Download.fi > Tietoturva > Virustorjunta > SmitFraudFix > Muutoshistoria

Muutoshistoria ohjelmalle SmitFraudFix

<<Takaisin ohjelman lataussivulle

Muutokset v2.422 - v2.423

[-HKEY_CURRENT_USER\Software\ColdWare]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinProtect"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"winupdate.exe"=-
"ColdWare"=-
%SYSTEM%\AVR09.exe
%SYSTEM%\msa.exe

Muutokset v2.421 - v2.422

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B1D95A2-F547-4e5e-8902-622B08354622}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B1D95A2-F547-4e5e-8902-622B08354622}]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
%STARTMENU%\Advanced Virus Remover.lnk
%DESKTOP%\Advanced Virus Remover.lnk
%PROGRAMFILES%\AdvancedVirusRemover\
[-HKEY_CURRENT_USER\Software\AVR]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced Virus Remover"=-

Muutokset v2.418 - v2.419

%DESKTOP%\XP Deluxe Protector.lnk
%STARTMENU%\XP Deluxe Protector.lnk
%USERPROFILE%\XP Deluxe Protector\
[-HKEY_CURRENT_USER\Software\XP Deluxe Protector]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"xpprotect "=-

Muutokset v2.417 - v2.418

Update: WS2Fix v1.3
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\UnVirex.lnk
%ALLUSERSTARTMENU%\Programs\UnVirex\
%ALLUSERSTARTMENU%\Programs\UnVirex.lnk
%ALLUSERDESKTOP%\UnVirex.lnk
%PROGRAMFILES%\UnVirex\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEAddon.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C0E56Ac2-9F72-436E-B6E7-Aec28Af9E4Eb}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCB5551D-8594-4999-85F9-1E3EABCB95AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B184B9D-B7BD-4FEA-8D1F-5E27182206A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3ED0E410-5C8E-47B6-A75D-D10B886E903C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEAddon.StatusBarPane]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEAddon.StatusBarPane.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCB5551D-8594-4999-85F9-1E3EABCB95AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UnVirex]
[-HKEY_LOCAL_MACHINE\SOFTWARE\UnVirex]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DRVFLTIP]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DrvFltIp]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DrvFltIp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"UnVirex"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnVirex"=-

Muutokset v2.416 - v2.417

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Presto TuneUp"=-
%WINDOWS%\pp10.exe
%SYSTEM%\SYSDLL.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SYSDLL"=-

Muutokset v2.414 - v2.416

O2 - BHO: (no name) - {3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}]
%SYSTEM%\SYS32DLL.exe
%PROGRAMFILES%\PCenter\
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SYS32DLL"=-
"agent.exe"=-

Muutokset v2.413 - v2.414

%SYSTEM%\DL32.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DL32"=-

Muutokset v2.411 - v2.412

%HOMEDRIVE%\asasa.exe
%HOMEDRIVE%\syst.exe
%PROGRAMFILES%\Microsoft Security Adviser\
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msctrl.exe"=-
"msavsc.exe"=-
"msscan.exe"=-
"msiemon.exe"=-
"msfw.exe"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msctrl.exe"=-
"msavsc.exe"=-
"msscan.exe"=-
"msiemon.exe"=-
"msfw.exe"=-
%ALLUSERS%\ApplicationData\Tally software LTD\
%STARTMENU%\Programs\Extra Antivirus\
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\Extra Antivirus 3.0]
[-HKEY_CURRENT_USER\Software\Tally software LTD]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Extra Antivirus"=-

Muutokset v2.409 - v2.411

%STARTMENU%\Programs\AV AntiSpyware\
%ALLUSERS%\ApplicationData\LastSun Ltd\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AV AntiSpyware 1.8]
[-HKEY_CURRENT_USER\Software\LastSun Ltd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AV AntiSpyware"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\load1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\browser helper objects\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
%SYSTEM%\ipv6monl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\WiniBlueSoft]
[-HKEY_CURRENT_USER\Software\WiniBlueSoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiniBlueSoft]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WiniBlueSoft"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"setup2.exe"=-
%SYSTEM%\setup2.exe
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\WiniBlueSoft.lnk
%ALLUSERSTARTMENU%\Programs\WiniBlueSoft\
%ALLUSERDESKTOP%\WiniBlueSoft.lnk
%PROGRAMFILES%\WiniBlueSoft Software\

Muutokset v2.408 - v2.409

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\homeantivirus2009.lnk
%STARTMENU%\Programs\homeantivirus2009\
%DESKTOP%\homeantivirus2009.lnk
%PROGRAMFILES%\homeantivirus2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HomeAntivirus2009]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HomeAntivirus 2009"=-

Muutokset v2.407 - v2.408

%SYSTEM%\ahtn.htm
%SYSTEM%\warning.gif
%SYSTEM%\frmwrk32.exe
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Framework Windows"=-
%STARTMENU%\Programs\MS AntiSpyware 2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusXP]
[-HKEY_CURRENT_USER\Software\AntivirusXP]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AntivirusXP.exe"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusXP.lnk
%DESKTOP%\AntivirusXP.lnk
%STARTMENU%\Programs\AntivirusXP\
%PROGRAMFILES%\AntivirusXP\

Muutokset v2.405 - v2.406

Added: Option 6, ProxyDisable.exe
%WINDOWS%\ld03.exe
%WINDOWS%\pp06.exe
%SYSTEM%\winsource.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\TSC.lnk
%DESKTOP%\TSC.lnk
%STARTMENU%\Programs\TSC\
%PROGRAMFILES%\TSC\
%SYSTEM%\userload.exe
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"restor"=-

Muutokset v2.404 - v2.405

%WINDIR%\ieocx.dll
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEocxApp.IEocx]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEocxApp.IEocx.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A54DC52D-7AAD-4D40-A126-337211631EDC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}]
%DESKTOP%\WinPC Defender.lnk
%STARTMENU%\WinPC Defender.lnk
[-HKEY_CURRENT_USER\Software\WinPC Defender]
%SYSTEM%\rs32net.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"rs32net"=-
%HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"rs32net"=-
[-HKEY_CURRENT_USER\Software\renus2008]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"renus2008.exe"=-

Muutokset v2.403 - v2.404

%USERPROFILE%\Application Data\sysrc32.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Win32load"=-

Muutokset v2.402 - v2.403

%ProgramFiles%\AntiSpyware Pro
%PROGRAMFILES%\RegistryFox\
%ALLUSERDESKTOP%\RegistryFox.lnk
%USERPROFILE%\Application Data\RegistryFox\
%ALLUSERSTARTMENU%\Programmes\RegistryFox\
[-HKEY_CURRENT_USER\SOFTWARE\RegistryFox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\6B4F6929EB6FE0E458263EBA6AF2EB30]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\6B4F6929EB6FE0E458263EBA6AF2EB30]
[-HKEY_LOCAL_MACHINE\SOFTWARE\RegistryFox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9296F4B6-F6BE-4E0E-8562-E3ABA62FBE03}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegistryFox"=-

Muutokset v2.401 - v2.402

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe svchostw.exe"
%SYSTEM%\svchostw.exe

Muutokset v2.400 - v2.401

%WINDOWS%\ld01.exe
%WINDOWS%\ld02.exe
%WINDOWS%\pp2.exe
%SYSTEM%\dll32.exe
%SYSTEM%\dll32.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dll"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysldtray"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pp"=-
%STARTMENU%\Programs\Malware Defender 2009\
%DESKTOP%\Malware Defender 2009.lnk
%PROGRAMFILES%\Malware Defender 2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Defender 2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defender 2009]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"malwaredef"=-
%STARTMENU%\Programs\System Guard 2009\
%DESKTOP%\System Guard 2009.lnk
%PROGRAMFILES%\System Guard 2009\
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\DLLs\iemodule.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Guard 2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\System Guard 2009]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"systemguard"=-

Muutokset v2.399 - v2.400

%WINDOWS%\iehost32.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"system tool"=-

Muutokset v2.398 - v2.399

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\GenericMultiMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WmpTray"=-
%PROGRAMFILES%\MediaSystem\

Muutokset v2.397 - v2.398

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Internet Agent"=-
%SYSTEM%\winagent.exe
%PROGRAMFILES%\HDQuality\
%STARTMENU%\Programs\HDQuality\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HDQuality]
[-HKEY_CURRENT_USER\SOFTWARE\HDQuality]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDQuality]

Muutokset v2.395 - v2.396

%PROGRAMFILES%\CMVideoPlugin
%PROGRAMFILES%\SmitFraudFixTool\
%ALLUSERDESKTOP%\SmitFraudFixTool.lnk
%USERPROFILE%\\Application Data\SmitFraudFixTool\
%ALLUSERSTARTMENU%\Programs\SmitFraudFixTool\
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SmitFraudFixTool"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10EE433D-A290-4811-B562-8A1878AEE706}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{10EE433D-A290-4811-B562-8A1878AEE706}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB63BB6D-4A8A-4E69-9F4B-E099C874A2AA}]
[-HKEY_CURRENT_USER\Software\SmitFraudFixTool]

Muutokset v2.394 - v2.395

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"systeminit.exe"=-

Muutokset v2.393 - v2.394

%PROGRAMFILES%\freshplay\
%STARTMENU%\Programs\freshplay
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\freshplay]
[-HKEY_CURRENT_USER\SOFTWARE\freshplay]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\freshplay]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=-
%ALLUSERPROFILE%\Application Data\CrucialSoft Ltd\
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\MS AntiSpyware 2009 5.7]
[-HKEY_CURRENT_USER\Software\CrucialSoft Ltd]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MS AntiSpyware 2009"=-

Muutokset v2.392 - v2.393

%WINDOWS%\sysguard.exe
%SYSTEM%\iehelper.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}]
[-HKEY_CURRENT_USER\Software\AvScan]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"sysguard"=-

Muutokset v2.391 - v2.392

%SYSTEM%\winsystems.dll
%STARTMENU%\Programs\IE-Security.lnk
%DESKTOP%\IE-Security.lnk
%PROGRAMFILES%\IE-Security\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE-Security]
[-HKEY_CURRENT_USER\Software\IE-Security]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"IE-Security"=-
%STARTMENU%\XP Police Antivirus.lnk
%DESKTOP%\XP Police Antivirus.lnk
%PROGRAMFILES%\XPPoliceAntivirus\
[-HKEY_CURRENT_USER\Software\XP Police Antivirus]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PoliceAV"=-

Muutokset v2.388 - v2.391

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CMVideo.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{36B94DC8-FA3B-45DF-8F6B-215A2A469BCC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D23EE44-2319-4B6C-93D2-A572E0F5B0E0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B87FA0EF-26D7-4B2A-B7EE-38C7271C4843}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2EB32B07-6A19-4D18-9A19-4DE49F18A1FB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{638E0063-BA00-487C-BAFF-423E356F52F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AC4A66D0-BB91-45E5-BB00-E0F091F630B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D23EE44-2319-4B6C-93D2-A572E0F5B0E0}]
[-HKEY_CURRENT_USER\Software\CMVideoPlugin]
%SYSTEM%\CMVideo.dll
%PROGRAMFILES%\totalvid\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msiexec.exe"=-

Muutokset v2.387 - v2.388

%STARTMENU%\Programs\videosoft\
%PROGRAMFILES%\videosoft\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videosoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videosoft]
[-HKEY_CURRENT_USER\Software\videosoft]
%PROGRAMFILES%\Total Protect 2009\
%ALLUSERPROFILE%\StartMenu\Programs\Total Protect 2009\
%ALLUSERPROFILE%\Desktop\Run Total Protect 2009.lnk
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\totalprotect]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\totalprotect]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Protect 2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Total Protect 2009"=-

Muutokset v2.386 - v2.387

%WINDIR%\fd.dll

Muutokset v2.385 - v2.386

Update: Hostschk 0.2 (10 lines max in log)

Muutokset v2.383 - v2.385

Added: Agent.OMZ.Fix.exe tool to remove Zlob hidden folder.
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 360.lnk
%STARTMENU%\Antivirus 360\
%DESKTOP%\Antivirus 360.lnk
%PROGRAMFILES%\A360\

Muutokset v2.382 - v2.383

%PROGRAMFILES%\vrl32software\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E6615B5-A259-4e55-905F-7F9CE60B379D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{305043E5-F9D9-4B3A-A618-C4D0DA8031CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{536CBA8A-9DB6-45CF-8D65-F486C49242D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B3A0AA5C-9FA3-408D-8193-2A948EF51D2D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vrl32Warning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vrl32Warning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vrl32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E6615B5-A259-4e55-905F-7F9CE60B379D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vrl32]
[-HKEY_CURRENT_USER\Software\vrl32]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\vrl32software\vrl32.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\vrl32software\vrl32.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"vrl32"=-

Muutokset v2.381 - v2.382

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Smax4"=-
%USERPROFILE%\Application Data\Google\kjzna1562565.exe
%USERPROFILE%\Application Data\Google\spcffwl.dll

Muutokset v2.380 - v2.381

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"QuickTime Task"=-
"VMware hptray"=-
%PROGRAMFILES%\avrlabs\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D695B871-8020-4041-A6D2-59F922E1B2E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avrlabsWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avrlabsWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\avrlabs]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D695B871-8020-4041-A6D2-59F922E1B2E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avrlabs]
[-HKEY_CURRENT_USER\Software\avrlabs]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\avrlabs\avrlabs.exe"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
"C:\Program Files\avrlabs\avrlabs.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"avrlabs"=-

Muutokset v2.379 - v2.380

%PROGRAMFILES%\WebMediaViewer\
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3B8FB116-D358-48A3-A5C7-DB84F15CBB04}]
%PROGRAMFILES%\AnvTrgrsoftware\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C8B2A9C-24A0-4991-A74B-1E4931BD3A57}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BAE92F67-539C-41CD-9183-162BB40AAA0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AnvTrgrWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AnvTrgrWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AnvTrgrsoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnvTrgrsoft]
[-HKEY_CURRENT_USER\Software\AnvTrgrsoft]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AnvTrgrsoftware\AnvTrgr.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AnvTrgrsoftware\AnvTrgr.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AnvTrgr"=-

Muutokset v2.376 - v2.378

%PROGRAMFILES%\WMVideoPlugin\
%SYSTEM%\mws31209.dll
%SYSTEM%\ws31209.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC3081A6-AC0C-331D-860E-AEF4790E6B5B}]
[-HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{C77BD12E-4A3C-33E3-858C-F2D04591C6B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BB62EE8-3528-39F7-9070-F9F0C09329D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC3081A6-AC0C-331D-860E-AEF4790E6B5B}]
%PROGRAMFILES%\AvirTrsoftware\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3A267370-076E-4af4-B986-77626B8E89DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764BC8B4-1159-4736-8AF1-F124A7C8C3A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3ED86073-2FA7-4CF4-810B-28B030671678}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvirTrWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvirTrWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvirTrsoft]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A267370-076E-4af4-B986-77626B8E89DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AvirTrsoft]
[-HKEY_CURRENT_USER\Software\AvirTrsoft]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AvirTrsoftware\AvirTr.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AvirTrsoftware\AvirTr.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AvirTr"=-

Muutokset v2.375 - v2.376

%PROGRAMFILES%\msvideoplugin\
%PROGRAMFILES%\homeview\
%STARTMENU%\Programs\homeview\
%SYSTEM%\mws55681.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6733C78-821F-3BBF-ADE6-3DB71CAD887A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6733C78-821F-3BBF-ADE6-3DB71CAD887A}]
%SYSTEM%\msiconf.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msiexec.exe"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\antivirustrigger 2.1.lnk
%STARTMENU%\antivirustrigger 2.1.lnk
%STARTMENU%\Programs\antivirustrigger 2.1\
%DESKTOP%\antivirustrigger 2.1.lnk
%PROGRAMFILES%\virtrigger\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0088C75C-6361-4dfb-B2CF-576CACFA3C55}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22C447D3-73A8-E1C7-C391-21BE4338CEBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirTriggerWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirTriggerWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirTrigger]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0088C75C-6361-4dfb-B2CF-576CACFA3C55}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirTrigger]
[-HKEY_CURRENT_USER\Software\VirTrigger]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirTrigger\VirTrigger.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirTrigger\VirTrigger.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirTrigger"=-

Muutokset v2.374 - v2.375

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusTrigger 2.1.lnk
%STARTMENU%\VirusTrigger 2.1.lnk
%STARTMENU%\Programs\VirusTriggerBin\
%DESKTOP%\VirusTrigger 2.1.lnk
%PROGRAMFILES%\VirusTriggerBin\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE8A3F7B-E4AB-5C41-4926-3FAED82759F5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirusTriggerBinWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirusTriggerBinWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusTriggerBin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusTriggerBin]
[-HKEY_CURRENT_USER\Software\VirusTriggerBin]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirusTriggerBin"=-

Muutokset v2.373 - v2.374

%PROGRAMFILES%\Google\googletoolbar1.dll
%PROGRAMFILES%\Google\setupcom.dat
%PROGRAMFILES%\Google\setupext.dat
%SYSTEM%\crypts.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt]
O2 - BHO: (no name) - {8710DF42-3171-4A3B-9079-3F7D7101552B} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8710DF42-3171-4A3B-9079-3F7D7101552B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8710DF42-3171-4A3B-9079-3F7D7101552B}]
O3 - Toolbar: Internet Service - {E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}"=-

Muutokset v2.372 - v2.373

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Guard 2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard]
[-HKEY_CURRENT_USER\Software\Spyware Guard]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"spywareguard"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"OLESys"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"Explorer"=-
%USERSTARTMENU%\Programs\Spyware Guard 2008\
%PROGRAMFILES%\Spyware Guard 2008\
%allusersprofile%\Application Data\Microsoft\Internet Explorer\olesys.dll
%allusersprofile%\Application Data\Microsoft\Protect\conf.sys
%allusersprofile%\Application Data\Microsoft\Protect\ie.dll
%allusersprofile%\Application Data\Microsoft\Protect\svhost.exe
%allusersprofile%\Application Data\Microsoft\Protect\track.sys
%allusersprofile%\Application Data\winlogon.exe
%DESKTOP%\Spyware Guard 2008.lnk
%WINDOWS%\reged.exe
%WINDOWS%\spoolsystem.exe
%WINDOWS%\sys.com
%WINDOWS%\syscert.exe
%WINDOWS%\sysexplorer.exe
%WINDOWS%\vmreg.dll
%SYSTEM%\wsc32x.exe

Muutokset v2.371 - v2.372

Removed: AntiXPVSTFix tool

Muutokset v2.370 - v2.371

%USERSTARTMENU%\Programs\sexvid\
%PROGRAMFILES%\sexvid\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sexvid]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid]
[-HKEY_CURRENT_USER\Software\sexvid]
%TEMP%\winlogon.exe
%SYSTEM%\msansspc.dll
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Firewall auto setup"=-

Muutokset v2.369 - v2.370

%userprofile%\Application Data\Google\sccmsk.dll
%userprofile%\Application Data\Google\mupd1_2_1711951.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"asus32"=-
%USERSTARTMENU%\Personal Defender 2009.lnk
%USERSTARTMENU%\Programs\Personal Defender 2009\
%PROGRAMFILES%\Personal Defender 2009\
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Personal Defender 2009"=-

Muutokset v2.367 - v2.368

%DESKTOP%\SMS TRAP.url
%FAVORITES%\SMS TRAP.url
%STARTMENU%\SMS TRAP.url
%SYSTEM%\p.ico
%DESKTOP%\AntiVirus Sentry.lnk
%PROGRAMFILES%\AVS\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVS]
[-HKEY_CURRENT_USER\Software\AVS]

Muutokset v2.366 - v2.367

%SYSTEM%\ntload.dll
%SYSTEM%\sex1.ico.tmp
%SYSTEM%\sex2.ico.tmp
%SYSTEM%\update32.exe.tmp
%SYSTEM%\winupdate.exe
%SYSTEM%\wscmp.dll.tmp
%DESKTOP%\Uncensored porn.url
%DESKTOP%\BDSM galleries.url
%SYSTEM%\winupdate.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"run"=-

Muutokset v2.365 - v2.366

%WINDIR%\woprdagt.exe
%PROGRAMFILES%\TS-2009

Muutokset v2.364 - v2.365

%USERPROFILE%\Application Data\spyprotector\
%USERPROFILE%\Application Data\install.exe
%USERPROFILE%\Application Data\shellex.dll
%USERPROFILE%\Application Data\srcss.exe
%ALLUSERSTARTMENU%\Programs\spy protector\
%DESKTOP%\spy protector.lnk
%PROGRAMFILES%\spy protector\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Spy Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CBE202A6-3B75-4189-B161-9B4DF370BEE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Spy Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Spy Protector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\shellex.TBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\srcss.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBE202A6-3B75-4189-B161-9B4DF370BEE9}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\SpyProtector]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spy Protector"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{107A1D63-2EAA-4694-8ABA-EC209C630D83}"=-

Muutokset v2.361 - v2.363

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
[-HKEY_CURRENT_USER\Software\VirusRemover2008]
[-HKEY_CURRENT_USER\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusRemover2008"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\virusremover2008.lnk
%USERPROFILE%\Application Data\virusremover2008\
%STARTMENU%\Programs\virusremover2008\
%DESKTOP%\virusremover2008.lnk
%PROGRAMFILES%\virusremover2008\
%ALLUSERSTARTMENU%\Programs\PC Protection Center 2008\
%ALLUSERDESKTOP%\PC Protection Center 2008.lnk
%PROGRAMFILES%\PC Protection Center 2008\
%SYSTEM%\vbzlib2.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Protection Center 2008]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Protection Center"=-
%WINDOWS%\ieguard.dll
%WINDOWS%\sysguard\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D032570A-5F63-4812-A094-87D007C23012}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ieguard.TIEAdvBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sysguard]
[-HKEY_CURRENT_USER\Software\sysguard]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"=-

Muutokset v2.360 - v2.361

%SYSTEM%\msxml71.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XML.XML]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XML.XML.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
[-HKEY_CURRENT_USER\Software\XML]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSFox"=-

Muutokset v2.359 - v2.360

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk (Already removed)
%STARTMENU%\VirusResponse Lab 2009 2.1.lnk (Already removed)
%STARTMENU%\Programs\VirusResponse Lab 2009 2.1\ (Already removed)
%DESKTOP%\VirusResponse Lab 2009 2.1.lnk (Already removed)
%PROGRAMFILES%\virrl2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirRLWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirRLWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirRL2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirRL2009]
[-HKEY_CURRENT_USER\Software\VirRL2009]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirRL2009\VirRL2009.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirRL2009\VirRL2009.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirRL2009"=-

Muutokset v2.358 - v2.359

%WINDIR%\karna.dat
%SYSTEM%\brastk.exe
%SYSTEM%\karna.dat
O20 - AppInit_DLLs: C:\WINDOWS\System32\karna.dat
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"brastk"=-

Muutokset v2.357 - v2.358

%WINDIR%\karna.dat
%SYSTEM%\brastk.exe
%SYSTEM%\karna.dat
O20 - AppInit_DLLs: C:\WINDOWS\System32\karna.dat
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"brastk"=-

Muutokset v2.356 - v2.357

%STARTMENU%\Programs\av2010\
%DESKTOP%\av2010.lnk
%PROGRAMFILES%\av2010\
%SYSTEM%\IEDefender.dll
%SYSTEM%\wingamma.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEDefender.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEDefender.IEDefenderBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEDefender.IEDefenderBHO.1]
[-HKEY_CURRENT_USER\Software\AV2010]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Gamma Display"=-

Muutokset v2.355 - v2.356

Update: VACFix definition

Muutokset v2.352 - v2.354

%SYSTEM%\fbxrqtwn.exe
%SYSTEM%\MicroAV.cpl
%DESKTOP%\Micro Antivirus 2009.lnk
%PROGRAMFILES%\MicroAV\
[-HKEY_CURRENT_USER\Software\AntiVirus]
[-HKEY_CURRENT_USER\Software\uav]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-
%PROGRAMFILES%\uav\
%DESKTOP%\Ultimate Antivirus 2008.lnk
%SYSTEM%\uav.cpl

Muutokset v2.351 - v2.352

%SYSTEM%\users64.dat
%SYSTEM%\sysppu?.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\pr]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow]
"10"=-
"di"=-
"u1"=-
"lk1"=-

Muutokset v2.350 - v2.351

O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{144A6B24-0EBC-4D89-BF09-A06A718E57B5}"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk
%STARTMENU%\VirusResponse Lab 2009 2.1.lnk
%STARTMENU%\Programs\VirusResponse Lab 2009 2.1\
%DESKTOP%\VirusResponse Lab 2009 2.1.lnk
%PROGRAMFILES%\VirusResponseLab2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusResponseLab2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusResponseLab2009]
[-HKEY_CURRENT_USER\Software\VirusResponseLab2009]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusResponseLab2009\VirusResponseLab2009.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\VirusResponseLab2009\VirusResponseLab2009.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"VirusResponseLab2009"=-

Muutokset v2.349 - v2.350

%SYSTEM%\algg.exe
O2 - BHO: (no name) - {CFEE97A3-4911-444D-8BE8-E243A23D3DE2} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}]
O3 - Toolbar: Internet Service - {0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87}"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Lab 2009 2.1.lnk
%STARTMENU%\AntiVirus Lab 2009 2.1.lnk
%STARTMENU%\Programs\AntiVirus Lab 2009 2.1\
%DESKTOP%\AntiVirus Lab 2009 2.1.lnk
%PROGRAMFILES%\AntiVirusLab2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A9759D-210A-0253-D944-8B76AC2B0D92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirusLab2009]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirusLab2009]
[-HKEY_CURRENT_USER\Software\AntiVirusLab2009]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AntiVirusLab2009"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AntiVirusLab2009\AntiVirusLab2009.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AntiVirusLab2009\AntiVirusLab2009.exe"=-

Muutokset v2.346 - v2.347

%SYSDIR%\c.ico
%STARTMENU%\VIP Casino.url
%FAVORITES%\VIP Casino.url
%DESKTOP%\VIP Casino.url
%WINDOWS%\mqgldfvo.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\YUR1.exe"=-
"\YUR2.exe"=-
"\YUR3.exe"=-
"\YUR4.exe"=-
"\YUR5.exe"=-
"\YUR6.exe"=-
"\YUR7.exe"=-
"\YUR8.exe"=-
"\YURA.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"\YUR1.exe"=-
"\YUR2.exe"=-
"\YUR3.exe"=-
"\YUR4.exe"=-
"\YUR5.exe"=-
"\YUR6.exe"=-
"\YUR7.exe"=-
"\YUR8.exe"=-
"\YURA.exe"=-
%DESKTOP%\BEST ZOO PORN.url
%DESKTOP%\QUALITY PORN.url
%SYSTEM%\YUR*.exe

Muutokset v2.345 - v2.346

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Antivirus-2009.lnk
%USERPROFILE%\Start Menu\Programs\Smart Antivirus 2009\
%DESKTOP%\Smart Antivirus-2009.lnk
%PROGRAMFILES%\Smart Antivirus 2009\
[-HKEY_CURRENT_USER\Software\Smart Antivirus 2009]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Smart Antivirus-2009.exe"=-

Muutokset v2.344 - v2.345

%SYSTEM%\Cpl32ver.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cpl32ver"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Somefox]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Somefox"=-
%DESKTOP%\System Antivirus 2008.lnk
%PROGRAMFILES%\sav\
[-HKEY_CURRENT_USER\Software\AntiVirus] (Already removed)
[-HKEY_CURRENT_USER\Software\SAV]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=- (Already removed)
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=- (Already removed)

Muutokset v2.343 - v2.344

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareExpert.lnk
%ALLUSERPROFILE%\Start Menu\Programs\AntiSpywareExpert\
%DESKTOP%\AntiSpywareExpert.lnk
%PROGRAMFILES%\AntiSpywareExpert\
[-HKEY_CURRENT_USER\Software\AntiSpywareExpert]
[-HKEY_CURRENT_USER\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiSpywareExpert"=-
%USERPROFILE%\Application Data\printer.exe
%USERPROFILE%\Application Data\temp.dll
%SYSTEM%\mcrupdate.exe
%SYSTEM%\npad.exe
%ProgramFiles%\altcmd\
O2 - BHO: BhoApp Class - {3EDBF8E9-3130-72C8-ED30-32A3DB08ED44} - C:\Program Files\altcmd\altcmd32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EDBF8E9-3130-72C8-ED30-32A3DB08ED44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3EDBF8E9-3130-72C8-ED30-32A3DB08ED44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adczaznsersgfm1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adczaznsersgfm=]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoApp Class]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare]

Muutokset v2.339 - v2.343

%ProgramFiles%\aspch\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1FAB6BD-4A34-47ce-82AF-50B16A6BE77E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ThreatWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ThreatWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\aspch]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E1FAB6BD-4A34-47ce-82AF-50B16A6BE77E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\aspch]
[HKEY_CURRENT_USER\Software\aspch]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\aspch\ASpCh.exe"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\aspch\ASpCh.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"aspch"=-
%DESKTOP%\Total Secure 2009.lnk
%USERPROFILE%\Start Menu\Programs\Total Secure 2009.lnk
%ProgramFiles%\TotalSecure2009\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Secure 2009]
[-HKEY_CURRENT_USER\Software\TotalSecure2009]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TotalSecure2009"=-
%ProgramFiles%\Power-Antivirus-2009\
%USERPROFILE%\Application Data\Power-Antivirus-2009\
%USERPROFILE%\Start Menu\Programs\Power-Antivirus-2009\
%desktop%\Power-Antivirus-2009.lnk
[-HKEY_CURRENT_USER\Software\Power-Antivirus-2009]
%ProgramFiles%\RichVideoCodec\ (Already removed)
%SYSTEM%\RichVideoCodec.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CodecBHO.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{e12b39a5-df4a-4f04-a85b-4ecf048e359f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a37b3779-e4f3-424c-a495-a60ea8063476}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b65c5ebd-0989-40b5-a2a0-84642539bf82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E46194A9-C4B1-4C0F-A75E-E9C5BDED7874}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7309FD6-0FD0-459D-A5E8-27D7A23215F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B648A7F7-DD8F-4535-AFAD-CE5BA0E8320E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a37b3779-e4f3-424c-a495-a60ea8063476}]
[-HKEY_CURRENT_USER\Software\RichVideoCodec] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\VIE2.exe"=-
"\VIE3.exe"=-
"\VIE4.exe"=-
"\VIE5.exe"=-
"\VIEA.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"\VIE2.exe"=-
"\VIE3.exe"=-
"\VIE4.exe"=-
"\VIE5.exe"=-
"\VIEA.exe"=-
%DESKTOP%\EXTREME FUCK.url
%DESKTOP%\TITS AND ASS.url
%SYSTEM%\1.ico
%SYSTEM%\2.ico
%SYSTEM%\VIEA.exe
%SYSTEM%\VIE5.exe
%SYSTEM%\VIE4.exe
%SYSTEM%\VIE3.exe
%SYSTEM%\VIE2.exe
%WINDOWS%\rvoelbxt.exe
O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BD44AB1-76A7-4E05-92F4-4B065FE72BD6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BD44AB1-76A7-4E05-92F4-4B065FE72BD6}]
O3 - Toolbar: Internet Service - {3BEBF2FE-7248-40E2-9752-8163EB6C4038} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BEBF2FE-7248-40E2-9752-8163EB6C4038}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3BEBF2FE-7248-40E2-9752-8163EB6C4038}"=-

Muutokset v2.338 - v2.339

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"buritos"=-
%ALLUSERPROFILE%\Start Menu\Programs\Antivirus XP 2008\
%ALLUSERPROFILE%\Start Menu\Programs\Antivirus XP 2008.lnk
%AllUserDesktop%\Antivirus XP 2008.lnk
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk

Muutokset v2.336 - v2.338

Update: 404Fix v1.3
%Desktop%\FETISH PICS.url
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"smile"=-
Update: IEDFix.C 1.1
O2 - BHO: (no name) - {300CF5C9-F02D-4CB8-ABED-9C229DA56825} - C:\Program Files\Applications\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}]
%SYSTEM%\scui.cpl
%ProgramFiles%\AV9\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
%USERPROFILE%\Start Menu\Programs\Antivirus 2009\
%desktop%\Antivirus 2009.lnk
%SYSTEM%\winsrc.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}]

Muutokset v2.335 - v2.336

Muutokset v2.3324 - v2.335

tdssserv.sys Rootkit detection
%ProgramFiles%\IA\
%ProgramFiles%\Internet Antivirus\
%USERPROFILE%\Application Data\Internet Antivirus\
%ALLUSERPROFILE%\Desktop\Internet Antivirus.lnk
%ALLUSERPROFILE%\Start Menu\Programs\Internet Antivirus\
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
%USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Antivirus_is1]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"iv"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Internet Antivirus"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"3P_UDEC_IA"=-
%desktop%\GAY PORN.url
%desktop%\MASTURBATION VIDS.url
%ProgramFiles%\PCHealthCenter\
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\Win2.exe"=-
"\Win3.exe"=-
"\Win4.exe"=-
"\Win5.exe"=-
"\Win6.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"\Win2.exe"=-
"\Win3.exe"=-
"\Win4.exe"=-
"\Win5.exe"=-
"\Win6.exe"=-
%ProgramFiles%\VAV\
%desktop%\Vista Antivirus 2008.lnk
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-

Muutokset v2.333 - v2.3324

Update: 404Fix v1.2
O3 - Toolbar: Internet Service - {254B87BB-510D-41FA-A887-52C5FA9BE585} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{254B87BB-510D-41FA-A887-52C5FA9BE585}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{254B87BB-510D-41FA-A887-52C5FA9BE585}"=-
%SYSTEM%\ieupdates.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ieupdate"=-

Muutokset v2.332 - v2.333

%ProgramFiles%\Applications\
O3 - Toolbar: Internet Service - {38BF827A-D7C5-46E1-A9A2-47B1B5BB5438} - C:\Program Files\Applications\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38BF827A-D7C5-46E1-A9A2-47B1B5BB5438}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{38BF827A-D7C5-46E1-A9A2-47B1B5BB5438}"=-

Muutokset v2.331 - v2.332

%ProgramFiles%\ASpyC\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F58FF278-2198-403b-9170-C95022A194C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ASpyC]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F58FF278-2198-403b-9170-C95022A194C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASpyC]
[-HKEY_CURRENT_USER\Software\ASpyC]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ASpyC"=-

Muutokset v2.330 - v2.331

Update: Generic Renos Fix 1.16

Muutokset v2.328 - v2.329

%ProgramFiles%\RichVideoCodec\ (Already removed)
%SYSTEM%\RichVideoCodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\RichVideoCodec.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A85A2972-D35F-4089-86AE-83DFEF054E23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35DA02A8-1D27-43EB-8088-3210521AA154}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B2DBC9D-7D49-48F4-8DDC-1B15415FF253}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{926A61C9-5C20-4583-ACA7-ACE21088816E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{11446072-F8F2-4C03-8A8A-D337AD2B13F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BAF84F6B-038B-40E2-9688-1E3BF20988D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0EF350A6-8AF0-40B5-ADE7-CB82FD02C3AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.VideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.VideoCodec.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.XMLDOMDocumentEventsSi.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.XMLDOMDocumentEventsSink]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{926A61C9-5C20-4583-ACA7-ACE21088816E}]
[-HKEY_CURRENT_USER\Software\RichVideoCodec]
O3 - Toolbar: Internet Service - {85BDD81D-31FD-4A6B-A73C-3955B128D2EC} - C:\Program Files\Web Technologies\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85BDD81D-31FD-4A6B-A73C-3955B128D2EC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{85BDD81D-31FD-4A6B-A73C-3955B128D2EC}"=-
O2 - BHO: (no name) - {E2090673-256B-4632-94EE-FEC7F551543C} - C:\Program Files\Web Technologies\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2090673-256B-4632-94EE-FEC7F551543C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2090673-256B-4632-94EE-FEC7F551543C}]

Muutokset v2.326 - v2.328

%STARTMENU%\Programs\LookForPorn\
%PROGRAMFILES%\LookForPorn\
[-HKEY_CURRENT_USER\Software\LookForPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LookForPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LookForPorn]
%SYSTEM%\CbEvtSvc.exe
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CbEvtSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CBEVTSVC]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbEvtSvc]

Muutokset v2.325 - v2.326

%favorites%\Antivirus Scan.url
%startmenu%\Antivirus Scan.url
%desktop%\Antivirus Scan.url
%startmenu%\Online Spyware Test.url
%desktop%\Online Spyware Test.url
%WINDOWS%\pebgkxwq
%WINDOWS%\neltabxw.exe
%PROGRAMFILES%\Web Technologies\
O2 - BHO: (no name) - {A49E097A-D6EF-4B2F-8B0F-1230E998587F} - C:\Program Files\Web Technologies\iebt.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]
O3 - Toolbar: Internet Service - {F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B} - C:\Program Files\Web Technologies\iebr.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}"=-
[-HKEY_CURRENT_USER\Software\Web Technologies]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning32.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning32.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\e405.e405mgr]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.lnk
%STARTMENU%\AntiSpyCheck 2.1.lnk
%STARTMENU%\Programs\AntiSpyCheck 2.1\
%DESKTOP%\AntiSpyCheck 2.1.lnk
%PROGRAMFILES%\AntiSpyCheck 2.1\
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiSpyCheck 2.1"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AUTORUN_VAL"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck 2.1.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck 2.1]
[-HKEY_CURRENT_USER\Software\AntiSpyCheck 2.1]

Muutokset v2.324 - v2.325

Update: IEDFix.C

Muutokset v2.323 - v2.324

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.0.lnk
%STARTMENU%\AntiSpyCheck 2.1.0.lnk
%STARTMENU%\Programs\AntiSpyCheck 2.1.0\
%DESKTOP%\AntiSpyCheck 2.1.0.lnk
%PROGRAMFILES%\AntiSpyCheck\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FA7933-DC3E-403b-8D47-BB5E3F345A21}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF-70C1EDD8B2E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning.WarningBHO]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning.WarningBHO.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56FA7933-DC3E-403b-8D47-BB5E3F345A21}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck]
[-HKEY_CURRENT_USER\Software\AntiSpyCheck]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiSpyCheck 2.1.0"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AntiSpyCheck"=-

Muutokset v2.320 - v2.323

New Componant: Policies.exe
This tool is run first (then it runs SmitfraudFix.cmd) to restore some policies that prevent command line execution.

Muutokset v2.319 - v2.320

%WINDOWS%\spwoqbmv.exe
%WINDOWS%\xbaqktfv.exe
%WINDOWS%\qadovnel.dll
VirusHeat 4.4.exe
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.4.lnk
%STARTMENU%\VirusHeat 4.4.lnk
%STARTMENU%\Programs\VirusHeat 4.4\
%DESKTOP%\VirusHeat 4.4.lnk
%PROGRAMFILES%\VirusHeat 4.4\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DFBA66B-DB48-4292-831A-E7186D8A61AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46F309AE-9D11-4C10-9D20-2C084B1C8BCE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB95561-AF37-4BBD-823C-1E355A744A43}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76157861-4996-4711-90E4-6D868B877B24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{81DA01DB-8100-4865-B9B0-A83F54378435}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{910EF37B-A486-41FC-8A1B-28C5581AB3AC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6B2BC38-7F2A-4202-9B43-A28615727FEE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B11DA4C8-52DC-44A2-B21B-02BF7A93EB5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5ADBFCA-C6DE-4E5A-A2DA-70AA2933B696}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5AE5932-F1B3-45E4-842A-59EEA65B13A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA18BA7B-9567-4408-9B87-3D3990C3969E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D56509AB-9821-4DB0-BF2F-115159804140}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DFF203EA-222C-44FA-8B78-ED88B4587AA2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB22B708-E0D3-4FCE-800B-6DD0C5B30D42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EA02F8-E536-4828-BFB7-3DE7FA4D4B09}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6E18622-DFA8-4DBA-B05E-D3D147E16D44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{23624BD0-2A69-4F91-BE6A-9F1F22B72C13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.4.exe 4.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.4]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 4.4"=-

Muutokset v2.318 - v2.319

%DESKTOP%\IE AntiVirus 3.2.lnk
%STARTMENU%\Programs\IE AntiVirus 3.2.lnk
%PROGRAMFILES%\IEAntiVirus
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE AntiVirus]
[-HKEY_CURRENT_USER\Software\IEAntiVirus]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"antispy"=-

Muutokset v2.317 - v2.318

Update: VACFix definition
%WINDOWS%\wxvgsdbq.exe
%WINDOWS%\olgdqarf.exe

Muutokset v2.314 - v2.315

%SYSTEM%\892267\
O2 - BHO: 892267 helper - {25E0128D-AAFC-49FF-AB11-1F12C2FCC391} - C:\WINDOWS\System32\892267\892267.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]

Muutokset v2.313 - v2.314

%DESKTOP%\Malware Bell 3.2.lnk
%STARTMENU%\Programs\Malware Bell 3.2.lnk
%PROGRAMFILES%\MalwareBell
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Bell]
[-HKEY_CURRENT_USER\Software\MalwareBell]

Muutokset v2.312 - v2.313

%SYSTEM%\403445\
O2 - BHO: 403445 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\403445\403445.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]

Muutokset v2.311 - v2.312

Update: IEDFix Signatures

Muutokset v2.310 - v2.311

%WINDOWS%\config.ini
%WINDOWS%\mywallpaper.bmp
%WINDOWS%\sysabmpmfr.exe
%WINDOWS%\sysahbecjh.exe
%WINDOWS%\sysatjsicj.exe
%WINDOWS%\sysavxjgdu.exe
%WINDOWS%\sysawechod.exe
%WINDOWS%\zysalwhkkw.exe
%WINDOWS%\zysaoxcjiy.exe
%WINDOWS%\zysapghucv.exe
%WINDOWS%\zysaxyczld.exe
[-HKEY_CURRENT_USER\Software\CrystalRealityCleaner]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{DD651081-A909-45ad-BD71-2335B0ADE043}"=- (Already removed)
"{9754B85A-3B34-4969-BE1F-CD03227E9470}"=- (Already removed)
"{7DD4A7AC-A3F1-4495-884A-7947C5B89108}"=-
"{2C70168B-97CE-4f31-B85D-1FEC5002721D}"=-
"{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}"=-

Muutokset v2.309 - v2.310

%SYSTEM%\215651\
O2 - BHO: 215651 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\215651\215651.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]
O3 - Toolbar: Internet Service - {51D81DD5-55B7-497F-95DB-D356429BB54E} - C:\Program Files\NetProject\wamdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51D81DD5-55B7-497F-95DB-D356429BB54E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{51D81DD5-55B7-497F-95DB-D356429BB54E}"=-

Muutokset v2.308 - v2.309

O2 - BHO: (no name) - {7C109800-A5D5-438F-9640-18D17E168B88} - C:\Program Files\NetProject\sbmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}]
%SYSTEM%\375013\
O2 - BHO: 375013 helper - {74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B} - C:\WINDOWS\System32\375013\375013.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]

Muutokset v2.307 - v2.308

%WINDOWS%\sysqyzwud.exe
%WINDOWS%\config.ini
%WINDOWS%\sysscpmqn.exe
%WINDOWS%\syssngbeh.exe
%WINDOWS%\sysutrnez.exe
%WINDOWS%\syszweuas.exe
%WINDOWS%\xcbhwuq.exe
%WINDOWS%\xewuaqj.exe
%WINDOWS%\xfjzrby.dll
%WINDOWS%\xhbxcnv.exe
%WINDOWS%\mywallpaper.bmp
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}"=-
"{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}"=-
"{DD651081-A909-45ad-BD71-2335B0ADE043}"=-
"{9754B85A-3B34-4969-BE1F-CD03227E9470}"=-

Muutokset v2.305 - v2.307

%SYSTEM%\tdidrv32.sys
%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {DF47DD37-AC11-4A93-8E16-2B2364AF0897} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]
%WINDOWS%\norlatmx.exe
%WINDOWS%\fmrcjmdc.exe

Muutokset v2.304 - v2.305

%USERPROFILE%\Application Data\?????.exe (Awola6 Dropper, Random filename)
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Windows Adapter 5.1.3214"=-
%USERPROFILE%\Application Data\Awola6\
%STARTMENU%\Programs\Awola6\
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Awola6"=-
%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]

Muutokset v2.303 - v2.304

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow]
"*.securewebinfo.com"=-
"*.safetyincludes.com"=-
"*.securemanaging.com"=-

Muutokset v2.300 - v2.301

O4 - HKCU\..\Run: [Pest-Capture] C:\Program Files\PestCapture\PestCapture.exe
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pest-Capture"=-
%SYSTEM%\sysockeu.exe
%SYSTEM%\sysokuaw.exe
%SYSTEM%\sysodkcs.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"[1029BB4B-16A9-4E77-AA3D-96930BD68EEC]"=-
"[2177F056-0AA6-4D6C-A944-13F71F341C29]"=-
"[852EBF20-A95D-4F1F-B9C2-B2CD24350F3E]"=-
%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F10DE2B-E923-4548-B524-4D9C5FA80777}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F10DE2B-E923-4548-B524-4D9C5FA80777}

Muutokset v2.299 - v2.300

%SYSTEM%\mgmrwmrv.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,

Muutokset v2.298 - v2.299

Update: IEDFix.exe 1.5
O2 - BHO: Windows Media Player - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\wmpdxm.dll
%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {03B902B1-9B25-4173-9468-56775C85A8D4} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03B902B1-9B25-4173-9468-56775C85A8D4}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B902B1-9B25-4173-9468-56775C85A8D4}

Muutokset v2.297 - v2.298

Update: VAC Fix 0.5

Muutokset v2.295 - v2.296

C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\RomAvp.dll
C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"RomAvp"=-

Muutokset v2.292 - v2.293

%WINDOWS%\764.exe
%WINDOWS%\7search.dll
%WINDOWS%\absolute key logger.lnk
%WINDOWS%\aconti.exe
%WINDOWS%\aconti.ini
%WINDOWS%\aconti.log
%WINDOWS%\aconti.sdb
%WINDOWS%\acontidialer.txt
%WINDOWS%\adbar.dll
%WINDOWS%\cbinst$.exe
%WINDOWS%\daxtime.dll
%WINDOWS%\default.htm
%WINDOWS%\dp0.dll
%WINDOWS%\eventlowg.dll
%WINDOWS%\fhfmm-Uninstaller.exe
%WINDOWS%\fhfmm.exe
%WINDOWS%\flt.dll
%WINDOWS%\hcwprn.exe
%WINDOWS%\hotporn.exe
%WINDOWS%\iexplorr23.dll
%WINDOWS%\ie_32.exe
%WINDOWS%\jd2002.dll
%WINDOWS%\kkcomp$.exe
%WINDOWS%\kkcomp.dll
%WINDOWS%\kkcomp.exe
%WINDOWS%\kvnab$.exe
%WINDOWS%\kvnab.dll
%WINDOWS%\kvnab.exe
%WINDOWS%\liqad$.exe
%WINDOWS%\liqad.dll
%WINDOWS%\liqad.exe
%WINDOWS%\liqui-Uninstaller.exe
%WINDOWS%\liqui.dll
%WINDOWS%\liqui.exe
%WINDOWS%\ngd.dll
%WINDOWS%\pbar.dll
%WINDOWS%\pbsysie.dll
%WINDOWS%\settn.dll
%WINDOWS%\spredirect.dll
%WINDOWS%\vxddsk.exe
%WINDOWS%\wbeCheck.exe
%WINDOWS%\wbeInst$.exe
%WINDOWS%\wml.exe
%WINDOWS%\xadbrk.dll
%WINDOWS%\xadbrk.exe
%WINDOWS%\xadbrk_.exe
%WINDOWS%\xxxvideo.exe
%SYSTEM%\ace16win.dll
%SYSTEM%\acespy\
%SYSTEM%\ESHOPEE.exe
%SYSTEM%\msole32.exe
%SYSTEM%\rxjddnvj.exe
%SYSTEM%\vxddsk.exe
%SYSTEM%\winfrun32.bin
%SYSTEM%\wml.exe
%PROGRAMFILES%\3721\
%PROGRAMFILES%\Accoona\
%PROGRAMFILES%\akl\
%PROGRAMFILES%\amsys\
%PROGRAMFILES%\e-zshopper\
%PROGRAMFILES%\p2pnetworks\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12F02779-6D88-4958-8AD3-83C12D86ADC7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Cleaning Userinit or deleting if empty
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Cleaning Userinit

Muutokset v2.291 - v2.292

%SYSTEM%\txdkfh.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}"="arborize"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.3.lnk
%STARTMENU%\VirusHeat 4.3.lnk
%STARTMENU%\Programs\VirusHeat 4.3\
%DESKTOP%\VirusHeat 4.3.lnk
%PROGRAMFILES%\VirusHeat 4.3\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EC085A8-9818-43B7-B975-EC7555EDA4D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1A74C41C-0837-4FBE-BA50-621EB70F01CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25297614-1B76-4C2C-82C6-62738AA0E8F0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37F89457-1208-4670-9245-58C62BD6D870}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45477032-ABD0-454D-9CE4-EA34C10322F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69E34747-0B27-4B30-AE20-1023BF29E246}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79BE5B3B-80B2-4B77-A042-EFC90F6E0DE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C0EC6BF-81B9-4FE0-9447-4ED29A36BF5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EBB34CF-1728-4136-A968-48F231DAD1B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88DAA291-B413-4C46-B378-3BE66F65369E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{936A2F4A-53F8-4D2F-92AA-2F9DE889841C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AFCC3FA7-82A9-42D5-A405-78711E97A5D6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC05A4A3-7B28-488F-AB02-6AAEDB86ACCF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E80114AA-6653-4952-9E97-5F1DC63BEE0F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9109A2A-432B-4ADD-A6FA-06BA22DCD2D9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FCA3958A-8D38-4D14-8B81-CCD7F68A8A01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CBD02E9B-37EF-47D2-96B0-3ABBB2EB92BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.3.exe 4.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 4.3"=-

Muutokset v2.290 - v2.291

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\??????????.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}
%STARTMENU%\Programs\SearchVideo\
%Programs%\SearchVideo
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchVideo]
[-HKEY_CURRENT_USER\Software\SearchVideo]
%SYSTEM%\svxmhpz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67dc0736-075a-4647-95f5-d5421b838fed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{67dc0736-075a-4647-95f5-d5421b838fed}"="esperantido"

Muutokset v2.289 - v2.290

%STARTMENU%\Programs\SearchPorn\
%Programs%\SearchPorn
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchPorn]
[-HKEY_CURRENT_USER\Software\SearchPorn]

Muutokset v2.288 - v2.289

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {8BD4438C-2511-4B93-AD34-2BDCD0FF78D2} - C:\Program Files\Helper\1203020309.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}
%STARTMENU%\Programs\ChristmasPorn\
%Programs%\ChristmasPorn
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChristmasPorn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ChristmasPorn]
[-HKEY_CURRENT_USER\Software\ChristmasPorn]
%SYSTEM%\eeioq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{917f93bf-6714-4e11-8982-59db2e0f88fc}"="epistylar"

Muutokset v2.287 - v2.288

%PROGRAMFILES%\Helper\ (Already removed)
O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1202750081.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]

Muutokset v2.282 - v2.283

%SYSTEM%\iinqyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27cb634d-c84e-4c00-9b53-f5523601dbad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27cb634d-c84e-4c00-9b53-f5523601dbad}"="cariniana"
%SYSTEM%\wuuawkz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{747e1fbe-b70f-441d-bbca-6e536c04924a}"="didact"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk
%STARTMENU%\VirusHeat 3.9.lnk
%STARTMENU%\Programs\VirusHeat 3.9\
%DESKTOP%\VirusHeat 3.9.lnk
%PROGRAMFILES%\VirusHeat 3.9\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0979850F-6C3E-4294-B225-B3D3C4A6F2A1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BB2DA5F-B78F-44EA-BDA1-771CBE1DEC68}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A4E73C5-BA3C-4391-B7E5-FFE8D3BD6245}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44A923CA-F430-4F85-9F84-5153ECDB882E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E6E21EC-9D72-4164-8A53-74786A467872}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{631E9E48-B066-43DA-92AC-6DADF61B173B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{65C1361C-E696-4AF0-9E21-81910193F352}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DCE805-C8CE-48AA-A47F-BFA6CC7704B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D42769F-07D8-494D-AAB4-AA1652C541FA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1922071-390C-418D-916D-91209E95D286}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1F8CD95-CFB3-43D1-A956-63441CC058C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A63B46AD-96A7-4A2C-BD8F-8CD097E1593A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A65F98DD-2360-468C-B76E-B1B84C0D547C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE2AEED0-BE1B-4BA2-826E-20D1991081B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7F73787-6206-4BBA-BDC0-7CFA9940DBCB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E770F739-2968-4ED9-A63C-DC1938DC82A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CFAFA83C-855B-4E3D-92B9-A587995B675A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 3.9.exe 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 3.9]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusHeat 3.9"=-

Muutokset v2.280 - v2.281

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132E4218-F960-4E17-B3F6-0F05431D81C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{435DEA43-7D14-47F0-8223-B416BD296464}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82FC6E1B-7C32-4144-B95D-22D757327778}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D604E3C4-21ED-43D4-8CDF-759954DE7E88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{132E4218-F960-4E17-B3F6-0F05431D81C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB41490A-2B8A-414F-BFFB-D3527364EE25}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19C93F79-69BC-4994-B6C6-8D9CCCD9C454}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CB7E3AA3-D273-428B-A0DD-579689D26EC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bsdw]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AB41490A-2B8A-414F-BFFB-D3527364EE25}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DD6CD4E-6AAA-44DC-A804-88EB672341D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE78CF65-D188-487A-9A39-5DBFC77BF015}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15EE94F8-5660-47F1-8358-0D386BC64247}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AB01356-C318-4E73-998C-8E54C8EB5E64}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA97E13E-1DED-4851-B684-BAD36D8E29B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.brgk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}"=-
%SYSTEM%\ctfmona.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmona"=-
%PROGRAMFILES%\IECodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F27B120-0DED-4701-85B4-4CC58D92534C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9D18326E-AD27-4757-8564-79929B2F6363}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45490C66-3E2A-46cb-880B-547D69157450}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VSCHelp]
[-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL] (Already removed)
[-HKEY_CURRENT_USER\Software\Classes\AppID\{A45C8C0C-E056-4892-A589-E389355E1E31}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{45490C66-3E2A-46cb-880B-547D69157450}]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO] (Already removed)
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1] (Already removed)

Muutokset v2.277 - v2.278

Changelog is now private.
Some people were using informations of this page to include malware files and keys to update and develop their tools.

Muutokset v2.276 - v2.277

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8113B5DE-F7EB-4154-A311-497FB80D8BD0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"=-
O2 - BHO: SXG Advisor - {EF39E67B-8383-4A49-AAC6-29349FA7F623} - C:\WINDOWS\dntpkwodpx.dll
O3 - Toolbar: ekxdvft - {F25117E3-2A27-4A0C-88EE-D9307F678DD0} - C:\WINDOWS\ekxdvft.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F25117E3-2A27-4A0C-88EE-D9307F678DD0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27DBACCC-358C-4C2A-98FB-C79AFD3691C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6A74AFE4-24A0-49E7-9FC9-2A603F486441}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8323182A-2264-4A99-B9F8-40F3A425FCD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1385D09E-8B2D-45E1-B235-49E12B248AD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A98CC268-6435-4453-8DB5-A31C3DEB74BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bwtn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F25117E3-2A27-4A0C-88EE-D9307F678DD0}"=-
%WINDOWS%\fxtqdrl.exe
%WINDOWS%\agrlmvp.dll
%WINDOWS%\bmlvqkn.dll
O21 - SSODL: agrlmvp - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\agrlmvp.dll
O21 - SSODL: bmlvqkn - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bmlvqkn.dll

Muutokset v2.275 - v2.276

VideoAccessCodec update.

Muutokset v2.274 - v2.275

Update: IEDFix v1.3

Muutokset v2.273 - v2.274

Update: IEDFix v1.1. The tool will now detected new generic files and registry keys/subkeys without updates.

Muutokset v2.272 - v2.273

%WINDOWS%\pdswin.dll

Muutokset v2.270 - v2.271

%WINDOWS%\websrc32.dll

Muutokset v2.269 - v2.270

%SYSTEM%\cjuvwa.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0123eb75-964c-4cb3-b796-431cc9099570}"="disgorging"
%WINDOWS%\corpol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E330678D-C3B1-4AC1-AD7B-2F9CAC58F889}]

Muutokset v2.268 - v2.269

%WINDOWS%\pmspl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38583F22-1B12-4893-9D7A-BD3FA2A114C7}]

Muutokset v2.266 - v2.267

Added: IEDFix.exe tool to remove IE Defender keys and BHO from registry.
%SYSTEM%\sysvideo32.dll

Muutokset v2.265 - v2.266

%WINDOWS%\msvideo.dll
O2 - BHO: Video - {80590BC5-F4BA-4AD1-B216-C19EE86E2A77} - C:\WINDOWS\msvideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\msvideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msvideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]

Muutokset v2.264 - v2.265

%WINDOWS%\windivx.dll
O2 - BHO: Video - {F5E81149-92B2-47D2-A12B-1B966AB46EA7} - C:\WINDOWS\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]

Muutokset v2.263 - v2.264

%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]

Muutokset v2.260 - v2.262

%WINDOWS%\windivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
%WINDOWS%\jokvip.exe
%WINDOWS%\blopenvt??.dll
%WINDOWS%\retnsrp.dll
%WINDOWS%\nopzet.dll
%WINDOWS%\leorop.dll
O2 - BHO: OFK System - {29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A} - C:\WINDOWS\blopenvtlv.dll
O3 - Toolbar: The retnsrp - {5FCD26F2-55C1-40F3-838A-FB4FD8833A53} - C:\WINDOWS\retnsrp.dll
O21 - SSODL: nopzet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopzet.dll
O21 - SSODL: leorop - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\leorop.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A914309-35E8-4A15-A175-56F7C7631A5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4E7132F-BC0F-4464-81AC-25F677AA7500}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18A7928B-2F6D-4B65-8DBB-96579CE0702D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D2CF7C5-E65C-470A-86FE-56C68CF07CBD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31820FB5-5CBD-49FF-92AD-795165A01C92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D7FDFC0-2192-4150-B573-DEE0661876C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F48D75B5-D574-4059-8D6B-6FA61DC0EAE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{88BB4245-F609-48CF-9C95-FAE9735037F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E8C85D6-5E9F-467B-896E-7127AED75504}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DD0501B8-8D05-446E-A510-EDCC0E43618D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.blos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"nopzet"=-
"leorop"=-
%ProgramFiles%\IECodec\
O2 - BHO: IECodecBHO - {4507C219-24AA-4813-9561-A2003F9920C3} - C:\Program Files\IECodec\IECodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA5EAB81-9E79-4751-8E06-3E68FF0CFFB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7C12A866-F10B-43B4-A9D0-8857C318AF17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4507C219-24AA-4813-9561-A2003F9920C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec]
[-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL]
[-HKEY_CURRENT_USER\Software\Classes\AppID\{9F264A67-6126-451A-8D14-D6EE64364CD0}]
[-HKEY_CURRENT_USER\Software\Classes\CLSID\{4507C219-24AA-4813-9561-A2003F9920C3}]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO]
[-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1]

Muutokset v2.258 - v2.260

%SYSTEM%\uglgs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76fbb79c-2ec6-4962-a324-fd4362588e1c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{76fbb79c-2ec6-4962-a324-fd4362588e1c}"="graphologists"
%SYSTEM%\ncrjf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}"="caribi"
%SYSTEM%\tvtpwp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}"="eaton"
O2 - BHO: (no name) - {E8249E69-A809-4544-832F-64EB65747A92} - C:\Program Files\Online Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E8249E69-A809-4544-832F-64EB65747A92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8249E69-A809-4544-832F-64EB65747A92}]
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}]
%WINDOWS%\stream32a.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\stream32a.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D23D68-9E03-4FF0-8035-C6184C8784EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{60B18D81-366A-4156-83B9-CF310ED9A8B7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stream32a.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
%WINDOWS%\vipext???.dll (Already removed)
O2 - BHO: OFK System - {014F04C1-4440-4901-9A39-D08B116C1BA0} - C:\WINDOWS\vipextgpk.dll
O3 - Toolbar: The voipwet - {476B38B7-6E7C-46B4-8080-F61ED0E814F2} - C:\WINDOWS\voipwet.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{014F04C1-4440-4901-9A39-D08B116C1BA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{476B38B7-6E7C-46B4-8080-F61ED0E814F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7ADB274-7419-4788-906D-C880FBAD11B9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEEEB14B-DB9F-48BB-B56D-CCDA3B942592}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{209A3C3B-B2C9-4451-9DD8-7B1C585ACC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25474AF2-E3DE-4E68-8DE8-0B0786735E01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5846BDF0-1EBB-4112-B601-2DA11EEF610E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CE5A74B-1E8B-4FD5-8C10-F49A2092FF8A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF809BE5-B8E2-4CD1-92DB-68129F895A64}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{13FD02D1-7E01-4CEA-B81D-595847E04645}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4795C864-D705-4009-B0A2-5F432FE6B61B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5383337F-EEC2-4B25-9C42-8992B49C7AFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bmrl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{014F04C1-4440-4901-9A39-D08B116C1BA0}]

Muutokset v2.257 - v2.258

%SYSTEM%\ymmzwd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{075a465d-0af2-4b79-8db3-2fda0fd8d74c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{075a465d-0af2-4b79-8db3-2fda0fd8d74c}"="arsenicism"
%SYSTEM%\zcwlnic.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d66c22b6-2217-4d1a-9a90-1a54de1fc706}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d66c22b6-2217-4d1a-9a90-1a54de1fc706}"="edgers"
%WINDOWS%\vipext???.dll
O2 - BHO: MSVPS System - {00A00BA9-9D58-4B56-8FC6-C280650A8BD7} - C:\WINDOWS\vipextpnk.dll
O3 - Toolbar: The voipwet - {167F6405-019D-4F32-8FBE-23B3C63CD8FD} - C:\WINDOWS\voipwet.dll
O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll (Already removed)
O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{167F6405-019D-4F32-8FBE-23B3C63CD8FD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EB24324-3394-4C5F-B69C-744A74797952}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C37AC-F6DC-4C75-B61A-8F86BC5A9E9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{133621C3-9F52-4497-A814-97D268F8CACE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{36009226-067D-47C0-A497-7B2E5D3FAF03}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63115489-CFBF-4B7F-8B2F-EC1811041239}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A98BEE2D-F5D8-4BBB-B041-077CEFF0CA41}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE58E4D5-E8E1-4F59-AC3F-6315810A7889}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{603C15E0-CC27-45BB-82FD-8B2B6143E574}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A930694-495D-4C93-A483-D72FEF0EF1CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EFD7B225-FD88-40C7-931F-1FEEA9585D5C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bros]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{167F6405-019D-4F32-8FBE-23B3C63CD8FD}"=-

Muutokset v2.256 - v2.257

%SYSTEM%\sysdivx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\sysdivx.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609F107D-88EE-4D19-B56F-6C21A3E9DC1F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F94E2B67-3D7A-4F94-AF35-5BBEDAAD3AC4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sysdivx.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
%WINDOWS%\nretcip.exe
%WINDOWS%\vipextoxn.dll
%WINDOWS%\voipwet.dll
%WINDOWS%\jetctrl.dll
%WINDOWS%\kopmet.dll
O2 - BHO: MSVPS System - {5EF40AC5-1BBE-4436-A9E3-F129C0D605D8} - C:\WINDOWS\vipextoxn.dll
O3 - Toolbar: The voipwet - {D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C} - C:\WINDOWS\voipwet.dll
O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll
O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C5B3552-E18F-45BE-BEA8-78ACEC1F2C6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D79308A2-F924-4CD6-A52A-158C68EF41F8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{602F5204-5CD4-4160-9506-2CA8266FAC4D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60C84877-62D8-4996-88E5-BAF3D115F09F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AEA32A1-63D2-4DE6-A1F8-C2132972C15F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9924DC07-F8D2-4A19-A396-9871B55612D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B039EF74-B33F-468E-BE93-2A4F0D61DF59}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{212B4E0F-BEA8-4894-800D-2C7E2EF097AD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3DD88B10-20E4-4085-BB2C-5A58B49910A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5216FD0F-3915-4F95-95CF-4F09659F58C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.btgn]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gormet"=-
"pmkret"=-
%WINDOWS%\oprevpfm.dll
O2 - BHO: MSVPS System - {3CE12841-9438-48A0-9DA9-D3D2D3D562CC} - C:\WINDOWS\oprevpfm.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]
%WINDOWS%\werbetpwg.dll (already removed)
O2 - BHO: MSVPS System - {7EB8B2AC-28EE-45F1-9834-418FC9D72DDF} - C:\Windows\werbetpwg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]
%WINDOWS%\hdtip.dll (already removed)
O3 - Toolbar: The hdtip - {E3E087D3-CA1D-4ECA-9960-D85944C2554C} - C:\Windows\hdtip.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3E087D3-CA1D-4ECA-9960-D85944C2554C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E3E087D3-CA1D-4ECA-9960-D85944C2554C}"=-

Muutokset v2.255 - v2.256

%SYSTEM%\ivrllc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b585105c-0e84-4ef0-9c6a-fbe134a72945}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b585105c-0e84-4ef0-9c6a-fbe134a72945}"="ineffulgent"
%SYSTEM%\PowerVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
O3 - Toolbar: IE Custom Tools - {EFAF6EA3-615D-4F83-8748-2F7A576FCEA6} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}=-

Muutokset v2.254 - v2.255

%WINDOWS%\monhop.exe
%WINDOWS%\werbet???.dll
%WINDOWS%\hdtip.dll
%WINDOWS%\gormet.dll
%WINDOWS%\pmkret.dll
O2 - BHO: MSVPS System - {A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE} - C:\WINDOWS\werbetdqw.dll
O3 - Toolbar: The hdtip - {85B2F289-7128-4C5A-A330-F9FC01432D3A} - C:\WINDOWS\hdtip.dll
O21 - SSODL: gormet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\gormet.dll
O21 - SSODL: pmkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\pmkret.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F25839C-CB93-4394-A938-2194851C544F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85B2F289-7128-4C5A-A330-F9FC01432D3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9024FB63-4FBA-4A65-B607-5D13B76CF13F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19D21F2D-455C-4AAA-8DF0-58F3D76962B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D78A01B-FD57-464B-B5F2-BFC1702F26DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A5ED75E-2562-4266-A85D-4D66E33C50FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B983DE8B-60CD-4F7F-B09A-F8A33B26845C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA978B5D-E354-47FD-9E95-ACE61FC665DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7AAFD5DA-55D0-4FAB-8AEF-9643707042F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE73C3E4-88F7-41A0-AF79-87BE6826B8DF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F7A3BB37-D5C6-4946-AF22-DFCF804C67AB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.bpnv]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{85B2F289-7128-4C5A-A330-F9FC01432D3A}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gormet"=-
"pmkret"=-
%WINDOWS%\oprevxlw.dll
O2 - BHO: MSVPS System - {27A5292F-0C87-4E81-A34E-3131DBFCE994} - C:\WINDOWS\oprevxlw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]
%WINDOWS%\bonsws.dll
O3 - Toolbar: The bonsws - {2181E54F-274D-48B7-9E51-BC374933CD24} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2181E54F-274D-48B7-9E51-BC374933CD24}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2181E54F-274D-48B7-9E51-BC374933CD24}"=-
%WINDOWS%\oprevgkx.dll
O2 - BHO: MSVPS System - {1658DABA-FC4C-46C6-BC48-246CFEA0C436} - C:\WINDOWS\oprevgkx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]
O3 - Toolbar: The bonsws - {3FDA21ED-312C-44DD-9030-A2DC90FD1CCD} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}"=-
%WINDOWS%\oprevnpx.dll
O2 - BHO: MSVPS System - {F675EED8-4A4B-4A11-801B-08297749B83D} - C:\WINDOWS\oprevnpx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F675EED8-4A4B-4A11-801B-08297749B83D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F675EED8-4A4B-4A11-801B-08297749B83D}]
O3 - Toolbar: The bonsws - {05E9894E-9C5F-454B-A6E1-7BEF518EC87E} - C:\WINDOWS\bonsws.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}"=-
%WINDOWS%\ddkret.dll
O21 - SSODL: ddkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ddkret.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ddkret"=-
%WINDOWS%\nopctrl.dll
O21 - SSODL: nopctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"nopctrl"=-
%WINDOWS%\sawkip.exe
%WINDOWS%\jokwmp.dll
O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BA27973-068D-4F85-BE84-1251E0B20FD3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6BA27973-068D-4F85-BE84-1251E0B20FD3}"=-
%WINDOWS%\popnetmtq.dll
O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A78E352-B1FA-4C18-9C48-96DD03979770}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A78E352-B1FA-4C18-9C48-96DD03979770}]
%WINDOWS%\rmvgor.dll
O21 - SSODL: rmvgor - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\rmvgor.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rmvgor"=-
%WINDOWS%\sapnet.dll
O21 - SSODL: sapnet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\sapnet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"sapnet"=-
O3 - Toolbar: The jokwmp - {AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34} - C:\WINDOWS\jokwmp.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}"=-
%WINDOWS%\popnetkqw.dll
O2 - BHO: MSVPS System - {A4D00A75-F69A-49FD-9058-AB925712CCFF} - C:\WINDOWS\popnetkqw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]
%WINDOWS%\popnetnlf.dll
O2 - BHO: MSVPS System - {AEAAD087-D66D-4FA3-A366-8F47C32E9E5F} - C:\WINDOWS\popnetnlf.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]

