat.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02e155c1-202c-43a5-a212-58bb67d4341c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{02e155c1-202c-43a5-a212-58bb67d4341c}"="bearlike"



Version 2.239 (October 06, 2007)


%SYSTEM%\fifzqip.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16be3225-e902-4d2a-ac98-aab162796927}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{16be3225-e902-4d2a-ac98-aab162796927}"="ataxics"

%SYSTEM%\hymww.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79cdca21-5055-4cae-b609-e1685ef55cf7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{79cdca21-5055-4cae-b609-e1685ef55cf7}"="hydria"

%SYSTEM%\veptlh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92050ffb-b796-4146-ae27-7e5e1d93b8a8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{92050ffb-b796-4146-ae27-7e5e1d93b8a8}"="endopsychic"

%PROGRAMFILES%\WinMsg\

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVe