Logfile of HijackThis v1.99.1
Scan saved at 17:43:52, on 22.1.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jussi\My Documents\HJT\HijackThis1991.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uta.fi/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Repair Registry Pro] C:\Program Files\Repair Registry Pro\RepairRegistryPro.exe -s
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft messenger] msnger.exe
O4 - HKCU\..\RunServices: [Microsoft messenger] msnger.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136714619260
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136714573554
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\fpj6031se.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Scan saved at 17:43:52, on 22.1.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jussi\My Documents\HJT\HijackThis1991.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uta.fi/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Repair Registry Pro] C:\Program Files\Repair Registry Pro\RepairRegistryPro.exe -s
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft messenger] msnger.exe
O4 - HKCU\..\RunServices: [Microsoft messenger] msnger.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136714619260
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136714573554
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\fpj6031se.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Vastaukset 10
Vanhimmat
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\fpj6031se.dll
Mutta ootele jos vaikka, tarkenpi silmäset löytää lisää.
Siirrä ensin se Hijackki omaan kansioon tonne
C:\HjT\HijackThis.exe
Merkkaa nuo sulje selain ja paina Fix checked
O4 - HKCU\..\Run: [Microsoft messenger] msnger.exe
O4 - HKCU\..\RunServices: [Microsoft messenger] msnger.exe
Sitte ota tuo
http://www.downloads.subratam.org/l2mfix.exe
Säästä se työpöydälle ja tuplaklikkaa sitä ja ensin Accept ja sitte Install
Työpöydälle ilmestyy l2mfix kansio.
Avaa se ja tuplaklikkaa l2mfix.bat
Valitse kohta 1 eli näppäät ykkösen ja Enter
Anna sen scannata valmiiks ja pistä ulostuleva logi tänne.
Tässä olis lisä tietoo aiheeseen.
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=1500000000000007&posting=22000000013479032
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\fpj6031se.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{0DA1EA3E-3D05-120A-CAA4-1F827105C8B4}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Resurssienhallinta"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{7AAFDB8C-34BB-46A4-B87A-B0EC535C1344}"=""
"{03666BE2-977E-43EA-9816-1CBFBB43573B}"=""
"{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}"=""
"{15632097-002E-4397-B4FA-6E4332CC53B6}"=""
"{93DD411E-5090-4512-8956-A292C32BF385}"=""
"{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}"=""
"{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}"=""
"{5815B26A-2E23-4B89-B65D-232FB1F4F458}"=""
"{7FB288F9-83C9-47E9-86F0-44858034D351}"=""
"{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}"=""
"{789DA91C-F920-4334-BDAD-AEA10A17C7C1}"=""
"{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}"=""
"{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}"=""
"{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}"=""
"{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}"=""
"{80DE1386-132B-4CEE-92F2-D97F9C2A6072}"=""
"{F6278807-3E90-4550-8698-11FCF561E3A4}"=""
"{14250587-ED2F-4EEB-AA59-468CA6A400DD}"=""
"{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}"=""
"{AE2EB7E2-41AD-4575-B999-0D804DB2350B}"=""
"{06E60B87-622C-4A02-AC41-A1920EA2E186}"=""
"{52B87208-9CCF-42C9-B88E-069281105805}"="Trojan Remover Shell Extension"
"{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}"=""
"{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
"{9DF6F7E5-C016-4751-A703-3482BC180D1F}"=""
"{73620316-5A1B-413C-8239-51C2F3E77EB8}"=""
"{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}"=""
"{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}"=""
"{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}"=""
"{9408201F-8F64-4D38-BEA4-78CA75B69D18}"=""
"{98D318C2-4447-42BE-8D6D-27E24100C145}"=""
"{242F8B32-1384-4791-B629-03A96403B2DE}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}\InprocServer32]
@="C:\\WINDOWS\\system32\\svgina.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}\InprocServer32]
@="C:\\WINDOWS\\system32\\pnrfnet.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}\InprocServer32]
@="C:\\WINDOWS\\system32\\nbtevent.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}\InprocServer32]
@="C:\\WINDOWS\\system32\\pqcn20.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}\InprocServer32]
@="C:\\WINDOWS\\system32\\mPpi32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}\InprocServer32]
@="C:\\WINDOWS\\system32\\sahannel.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}\InprocServer32]
@="C:\\WINDOWS\\system32\\lwasrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}\InprocServer32]
@="C:\\WINDOWS\\system32\\majter40.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}\InprocServer32]
@="C:\\WINDOWS\\system32\\ujrsdpia.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}\InprocServer32]
@="C:\\WINDOWS\\system32\\iIsacct.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}\InprocServer32]
@="C:\\WINDOWS\\system32\\nYrrhook.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}\InprocServer32]
@="C:\\WINDOWS\\system32\\mumtapi.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}\InprocServer32]
@="C:\\WINDOWS\\system32\\lrasrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}\InprocServer32]
@="C:\\WINDOWS\\system32\\cpmuid.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}\InprocServer32]
@="C:\\WINDOWS\\system32\\csyptdll.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}\InprocServer32]
@="C:\\WINDOWS\\system32\\ujrfaxa.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}\InprocServer32]
@="C:\\WINDOWS\\system32\\cacdll.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}\InprocServer32]
@="C:\\WINDOWS\\system32\\svgtab.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}\InprocServer32]
@="C:\\WINDOWS\\system32\\rlpwsx.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}\InprocServer32]
@="C:\\WINDOWS\\system32\\wjaservc.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}\InprocServer32]
@="C:\\WINDOWS\\system32\\wuhatm.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}\InprocServer32]
@="C:\\WINDOWS\\system32\\nnrssl.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}\InprocServer32]
@="C:\\WINDOWS\\system32\\psdx5016.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}\InprocServer32]
@="C:\\WINDOWS\\system32\\mjutilse.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}\InprocServer32]
@="C:\\WINDOWS\\system32\\iSsacct.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\drlay.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
dpl100.dll Thu 27 Oct 2005 21.37.46 A.... 86 016 84,00 K
dpu10.dll Thu 27 Oct 2005 21.37.44 A.... 294 912 288,00 K
dpu11.dll Thu 27 Oct 2005 21.37.44 A.... 294 912 288,00 K
dpugui10.dll Thu 27 Oct 2005 21.37.48 A.... 53 248 52,00 K
dpugui11.dll Thu 27 Oct 2005 21.37.46 A.... 593 920 580,00 K
dpus11.dll Thu 27 Oct 2005 21.37.44 A.... 339 968 332,00 K
dpv11.dll Thu 27 Oct 2005 21.37.44 A.... 57 344 56,00 K
dtu100.dll Thu 27 Oct 2005 21.37.44 A.... 200 704 196,00 K
fpj603~1.dll Sat 21 Jan 2006 22.34.04 ..S.R 237 007 231,45 K
n2r20c~1.dll Sun 22 Jan 2006 9.13.14 ..S.R 237 143 231,58 K
sahannel.dll Sun 22 Jan 2006 10.14.48 ..... 237 007 231,45 K
vsdata.dll Tue 15 Nov 2005 0.50.30 A.... 83 720 81,76 K
vsinit.dll Tue 15 Nov 2005 0.50.42 A.... 141 064 137,76 K
vsmonapi.dll Tue 15 Nov 2005 0.50.52 A.... 104 208 101,77 K
vspubapi.dll Tue 15 Nov 2005 0.50.56 A.... 227 088 221,77 K
vsregexp.dll Tue 15 Nov 2005 0.51.00 A.... 71 440 69,77 K
vsutil.dll Tue 15 Nov 2005 0.51.12 A.... 382 728 373,76 K
vsxml.dll Tue 15 Nov 2005 0.51.20 A.... 100 104 97,76 K
zlcomm.dll Tue 15 Nov 2005 0.51.40 A.... 79 624 77,76 K
zlcommdb.dll Tue 15 Nov 2005 0.51.44 A.... 71 440 69,77 K
20 items found: 20 files (2 H/S), 0 directories.
Total of file sizes: 3 893 597 bytes 3,71 M
Locate .tmp files:
C:\WINDOWS\SYSTEM32\
perfst~1.tmp Sun 30 Oct 2005 22.46.06 A.... 356 120 347,77 K
trj_nt~1.tmp Sat 7 Jan 2006 20.58.08 A.... 1 688 1,65 K
__dele~1.tmp Sun 22 Jan 2006 10.22.48 A.... 237 007 231,45 K
3 items found: 3 files, 0 directories.
Total of file sizes: 594 815 bytes 580,87 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C is Mainframe
Volume Serial Number is 1480-1D3D
Directory of C:\WINDOWS\System32
22.01.2006 09:13 237ÿ143 n2r20c9oef.dll
21.01.2006 22:34 237ÿ007 fpj6031se.dll
08.01.2006 12:04 dllcache
04.11.2004 15:40 10ÿ022 KGyGaAvL.sys
08.02.2003 14:53 Microsoft
3 File(s) 484ÿ172 bytes
2 Dir(s) 2ÿ988ÿ560ÿ384 bytes free
Jos sulla on jotain extraa siinä auki niin sammuta jo valmiiks koska kone käynnistyy uudestaan seuraavassa operaatiossa.
Avaa l2mfix kansio ja tuplaklikkaa l2mfix.bat
valitse kohta 2 eli näppäät 2 ja Enter
Sitte paina vaan jotain näppäintä ja kone käynnistyy uudestaan.
Kun kone on käynnistynny uudestaan,niin se jatkaa scannausta ja kun se on valmis,niin tulee taas logi ulos.
Jos logi ei aukee itestään notepadiin,niin aukase l2mfix kansio ja tuplaklikkaa second.bat
L2mfix 010406
Creating Account.
The command completed successfully.
Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Running From:
C:\WINDOWS\SYSTEM32
Killing Processes!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 496 'smss.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 568 'winlogon.exe'
Killing PID 568 'winlogon.exe'
Killing PID 568 'winlogon.exe'
Killing PID 568 'winlogon.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Killing PID 1912 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 3172 'rundll32.exe'
Killing PID 3172 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
Deleting: C:\WINDOWS\system32\fpj6031se.dll
Successfully Deleted: C:\WINDOWS\system32\fpj6031se.dll
Deleting: C:\WINDOWS\system32\n2r20c9oef.dll
Successfully Deleted: C:\WINDOWS\system32\n2r20c9oef.dll
Deleting: C:\WINDOWS\system32\sahannel.dll
Successfully Deleted: C:\WINDOWS\system32\sahannel.dll
Deleting: C:\WINDOWS\system32\__delete_on_reboot__guard.tmp
Successfully Deleted: C:\WINDOWS\system32\__delete_on_reboot__guard.tmp
msg11?.dll
0 file(s) copied.
Restoring Windows Update Certificates.:
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\fpj6031se.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\fpj6031se.dll
C:\WINDOWS\system32\n2r20c9oef.dll
C:\WINDOWS\system32\sahannel.dll
C:\WINDOWS\system32\__delete_on_reboot__guard.tmp
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}\InprocServer32]
@="C:\\WINDOWS\\system32\\svgina.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}\InprocServer32]
@="C:\\WINDOWS\\system32\\pnrfnet.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}\InprocServer32]
@="C:\\WINDOWS\\system32\\nbtevent.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}\InprocServer32]
@="C:\\WINDOWS\\system32\\pqcn20.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}\InprocServer32]
@="C:\\WINDOWS\\system32\\mPpi32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}\InprocServer32]
@="C:\\WINDOWS\\system32\\sahannel.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}\InprocServer32]
@="C:\\WINDOWS\\system32\\lwasrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}\InprocServer32]
@="C:\\WINDOWS\\system32\\majter40.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}\InprocServer32]
@="C:\\WINDOWS\\system32\\ujrsdpia.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}\InprocServer32]
@="C:\\WINDOWS\\system32\\iIsacct.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}\InprocServer32]
@="C:\\WINDOWS\\system32\\nYrrhook.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}\InprocServer32]
@="C:\\WINDOWS\\system32\\mumtapi.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}\InprocServer32]
@="C:\\WINDOWS\\system32\\lrasrv.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}\InprocServer32]
@="C:\\WINDOWS\\system32\\cpmuid.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}\InprocServer32]
@="C:\\WINDOWS\\system32\\csyptdll.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}\InprocServer32]
@="C:\\WINDOWS\\system32\\ujrfaxa.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}\InprocServer32]
@="C:\\WINDOWS\\system32\\cacdll.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}\InprocServer32]
@="C:\\WINDOWS\\system32\\svgtab.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}\InprocServer32]
@="C:\\WINDOWS\\system32\\rlpwsx.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}\InprocServer32]
@="C:\\WINDOWS\\system32\\wjaservc.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}\InprocServer32]
@="C:\\WINDOWS\\system32\\wuhatm.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}\InprocServer32]
@="C:\\WINDOWS\\system32\\nnrssl.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}\InprocServer32]
@="C:\\WINDOWS\\system32\\psdx5016.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}\InprocServer32]
@="C:\\WINDOWS\\system32\\mjutilse.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}\InprocServer32]
@="C:\\WINDOWS\\system32\\iSsacct.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\drlay.dll"
"ThreadingModel"="Apartment"
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{7AAFDB8C-34BB-46A4-B87A-B0EC535C1344}"=-
"{03666BE2-977E-43EA-9816-1CBFBB43573B}"=-
"{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}"=-
"{15632097-002E-4397-B4FA-6E4332CC53B6}"=-
"{93DD411E-5090-4512-8956-A292C32BF385}"=-
"{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}"=-
"{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}"=-
"{5815B26A-2E23-4B89-B65D-232FB1F4F458}"=-
"{7FB288F9-83C9-47E9-86F0-44858034D351}"=-
"{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}"=-
"{789DA91C-F920-4334-BDAD-AEA10A17C7C1}"=-
"{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}"=-
"{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}"=-
"{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}"=-
"{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}"=-
"{80DE1386-132B-4CEE-92F2-D97F9C2A6072}"=-
"{F6278807-3E90-4550-8698-11FCF561E3A4}"=-
"{14250587-ED2F-4EEB-AA59-468CA6A400DD}"=-
"{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}"=-
"{AE2EB7E2-41AD-4575-B999-0D804DB2350B}"=-
"{06E60B87-622C-4A02-AC41-A1920EA2E186}"=-
"{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}"=-
"{9DF6F7E5-C016-4751-A703-3482BC180D1F}"=-
"{73620316-5A1B-413C-8239-51C2F3E77EB8}"=-
"{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}"=-
"{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}"=-
"{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}"=-
"{9408201F-8F64-4D38-BEA4-78CA75B69D18}"=-
"{98D318C2-4447-42BE-8D6D-27E24100C145}"=-
"{242F8B32-1384-4791-B629-03A96403B2DE}"=-
[-HKEY_CLASSES_ROOT\CLSID\{7AAFDB8C-34BB-46A4-B87A-B0EC535C1344}]
[-HKEY_CLASSES_ROOT\CLSID\{03666BE2-977E-43EA-9816-1CBFBB43573B}]
[-HKEY_CLASSES_ROOT\CLSID\{0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F}]
[-HKEY_CLASSES_ROOT\CLSID\{15632097-002E-4397-B4FA-6E4332CC53B6}]
[-HKEY_CLASSES_ROOT\CLSID\{93DD411E-5090-4512-8956-A292C32BF385}]
[-HKEY_CLASSES_ROOT\CLSID\{F20F3EE6-B2F3-496A-8DF7-9C59271BFE68}]
[-HKEY_CLASSES_ROOT\CLSID\{04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F}]
[-HKEY_CLASSES_ROOT\CLSID\{5815B26A-2E23-4B89-B65D-232FB1F4F458}]
[-HKEY_CLASSES_ROOT\CLSID\{7FB288F9-83C9-47E9-86F0-44858034D351}]
[-HKEY_CLASSES_ROOT\CLSID\{EF6D0581-3B4C-4C54-8AC6-4390A3C156FF}]
[-HKEY_CLASSES_ROOT\CLSID\{789DA91C-F920-4334-BDAD-AEA10A17C7C1}]
[-HKEY_CLASSES_ROOT\CLSID\{6850553B-ECAB-44FD-AC9A-2DE8286A12F7}]
[-HKEY_CLASSES_ROOT\CLSID\{4E043C26-D787-4FA4-8DE2-D0C2714B4EC4}]
[-HKEY_CLASSES_ROOT\CLSID\{F043EC0D-34C5-4CD4-9EA7-499AD600BDE7}]
[-HKEY_CLASSES_ROOT\CLSID\{23BD7378-52C8-4D8B-8F7F-A43E2EA2A451}]
[-HKEY_CLASSES_ROOT\CLSID\{80DE1386-132B-4CEE-92F2-D97F9C2A6072}]
[-HKEY_CLASSES_ROOT\CLSID\{F6278807-3E90-4550-8698-11FCF561E3A4}]
[-HKEY_CLASSES_ROOT\CLSID\{14250587-ED2F-4EEB-AA59-468CA6A400DD}]
[-HKEY_CLASSES_ROOT\CLSID\{C0B92120-FFF2-4C65-9E2A-17D7184B7EAC}]
[-HKEY_CLASSES_ROOT\CLSID\{AE2EB7E2-41AD-4575-B999-0D804DB2350B}]
[-HKEY_CLASSES_ROOT\CLSID\{06E60B87-622C-4A02-AC41-A1920EA2E186}]
[-HKEY_CLASSES_ROOT\CLSID\{E8CCEFAD-16EF-4BB1-96D6-9591A18244A0}]
[-HKEY_CLASSES_ROOT\CLSID\{9DF6F7E5-C016-4751-A703-3482BC180D1F}]
[-HKEY_CLASSES_ROOT\CLSID\{73620316-5A1B-413C-8239-51C2F3E77EB8}]
[-HKEY_CLASSES_ROOT\CLSID\{7B1A8E7A-EF88-41BD-B346-9577212EE9F3}]
[-HKEY_CLASSES_ROOT\CLSID\{81CE4E15-E9D3-4247-A1B2-9E76F36379D2}]
[-HKEY_CLASSES_ROOT\CLSID\{943BDD3E-8BD8-4CF7-8E2D-570BE98E3901}]
[-HKEY_CLASSES_ROOT\CLSID\{9408201F-8F64-4D38-BEA4-78CA75B69D18}]
[-HKEY_CLASSES_ROOT\CLSID\{98D318C2-4447-42BE-8D6D-27E24100C145}]
[-HKEY_CLASSES_ROOT\CLSID\{242F8B32-1384-4791-B629-03A96403B2DE}]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/fpj6031se.dll (164 bytes security) (deflated 5%)
adding: dlls/n2r20c9oef.dll (164 bytes security) (deflated 6%)
adding: dlls/sahannel.dll (164 bytes security) (deflated 5%)
adding: dlls/__delete_on_reboot__guard.tmp (164 bytes security) (deflated 5%)
adding: backregs/04BBE1C8-D804-4CD7-A6E8-F53E33D62C5F.reg (212 bytes security) (deflated 70%)