Muutokset v2.253 - v2.254

%SYSTEM%\PowerVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
O2 - BHO: (no name) - {23B760D6-C98B-450B-9B32-26C7775CDF83} - C:\Program Files\Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23B760D6-C98B-450B-9B32-26C7775CDF83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23B760D6-C98B-450B-9B32-26C7775CDF83}]
O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70CC76D5-A4EE-4F25-9931-B109A63E298E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{70CC76D5-A4EE-4F25-9931-B109A63E298E}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{70CC76D5-A4EE-4F25-9931-B109A63E298E}=-
%SYSTEM%\bubbj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}"="exegeses"
%SYSTEM%\ijftc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}"="bigfeet"
%SYSTEM%\fftktmk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}"="doglike"
%SYSTEM%\moywh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"="haeckel"
%SYSTEM%\ucmbegr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d653e105-3e53-480a-b129-54d957d174bb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d653e105-3e53-480a-b129-54d957d174bb}"="groutiest"
%SYSTEM%\rldyt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0883848-1466-4470-a418-3fe7d36694b9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b0883848-1466-4470-a418-3fe7d36694b9}"="bemocked"

Muutokset v2.252 - v2.253

%ProgramFiles%\RichVideoCodec
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtect 3.8.lnk
%STARTMENU%\VirusProtect 3.8.lnk
%STARTMENU%\Programs\VirusProtect 3.8\
%DESKTOP%\VirusProtect 3.8.lnk
%PROGRAMFILES%\VirusProtect 3.8\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21688E5D-A895-4B60-B127-B76607420334}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{40E563B2-61B2-4215-819A-A7E24CF8AA3E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45FBEFBF-E8B6-44A5-B0A1-A143E1A74816}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5146B43E-B36D-4A2A-B617-CC05CC500150}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B8BED0F-5F18-4051-9908-C5C569A1AAE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63667718-EBF2-4CAB-B1E8-994D41589C24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{972F0BE3-976F-40B8-8EB4-88A25987416E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F80EA2D-53CF-4AA5-A154-F4FBF1EF6A5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A35F8FAC-755D-4F90-A5D3-F7E18D9EB100}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C269F4C1-7558-4DFC-9FB6-4C149B482586}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE92A296-3142-493C-B64E-6ED73EAFB9AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7C0DF6C-91FF-48BD-AD98-E35769394138}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8EC2704-B249-4495-A7A4-A90857BDDF4D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D91E9F36-9E44-44AB-803C-0D941FDA7988}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0757BDD-69BE-4C3F-AFC6-50D6524FA9B6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2F8C877-B06C-4B5E-95E7-AACFC9E8219D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3B8E549E-0C73-4AAB-8939-5EA2ED102CC6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtect 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtect 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtect 3.8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtect 3.8"=-

Muutokset v2.250 - v2.252

%SYSTEM%\VideoMP3.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\VideoMP3.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64130BE8-2B67-4A65-9CA5-1CC6948C1471}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E54D728-1FA3-4125-B468-C8B43C123E65}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoMP3.MP3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
%SYSTEM%\fnczfh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6fddce1-36ae-41c1-87d3-f49e514273d4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6fddce1-36ae-41c1-87d3-f49e514273d4}"="citrinous"
%SYSTEM%\xovdzz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1977ce08-a38f-43db-a856-f4aa6122131b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1977ce08-a38f-43db-a856-f4aa6122131b}"="bothrops"
%SYSTEM%\vtewupi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{831b4681-6ab9-436c-b2f1-6139158e3a91}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{831b4681-6ab9-436c-b2f1-6139158e3a91}"="eulalia"
%WINDOWS%\qdertu.exe
%WINDOWS%\ipwypkmg.dll
O2 - BHO: MSVPS System - {7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2} - C:\WINDOWS\ipwypkmg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19A236AD-F37B-40A8-A11A-7E9ABFD56CB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8955B427-6C0C-413E-A0A7-0DC2948ADA3D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE1A8EBF-5AC3-488E-8226-F38C167B6C5F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]
%WINDOWS%\bonrep.dll (Already removed)
O3 - Toolbar: The bonrep - {2357FC16-D8FC-4BF6-AFCA-573F9BD52644}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2357FC16-D8FC-4BF6-AFCA-573F9BD52644}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0E1B3BA-3D8E-456B-BCC5-163B09308240}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F575BBB6-A0A5-42C1-8406-CEDC8579FD75}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7586FC82-2EF8-4731-BAE1-22607AC0CC4A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E317C0F8-81DD-4AE8-87C7-B575A64B3696}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02A78E77-525D-4AF0-A822-CD04678CD638}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B141181-E967-42FD-AD64-52F283E12AAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7B0446D3-68BB-4A03-B907-EEE372655460}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichVideoCodec]
%WINDOWS%\advrepkon.dll
O2 - BHO: MSVPS System - {6BE306E6-555D-41B1-98FF-6453622F4F4B} - C:\WINDOWS\advrepkon.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]
%WINDOWS%\advrepgds.dll
O2 - BHO: MSVPS System - {FC91E698-C4BA-4564-9B85-659E38FCE154} - C:\WINDOWS\advrepgds.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC91E698-C4BA-4564-9B85-659E38FCE154}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC91E698-C4BA-4564-9B85-659E38FCE154}]
%WINDOWS%\ipwypwpk.dll
O2 - BHO: MSVPS System - {1BD6031F-BD9B-4DDF-A164-1D3A6701F374} - C:\WINDOWS\ipwypwpk.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]

Muutokset v2.249 - v2.250

O2 - BHO: (no name) - {D1BD315B-8706-4C47-B443-A0784865CD04} - C:\Program Files\Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1BD315B-8706-4C47-B443-A0784865CD04}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1BD315B-8706-4C47-B443-A0784865CD04}]
%WINDOWS%\advreprwd.dll
O2 - BHO: MSVPS System - {7A22D62B-562F-4D55-8B1E-3AAA6C2BA688} - C:\WINDOWS\advreprwd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]
%WINDOWS%\advrepvto.dll
O2 - BHO: MSVPS System - {E6E59F48-7BF8-4BEE-B906-273526C25DA4} - C:\WINDOWS\advrepvto.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]
%WINDOWS%\movctrlknq.dll
O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC546B33-036A-41DA-B1CC-C1D15659520E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC546B33-036A-41DA-B1CC-C1D15659520E}]
%WINDOWS%\ipwypktx.dll
O2 - BHO: MSVPS System - {9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E} - C:\WINDOWS\ipwypktx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27B9F7C0-3728-48DB-BEEE-FA1279B7E62C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC9A032C-651A-41C7-AA02-781AF6F0B132}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FB301567-C982-4C81-A21A-BDAF829299D0}]
%WINDOWS%\bonrep.dll
O3 - Toolbar: The bonrep - {6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86B93136-309C-4763-8F63-DD95DA7D4A91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F3EEF4B8-F62A-471A-8565-48BDF3BFE163}]
%PROGRAMFILES%\VideoAccessCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55C68B1E-8FE7-46FE-8269-FBDE29BF6300}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B98015-F9F4-4B36-A9D8-EE9BCA7C2AC6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C14EEF3C-32F1-47DF-AFE1-ED8EEC9F0C0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD2D9F83-5761-4291-B713-A2C5044DD722}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BCF3C064-B623-4934-A025-56F151FA3778}]
%WINDOWS%\neobus.dll
O21 - SSODL: neobus - {5D1C9A4F-438B-4C5C-BE66-FAAA08D4BF49} - C:\WINDOWS\neobus.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"neobus"=-
%WINDOWS%\kbdctrl.dll
O21 - SSODL: kbdctrl - {A3023D18-B93F-4892-B89B-56FB36382B8F} - C:\WINDOWS\kbdctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"kbdctrl"=-

Muutokset v2.248 - v2.249

%SYSTEM%\eulbn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{48a7a70a-e118-4506-a373-c9d4e8a212a1}"="arturo"
%WINDOWS%\advrepnok.dll
O2 - BHO: MSVPS System - {CFF8726A-9262-441C-8163-C6371E9EDE47} - C:\WINDOWS\advrepnok.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF8726A-9262-441C-8163-C6371E9EDE47}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFF8726A-9262-441C-8163-C6371E9EDE47}]
%SYSTEM%\mp3avi.dll
O2 - BHO: Mp3 Video - {D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF} - C:\WINDOWS\system32\mp3avi.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\mp3avi.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mp3avi.MP3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]

Muutokset v2.247 - v2.248

%SYSTEM%\bqrcr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2dcea392-ea10-4e6d-aba4-329ac377119c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2dcea392-ea10-4e6d-aba4-329ac377119c}"="brachypyramid"
%PROGRAMFILES%\EZVideo\
%STARTMENU%\Programs\EZVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EZVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZVideo]
[-HKEY_CURRENT_USER\Software\EZVideo]
%SYSTEM%\a3gpcodec.dll
O2 - BHO: 3GP - {5D67E2E7-0C2B-4491-87C4-37F2AC6033D2} - C:\WINDOWS\system32\a3gpcodec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\a3gpcodec.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\a3gpcodec.a3GP]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
%DESKTOP%\IE Defender 2.3.lnk
%STARTMENU%\Programs\IE Defender 2.3.lnk
%PROGRAMFILES%\IE Defender
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Defender]
[-HKEY_CURRENT_USER\Software\IEDefender]

Muutokset v2.246 - v2.247

Update, due to legit software (XunLei, a Chinese downloader) , using the same CLSID as the infection, this one is not removed anymore:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]
%SYSTEM%\dx50codec.dll
O2 - BHO: RealMedia - {87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95} - C:\WINDOWS\system32\dx50codec.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\dx50codec.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dx50codec.RealMedia]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]
%SYSTEM%\yneid.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41591d7f-9e25-4bd0-af53-9908fcf3a738}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{41591d7f-9e25-4bd0-af53-9908fcf3a738}"="complacential"
%PROGRAMFILES%\Image Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image Add-on]
O2 - BHO: (no name) - {43BF8E0C-886D-4103-8DDB-2DFE0E8A0168} - C:\Program Files\Image Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]
%WINDOWS%\bndsrpfn.dll
%WINDOWS%\advrepdow.dll
O2 - BHO: MSVPS System - {CF368FC4-3241-409B-B1D6-0EA4FE33A555} - C:\WINDOWS\advrepdow.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]
%WINDOWS%\advrepgpd.dll
O2 - BHO: MSVPS System - {93205C3F-1221-43F4-847F-007C6A4CE9A5} - C:\WINDOWS\advrepgpd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]
%WINDOWS%\sdrmod.dll
O3 - Toolbar: The sdrmod - {210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.ToolBar.1]
%WINDOWS%\hupsrv.dll
O21 - SSODL: hupsrv - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hupsrv.dll
%WINDOWS%\bindmod.dll
O21 - SSODL: bindmod - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bindmod.dll
%SYSTEM%\proper.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\proper.exe
%SYSTEM%\bronto.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\System32\bronto.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D27987B8-7244-4DE0-AE10-39B826B492F1}]
%SYSTEM%\winter.exe
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe
%USERPROFILE%\StartMenu\Program\Startup\infos.exe
O4 - Startup: infos.exe
%AllUsers%\StartMenu\Program\Startup\autos.exe
O4 - Global Startup: autos.exe
%SYSTEM%\skuns.dat
O20 - AppInit_DLLs: C:\WINDOWS\System32\skuns.dat

Muutokset v2.245 - v2.246

%SYSTEM%\XunLeiBHO_Now.dll
O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\WINDOWS\system32\XunLeiBHO_Now.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\XunLeiBHO_Now.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xunleiBHO_Now.XunLei]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]

Muutokset v2.244 - v2.245

%WINDIR%\movctrlqtn.dll
O2 - BHO: MSVPS System - {24038BE3-4EF2-41E2-A603-4CE3BDD9E874} - C:\WINDOWS\movctrlqtn.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]
O3 - Toolbar: The nssfrch - {1699137C-B90E-4488-97BC-575C896C2B5C} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1699137C-B90E-4488-97BC-575C896C2B5C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1699137C-B90E-4488-97BC-575C896C2B5C}"=-
%WINDIR%\movctrlnkd.dll
O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]
O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}"=-
%WINDIR%\movctrlwxq.dll
O2 - BHO: MSVPS System - {90CF5384-7C70-4CD6-A30D-B2F14537B5C3} - C:\WINDOWS\movctrlwxq.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]
O3 - Toolbar: The nssfrch - {7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC} - C:\WINDOWS\nssfrch.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}"=-

Muutokset v2.243 - v2.244

%SYSTEM%\IntelVideo.dll
%SYSTEM%\sysinit32.exe
O2 - BHO: IntelVideoCodec - {04F7FAC5-F506-4F29-9094-9CB9144B192C} - C:\WINDOWS\system32\IntelVideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IntelVideo.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IntelVideo.IntelVideoCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]

Muutokset v2.241 - v2.242

%PROGRAMFILES%\Video Add-on\
%PROGRAMFILES%\Video Add-on Setup\
O3 - Toolbar: IE Custom Tools - {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}=-
O3 - Toolbar: IE Custom Tools - {062F3F8B-CB94-4D76-A98A-EF800A438F01} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{062F3F8B-CB94-4D76-A98A-EF800A438F01}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{062F3F8B-CB94-4D76-A98A-EF800A438F01}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{062F3F8B-CB94-4D76-A98A-EF800A438F01}=-
O3 - Toolbar: IE Custom Tools - {23ED2206-856D-461A-BBCF-1C2466AC5AE3} - C:\Program Files\Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23ED2206-856D-461A-BBCF-1C2466AC5AE3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{23ED2206-856D-461A-BBCF-1C2466AC5AE3}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{23ED2206-856D-461A-BBCF-1C2466AC5AE3}=-
O2 - BHO: (no name) - {B499D34E-58EF-4927-AB9F-7AF52B2C4C82} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]
%SYSTEM%\ugbtna.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}"="boardwalk"
%WINDIR%\bndsrfst.dll
%WINDIR%\bndsrsvk.dll
%WINDIR%\bndsrdkq.dll
%WINDIR%\bndsrgxt.dll
%WINDIR%\bndsrkwm.dll
%WINDIR%\bndsrtvd.dll
%WINDIR%\bndsrvnl.dll
%WINDIR%\bndsrwlq.dll
%WINDIR%\movctrlswd.dll
%WINDIR%\movctrlfqd.dll
%WINDIR%\ntspknlg.dll
%WINDIR%\ntspklqs.dll
%WINDIR%\ntspkfnd.dll
O2 - BHO: MSVPS System - {15272B08-F6FE-4E71-B2BD-A59AD23EBE3C} - C:\WINDOWS\bndsrfst.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]
O2 - BHO: MSVPS System - {05F79890-CFA6-4D53-87BC-2F390DA6645E} - C:\WINDOWS\bndsrsvk.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]
O2 - BHO: MSVPS System - {480598DD-AE28-48B7-82F7-6ADDA1AA6B66} - C:\WINDOWS\ntspknlg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]
O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]
O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]
O3 - Toolbar: The netadv - {D1413F77-5B69-4562-84E1-78F997794E9D} - C:\WINDOWS\netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1413F77-5B69-4562-84E1-78F997794E9D}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D1413F77-5B69-4562-84E1-78F997794E9D}"=-
O3 - Toolbar: The netadv - {899B0EF2-E0BE-41BA-BB41-0ABFB232813C} - C:\WINDOWS\netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}"=-
%WINDOWS%\kthemup.exe
%WINDOWS%\nssfrch.dll
O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.ToolBar.1]
O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
O21 - SSODL: hstsys - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hstsys.dll
O21 - SSODL: bxsbang - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ocgrep.dll

Muutokset v2.240 - v2.241

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusRay 3.8.lnk
%STARTMENU%\VirusRay 3.8.lnk
%STARTMENU%\Programs\VirusRay 3.8\
%DESKTOP%\VirusRay 3.8.lnk
%PROGRAMFILES%\VirusRay 3.8\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97C6E0E9-1D24-48CA-11E7-DC22C5308ABA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D723C81-2C9F-44DD-8F94-A2D3A06845E9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41FC2EBD-79F5-4FE0-8558-708DCB7FE255}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45DB217B-965D-4917-A653-C2A871534B4C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48A95844-A761-4D96-8191-0913D493823E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60FD2747-818B-4242-A041-4C1209F3D3A6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70F731FD-6C5F-4D46-A29C-6B97FABEF0D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77F6ABAA-C14B-4E0C-975E-0CFFA568B0BE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78AA9209-DED5-4F37-93A0-89FBEE57E4FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{869B656B-142E-47E6-B4F6-973D17E80BBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89F84A04-F5EF-4F4A-AF97-7DA43DD0371F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F9C1393-41D7-4BE1-8752-098BC97514D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9097FA96-8EFD-4D04-8024-C920AB56BBEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACD5D550-4481-4F05-B6D8-A78566BD81D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE096ECD-D62E-4B2D-BBA5-CBF9BFA4AB23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DDA20808-84A0-48C3-902A-7E31FF47EA6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9C4CBEB-7BDF-47FF-8EDF-D72B50BB50EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1AE427B0-E3B7-4D2E-A6B9-36605B0F214E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusRay 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRay 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRay 3.8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusRay 3.8"=-
%SYSTEM%\beahahl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb4c6870-721f-4989-9c90-8cbfa46d0298}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb4c6870-721f-4989-9c90-8cbfa46d0298}"="anomuran"
%SYSTEM%\dfrep.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab75cc7d-2751-4144-a278-5462d5a5884c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ab75cc7d-2751-4144-a278-5462d5a5884c}"="bokard"
%SYSTEM%\mxhfjy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7999c5e2-b500-4ba5-8e9a-99639eca65fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7999c5e2-b500-4ba5-8e9a-99639eca65fc}"="celtiberi"
%system%\gaaplp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}"="forayer"
%SYSTEM%\nczupfw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6d478c6-7961-4fe9-be4b-e621dd640112}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a6d478c6-7961-4fe9-be4b-e621dd640112}"="benzaldoxime"
%SYSTEM%\clbrcek.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}"="inquisitionist"
%SYSTEM%\siiyal.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1adb94e-0dc6-487c-b274-981bee6301a1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e1adb94e-0dc6-487c-b274-981bee6301a1}"="armillifer"
%SYSTEM%\sttwrd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}"="designers"
%SYSTEM%\rrtrit.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}"="eurymus"

Muutokset v2.239 - v2.240

%WINDIR%\bndsrvqt.dll
%SYSTEM%\flirek.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34ec76b6-53c4-4686-822f-910c790683fb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{34ec76b6-53c4-4686-822f-910c790683fb}"="evangeliarium"
%SYSTEM%\gdrtul.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a47e7ce0-263d-40aa-86bc-27c1f6433143}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a47e7ce0-263d-40aa-86bc-27c1f6433143}"="chinned"
%SYSTEM%\hteogat.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02e155c1-202c-43a5-a212-58bb67d4341c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{02e155c1-202c-43a5-a212-58bb67d4341c}"="bearlike"

Muutokset v2.238 - v2.239

%SYSTEM%\fifzqip.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16be3225-e902-4d2a-ac98-aab162796927}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{16be3225-e902-4d2a-ac98-aab162796927}"="ataxics"
%SYSTEM%\hymww.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79cdca21-5055-4cae-b609-e1685ef55cf7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{79cdca21-5055-4cae-b609-e1685ef55cf7}"="hydria"
%SYSTEM%\veptlh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92050ffb-b796-4146-ae27-7e5e1d93b8a8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{92050ffb-b796-4146-ae27-7e5e1d93b8a8}"="endopsychic"
%PROGRAMFILES%\WinMsg\
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sware"=-
"sclick"=-

Muutokset v2.237 - v2.238

O2 - BHO: (no name) - {CFE15135-C591-4000-A55E-A50E5F9F82BC} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFE15135-C591-4000-A55E-A50E5F9F82BC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFE15135-C591-4000-A55E-A50E5F9F82BC}]
%WINDIR%\bndsronw.dll
%WINDIR%\wsremover.exe
%WINDIR%\netadv.dll
O2 - BHO: MSVPS System - {3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A} - C:\WINDOWS\bndsronw.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}]
O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - netadv.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABF529BE-6245-465A-BBD4-238C4EAB0F0A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ABF529BE-6245-465A-BBD4-238C4EAB0F0A}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\netadv.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\netadv.ToolBar.1]

Muutokset v2.236 - v2.237

Update: WS2Fix v1.1

Muutokset v2.235 - v2.236

%WINDOWS%\svhjdsah.exe
%WINDOWS%\afxp.dll
%WINDOWS%\msvb.dll
%WINDOWS%\sysdx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msvb"=-
"sysdx"=-
%PROGRAMFILES%\Online Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Add-on]

Muutokset v2.234 - v2.235

%WINDIR%\exploeee.exe
%SYSTEM%\explore.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DoNotDelete"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DoNotDelete"=-
O4 - Startup: info.exe
O4 - Global Startup: info.exe
O20 - AppInit_DLLs: C:\WINDOWS\System32\sulimo.dat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\sulimo.dat"
%SYSTEM%\mvwqn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0f691d7-01bf-4fed-926c-7368034a45e3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e0f691d7-01bf-4fed-926c-7368034a45e3}"="barbican"
O2 - BHO: MSVPS System - {ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1} - C:\WINDOWS\div32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1}]

Muutokset v2.233 - v2.234

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirGear 3.8.lnk
%STARTMENU%\AntiVirGear 3.8.lnk
%STARTMENU%\Programs\AntiVirGear 3.8\
%DESKTOP%\AntiVirGear 3.8.lnk
%PROGRAMFILES%\AntiVirGear 3.8\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BC3AC5B-3BBB-9DBE-8166-EC650E3B9B48}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A0FC1A4-41D4-4793-9AC5-0B55CDC95AE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14F47CA3-2291-4B3E-9ED4-8C7E6AE80851}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2447284F-3590-4E8C-A869-049BD87CAD07}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38EEEF46-CA24-4ACA-A90D-540978DF7252}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D5E5AE1-5DED-4520-BDC2-B9292EA708CA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{409A05EF-1B48-4198-B6BF-993B8B52790C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{47A93011-1004-440C-9960-BD3B0348A7C2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50B388D5-4A80-4191-8BCC-5DD031D7F3EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58A1ACE6-0DBA-45D2-8154-E8253A7B87BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73D25394-992F-43D1-BF92-48494CC0D1AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D2A83A4-0687-4704-937E-A29045826F77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7FE54B2-B167-4017-BCCC-CF73B2F678E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C183B073-2D7F-45BC-8967-80147CECEE45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6FDBF9A-19A7-4F0A-9F46-6F015A067B44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F90A7969-20A0-4257-B39D-9C73D64CE3B0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA38F299-57F8-4FEB-9096-715460AE943C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE6AE29A-EB7D-4656-9418-26D5FCC9ADF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirGear 3.8.exe 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirGear 3.8]
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVirGear 3.8]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVirGear 3.8"=-
%SYSTEM%\vzfhprk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95dde900-8bf3-428c-b9be-8345c9d194f7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{95dde900-8bf3-428c-b9be-8345c9d194f7}"="homeridae"
O2 - BHO: MSVPS System - {0D5227BF-0C5B-4EA8-833C-FE09F1496F39} - C:\Windows\div32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]

Muutokset v2.231 - v2.233

Added: WS2Fix.exe
%SYSTEM%\laf1.dll
%SYSTEM%\laf1.ini
%SYSTEM%\laf2.dll
%SYSTEM%\laf2.ini
%SYSTEM%\laf3.dll
%SYSTEM%\laf3.ini
%SYSTEM%\laf4.dll
%SYSTEM%\laf4.ini
%SYSTEM%\laf5.dll
%SYSTEM%\laf5.ini
%PROGRAMFILES%\Online Video Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Video Add-on] (C:\Program Files\Online Video Add-on\uninst.exe)
O3 - Toolbar: IE Custom Tools - {41F6170D-6AF8-4188-8D92-9DDAB3C71A78} - C:\Program Files\Online Video Add-on\ictmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Custom Tools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Safety Features]
%SYSTEM%\ieffse32.dll
%SYSTEM%\regmod.exe
O2 - BHO: ieffse32.msdn_hlp - {C1C6426B-FB16-4123-ACBE-74D94FB0E663} - C:\WINDOWS\System32\ieffse32.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1C6426B-FB16-4123-ACBE-74D94FB0E663}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ieffse32.msdn_hlp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1C6426B-FB16-4123-ACBE-74D94FB0E663}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\yggyfnhb]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"some"=-
"start"=-
%SYSTEM%\swqzdtj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{adf64b1b-c68c-4ce8-bb55-258b7b8b0f81}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{adf64b1b-c68c-4ce8-bb55-258b7b8b0f81}"="aldoa"
%SYSTEM%\vusxqm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5feba593-3e6d-4606-ae6e-0680501cd29e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5feba593-3e6d-4606-ae6e-0680501cd29e}"="cacomixls"

Muutokset v2.230 - v2.231

O2 - BHO: (no name) - {D579A683-0CC7-4023-BAE7-0544D0D1DA3A} - C:\Program Files\Online Video Add-on\isfmdl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D579A683-0CC7-4023-BAE7-0544D0D1DA3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D579A683-0CC7-4023-BAE7-0544D0D1DA3A}]
%WINDOWS%\mscore.dll
%WINDOWS%\drvsvp.dll
%WINDOWS%\msmduo.dll
%WINDOWS%\msmduo2.dll
%WINDOWS%\div32.dll
%WINDOWS%\mssql.dll
%WINDOWS%\syscore.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{428FA4A4-C8EC-427C-85DE-11C80F67893A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{428FA4A4-C8EC-427C-85DE-11C80F67893A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"drvsvp"=-
"msmduo"=-
"msmduo2"=-
"mssql"=-
"syscore"=-

Muutokset v2.229 - v2.230

%PROGRAMFILES%\Online Image Add-on\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imageactivexobject.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Image Add-on] (C:\Program Files\Online Image Add-on\uninst.exe)
[-HKEY_CURRENT_USER\Software\Online Add-on]
%SYSTEM%\jrpkmgh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60dea04c-9817-4309-bfa2-f8a1766c3cd1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{60dea04c-9817-4309-bfa2-f8a1766c3cd1}"="haruspicy"

Muutokset v2.227 - v2.229

Minor Bug correction in path retriever on French SP2 OS.
O2 - BHO: MSVPS System - {31CBB13B-244D-4C44-AED5-DCAD70F66281} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CBB13B-244D-4C44-AED5-DCAD70F66281}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31CBB13B-244D-4C44-AED5-DCAD70F66281}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegedit"=-
O20 - AppInit_DLLs: C:\WINDOWS\System32\stdole32.dat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\stdole32.dat"
%SYSTEM%\pluwue.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"
%SYSTEM%\zdhgsp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc25189b-1b13-4abe-900e-65e08bd961af}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cc25189b-1b13-4abe-900e-65e08bd961af}"="escalators"
%SYSTEM%\fwjgtk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6747456b-cea8-463d-ad2a-50d67ae73d30}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6747456b-cea8-463d-ad2a-50d67ae73d30}"="cakewalks"

Muutokset v2.226 - v2.227

%SYSTEM%\lgaac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{655560a9-3ca8-4509-9632-6abbef21426b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{655560a9-3ca8-4509-9632-6abbef21426b}"="andropogon"
%SYSTEM%\iheuv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27882a9f-8937-4ae4-87ab-ed669c8b6d7a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27882a9f-8937-4ae4-87ab-ed669c8b6d7a}"="bund"
O2 - BHO: MSVPS System - {60D3EC53-56A8-46A8-9D01-1AB64410665C} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60D3EC53-56A8-46A8-9D01-1AB64410665C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60D3EC53-56A8-46A8-9D01-1AB64410665C}]