adding: backregs/06E60B87-622C-4A02-AC41-A1920EA2E186.reg (212 bytes security) (deflated 70%)
adding: backregs/0E38B2DC-6AB9-4EAC-98A2-C83EAA74157F.reg (212 bytes security) (deflated 70%)
adding: backregs/14250587-ED2F-4EEB-AA59-468CA6A400DD.reg (212 bytes security) (deflated 70%)
adding: backregs/15632097-002E-4397-B4FA-6E4332CC53B6.reg (212 bytes security) (deflated 70%)
adding: backregs/23BD7378-52C8-4D8B-8F7F-A43E2EA2A451.reg (212 bytes security) (deflated 70%)
adding: backregs/242F8B32-1384-4791-B629-03A96403B2DE.reg (212 bytes security) (deflated 70%)
adding: backregs/4E043C26-D787-4FA4-8DE2-D0C2714B4EC4.reg (212 bytes security) (deflated 70%)
adding: backregs/5815B26A-2E23-4B89-B65D-232FB1F4F458.reg (212 bytes security) (deflated 70%)
adding: backregs/6850553B-ECAB-44FD-AC9A-2DE8286A12F7.reg (212 bytes security) (deflated 70%)
adding: backregs/73620316-5A1B-413C-8239-51C2F3E77EB8.reg (212 bytes security) (deflated 70%)
adding: backregs/789DA91C-F920-4334-BDAD-AEA10A17C7C1.reg (212 bytes security) (deflated 70%)
adding: backregs/7B1A8E7A-EF88-41BD-B346-9577212EE9F3.reg (212 bytes security) (deflated 70%)
adding: backregs/7FB288F9-83C9-47E9-86F0-44858034D351.reg (212 bytes security) (deflated 70%)
adding: backregs/80DE1386-132B-4CEE-92F2-D97F9C2A6072.reg (212 bytes security) (deflated 70%)
adding: backregs/81CE4E15-E9D3-4247-A1B2-9E76F36379D2.reg (212 bytes security) (deflated 70%)
adding: backregs/93DD411E-5090-4512-8956-A292C32BF385.reg (212 bytes security) (deflated 70%)
adding: backregs/9408201F-8F64-4D38-BEA4-78CA75B69D18.reg (212 bytes security) (deflated 70%)
adding: backregs/943BDD3E-8BD8-4CF7-8E2D-570BE98E3901.reg (212 bytes security) (deflated 70%)
adding: backregs/98D318C2-4447-42BE-8D6D-27E24100C145.reg (212 bytes security) (deflated 70%)
adding: backregs/9DF6F7E5-C016-4751-A703-3482BC180D1F.reg (212 bytes security) (deflated 70%)
adding: backregs/AE2EB7E2-41AD-4575-B999-0D804DB2350B.reg (212 bytes security) (deflated 70%)
adding: backregs/C0B92120-FFF2-4C65-9E2A-17D7184B7EAC.reg (212 bytes security) (deflated 70%)
adding: backregs/E8CCEFAD-16EF-4BB1-96D6-9591A18244A0.reg (212 bytes security) (deflated 70%)
adding: backregs/EF6D0581-3B4C-4C54-8AC6-4390A3C156FF.reg (212 bytes security) (deflated 70%)
adding: backregs/F043EC0D-34C5-4CD4-9EA7-499AD600BDE7.reg (212 bytes security) (deflated 70%)
adding: backregs/F20F3EE6-B2F3-496A-8DF7-9C59271BFE68.reg (212 bytes security) (deflated 70%)
adding: backregs/F6278807-3E90-4550-8698-11FCF561E3A4.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 72%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
Näyttäis että fixi toimi,pistä uus Hijack logi.
Logfile of HijackThis v1.99.1
Scan saved at 20:25:55, on 22.1.2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\mIRC\mirc.exe
C:\HJT\HijackThis1991.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uta.fi/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Repair Registry Pro] C:\Program Files\Repair Registry Pro\RepairRegistryPro.exe -s
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136714619260
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136714573554
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\fpj6031se.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Merkkaa ja Fix:saa
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\fpj6031se.dll (file missing)
sitte on ok.
unohtu....päivityksiä puuttuu koneesta Windows Update.