Muutokset v2.225 - v2.226

%SYSTEM%\vmlwp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4c4bc43-0974-4dec-a669-9f7bfcb3503d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d4c4bc43-0974-4dec-a669-9f7bfcb3503d}"="coexpire"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirGear 3.7.lnk
%STARTMENU%\AntiVirGear 3.7.lnk
%STARTMENU%\Programs\AntiVirGear 3.7\
%DESKTOP%\AntiVirGear 3.7.lnk
%PROGRAMFILES%\AntiVirGear 3.7\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BC3AC5B-3BBB-9DBE-8166-EC650E3B9B48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{418985AE-4FE4-448D-83EE-238C887D8FC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F251303-F8C4-44C3-A7C2-9E8A93C59322}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61840430-C7CF-43A0-9D49-3B3ED563FED1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64A8E3CA-AE17-4EB0-8C67-47D1103A5B6F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{765A8F7D-F57B-4601-A038-3F463A4D3193}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77E616D5-5DB4-4B6A-8BDA-2BE4103A9921}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8742F319-C916-4930-B781-1C148134C05C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{897F5CB6-C1C1-494E-8F17-972784193442}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2224C72-745E-4046-882F-1A48C9311D77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA500EFC-3C92-44C9-B1D6-7A7033343A50}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB5E9971-7086-4E6E-ADFA-BE9C685BE68B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD7CA0BC-693A-4AF9-B31A-60472248F761}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2882CC2-0077-426B-916D-E0B9EA23A1B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE241504-6F15-49E4-847F-B4D7DA9EA8F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1666E4E-45C8-462A-97FF-BFD5A103BFFA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD9A05E8-4A1E-45E6-B3B6-37CE20140278}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AF0C5CBA-52E1-4B29-A2DC-58D91D599612}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirGear 3.7.exe 3.7]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirGear 3.7] (C:\Program Files\AntiVirGear 3.7\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVirGear 3.7]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVirGear 3.7"=-

Muutokset v2.224 - v2.225

O2 - BHO: MSVPS System - {ACD85107-9CF9-4C9E-B0B7-39940A0017C0} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ACD85107-9CF9-4C9E-B0B7-39940A0017C0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ACD85107-9CF9-4C9E-B0B7-39940A0017C0}]
%SYSTEM%\ddllup.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8ea5f37-7327-4923-9808-8fd3b6f0d529}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b8ea5f37-7327-4923-9808-8fd3b6f0d529}"="beers"
%PROGRAMFILES%\DirectAccess\
%STARTMENU%\Programs\DirectAccess\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DirectAccess]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectAccess] (C:\Program Files\DirectAccess\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\DirectAccess]

Muutokset v2.223 - v2.224

%SYSTEM%\vvihh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b36d60c8-e1ce-464e-b74c-8128a627ef56}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b36d60c8-e1ce-464e-b74c-8128a627ef56}"="hyracina"
O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C3C4699-B285-475F-BE47-0B26088CE876}]
O2 - BHO: MSVPS System - {3CB70CC2-303F-4A6C-824D-013AE8CFDB6B} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}

Muutokset v2.222 - v2.223

O2 - BHO: MSVPS System - {695A94FD-15D0-4ED7-8F40-D2B3BDC42C15} - C:\WINDOWS\nsduo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{695A94FD-15D0-4ED7-8F40-D2B3BDC42C15}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{695A94FD-15D0-4ED7-8F40-D2B3BDC42C15}
%SYSTEM%\iklqcx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{de5ede53-9db0-422d-b32d-5c41c96d6f52}"="heterotroph"
%SYSTEM%\kzpkwj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f39d0dee-b2f0-4591-9187-1cc39c1df98a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f39d0dee-b2f0-4591-9187-1cc39c1df98a}"="biisk"
%SYSTEM%\ddomv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9f5cb985-d4a4-49af-9185-133f956b5756}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9f5cb985-d4a4-49af-9185-133f956b5756}"="anthracosaurus"
%SYSTEM%\gkymhk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{903902a8-0691-460e-8351-24df3d425e9c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{903902a8-0691-460e-8351-24df3d425e9c}"="apdu"
%SYSTEM%\ayjhc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}"="cordiformis"
%SYSTEM%\osdjhjc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}"="disenfranchising"

Muutokset v2.221 - v2.222

%SYSTEM%\systems.txt
O20 - AppInit_DLLs: C:\WINDOWS\System32\systems.txt
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\systems.txt"

Muutokset v2.219 - v2.221

Added: VCCLSID.exe tool.
Removes ShellServiceObjectDelayLoad LeftOvers random CLSID (newmediacodec/videoaccesscodec infections):
O21 - SSODL: msmdev - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\msmdev.dll
O21 - SSODL: msmhost - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\msmhost.dll
%WINDOWS%\nsduo.dll
%WINDOWS%\msmdev.dll
%WINDOWS%\msmhost.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msmdev"=-
"msmhost"=-
%SYSTEM%\muvdjo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{46f5a8b0-0b73-48c5-9e40-3c443a43c161}"="aht"
%SYSTEM%\tqcwm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bb2b2d6-8b86-412e-acca-d656a8979b3e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2bb2b2d6-8b86-412e-acca-d656a8979b3e}"="fraternalism"

Muutokset v2.218 - v2.219

%STARTMENU%\Programs\StartUp\autorun.exe
%ALLUSERSTARTMENU%\Programs\Startup\findfast.exe
%WINDIR%\shell.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe C:\WINDOWS\shell.exe"
O4 - HKLM\..\Run: [Printer] C:\WINDOWS\System32\printer.exe
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Printer"=-
%SYSTEM%\spoolvs.exe
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\System32\spoolvs.exe
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Spoolsv"=-
%SYSTEM%\fyhwfc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}"="biltongs"

Muutokset v2.217 - v2.218

%SYSTEM%\guxmhcd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fedff4ae-1302-4b8a-bda9-43b9f67b9749}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fedff4ae-1302-4b8a-bda9-43b9f67b9749}"="astronomically"
%SYSTEM%\kvfvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}"="glauke"
%SYSTEM%\hrum.txt
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hrum.txt"
%FAVORITE%\Error Cleaner.url
%FAVORITE%\Privacy Protector.url
%FAVORITE%\Spyware&Malware Protection.url
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4CF814F-970F-405D-A42C-0CE06EB97373}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4CF814F-970F-405D-A42C-0CE06EB97373}]
O3 - Toolbar: Protection Bar - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - C:\Program Files\Video ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}"=-

Muutokset v2.216 - v2.217

%SYSTEM%\mivmv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6625fc6c-731c-443a-b3f0-2c8c520a1766}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6625fc6c-731c-443a-b3f0-2c8c520a1766}"="anhydrase"
%SYSTEM%\zdwii.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fdde73c-273e-4e55-84dc-455de06e4866}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2fdde73c-273e-4e55-84dc-455de06e4866}"="amaretti"
%SYSTEM%\tiqmcx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}"="athermancies"

Muutokset v2.215 - v2.216

%SYSTEM%\fwrkqfl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e886df7-914d-48f0-86b3-a5cf24385361}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6e886df7-914d-48f0-86b3-a5cf24385361}"="falsism"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hadjajr.ini"
%SYSTEM%\hadjajr.ini
%SYSTEM%\gopa.exe

Muutokset v2.213b - v2.215

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.7.lnk
%STARTMENU%\VirusProtectPro 3.7.lnk
%STARTMENU%\Programs\VirusProtectPro 3.7\
%DESKTOP%\VirusProtectPro 3.7.lnk
%PROGRAMFILES%\VirusProtectPro 3.7\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03F65A7B-6E49-4ACE-848B-4459DDBD3981}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15125718-D196-47C9-8FBF-9889C0C85D67}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21C40A12-3079-4A70-A715-8A44CE0DE829}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A3E745F-1EAE-441F-A5D5-E53C909CEEC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F6A3DCF-D68F-4663-8C25-312BCDBE4D47}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48129B70-2F29-4DBA-A499-BEB1A1554E10}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{484E9A1B-C631-47F3-9BC0-F752CDAAFB9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1886D5E-3508-4109-A8A0-F045AA86F3A3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2817460-5C53-4B41-8D01-D3EF255DD41E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AEEA2138-2168-449E-B995-B56612EEF65E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AEFD40BB-03E3-4C66-ABFB-B5720ACB833E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9C7A624-88E3-4DFA-8D56-438B10BC0149}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D21FBDCE-EF01-417C-A1A1-C1EEDB8D5DB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBA2671E-29BF-42D8-B17E-AB5315CC73C5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F105F0C9-50E2-44FA-B3EC-92CA7BFE0C0D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F664EA90-9B91-4825-9B51-5635AC38CCA6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6D7F9517-F134-45E3-BF2E-73414FF15CA1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.7.exe 3.7]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.7] (C:\Program Files\VirusProtectPro 3.7\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.7]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.7"=-
%SYSTEM%\tmxxxh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70d17a5f-ef27-4295-90f5-20ad6f24834f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{70d17a5f-ef27-4295-90f5-20ad6f24834f}"="dizening"
%SYSTEM%\ccyszwl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}"="arachnodacty"
%SYSTEM%\igzxwrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18a8f76b-804b-4981-b87c-460699971a4b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{18a8f76b-804b-4981-b87c-460699971a4b}"="dataria"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hrum323.txt"
Update: %SYSTEM%\vtr167.dll -> %SYSTEM%\vtr???.dll
O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr???.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ABCDECF0-4B15-11D1-ABED-709549C10000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\WINDOWS\System32\hanonvt.ini"
%SYSTEM%\hanonvt.ini
%SYSTEM%\vtr167.dll

Muutokset v2.213 - v2.213b

Correction of a minor bug (missing caracter } ) in
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"=-

Muutokset v2.212 - v2.213

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}]
%SYSTEM%\ryxrho.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}"="archiblast"
%SYSTEM%\zkpssqa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}"="bosken"

Muutokset v2.211 - v2.212

O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5DDE5591-A8AB-4897-93EF-1E4E943F85A7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5DDE5591-A8AB-4897-93EF-1E4E943F85A7}]
O3 - Toolbar: Protection Bar - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - C:\Program Files\Image ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}"=-
%SYSTEM%\vpccw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e758745e-b8aa-47ac-a652-6307ff5f3ebf}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e758745e-b8aa-47ac-a652-6307ff5f3ebf}"="counterclaim"

Muutokset v2.210 - v2.211

%PROGRAMFILES%\Video iCodec\
%STARTMENU%\Programs\Video iCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Video iCodec]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video iCodec]
[-HKEY_CURRENT_USER\Software\Video iCodec]
%SYSTEM%\eigbbb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4da240e-7525-404a-b366-f50a422376d8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c4da240e-7525-404a-b366-f50a422376d8}"="arouse"
%SYSTEM%\nexpegp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"="electroosmoses"
%SYSTEM%\xtsyynm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4029063-4fe3-422c-ac72-12905c09642a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a4029063-4fe3-422c-ac72-12905c09642a}"="clinker"
%SYSTEM%\fqdqs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}"="heterostyly"
%PROGRAMFILES%\VideoAccessCodec\
%WINDOWS%\duocore.dll
%WINDOWS%\wmpenv.dll
%WINDOWS%\wmpconf.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoAccessCodec] (C:\Program Files\VideoAccessCodec\Uninstall.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VAC.Video]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo] (C:\WINDOWS\main_uninstaller.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7AF59C20-A1D8-4C1C-927A-99DD9F2A9E0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AF59C20-A1D8-4C1C-927A-99DD9F2A9E0B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wmpenv"=-
"wmpconf"=-

Muutokset v2.209 - v2.210

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.6.lnk
%STARTMENU%\VirusProtectPro 3.6.lnk
%STARTMENU%\Programs\VirusProtectPro 3.6\
%DESKTOP%\VirusProtectPro 3.6.lnk
%PROGRAMFILES%\VirusProtectPro 3.6\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A2C9DEF-83EB-4575-AD6C-2377FEFC5122}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56943D7C-2283-4D73-B2B1-46173B4844B4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71C9109D-EB8D-49B9-9211-1CBE8A25A9AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75F32B07-D45F-4D5B-9266-3863C65D5B29}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84037416-6A70-46E5-9216-CDCC7E2513E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94E14C33-2473-4185-9FA0-3D881BDB5C0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{95D963D7-86E3-434E-BFF6-FCDDEA5F9F24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9DC10DE5-5104-4554-ACA0-D9F2D146CD4C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A140FE51-3136-4E0D-AFDA-1313B30ADFEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B41DF4F9-0191-46E6-8107-16634FBC7F3C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE1C526E-CCCC-449C-A9CB-691B8C5E2769}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE465556-F79D-476F-9457-74E49F8F400A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8DFA789-47D3-4197-B187-23AE2D7DCF6A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0277D0D-43C7-4ECA-B8C4-545A2E71485B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA166DBF-EAC4-4D33-B48D-A40B8C8FDEC1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0ED2F90-DE03-46AD-97C1-709E5A49422C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40331B9F-75E5-4E1E-B511-5AA6638B9ADE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.6.exe 3.6]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.6] (C:\Program Files\VirusProtectPro 3.6\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.6]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.6"=-
%SYSTEM%\vophqmn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}\InProcServer32] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e71aba09-d81a-4876-baa3-df133c1dfc48}"="helicoid" (Already Removed)
%SYSTEM%\fshqaln.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4a9e875b-d032-45e4-8294-789fe3be5b19}"="atrichia" (Already Removed)
%SYSTEM%\ktrxe.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}"="hemprich"

Muutokset v2.208 - v2.209

%SYSTEM%\gusur.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f5f16ef-af9d-4fe6-8410-f0670b58979d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4f5f16ef-af9d-4fe6-8410-f0670b58979d}"="exultet"
%SYSTEM%\khtbpdl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c82e1789-207a-4b8a-806f-76b62dfac2a2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c82e1789-207a-4b8a-806f-76b62dfac2a2}"="hutlet"
%SYSTEM\afqgda.exe
%SYSTEM\printer.exe
%SYSTEM\WinAvX.exe
%SYSTEM%\WinAvXX.exe
%SYSTEM\atzrdada.dll
%STARTMENU%\Programs\StartUp\system.exe
%ALLUSERSTARTMENU%\Programs\Startup\autorun.exe
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=0x00000001
"DisableTaskMgr"=0x00000001
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinAVX"="C:\WINDOWS\System32\WinAvX.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoControlPanel"=0x00000001
"NoWindowsUpdate"=0x00000001
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinAVX"="C:\WINDOWS\System32\WinAvX.exe"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe C:\WINDOWS\System32\printer.exe"

Muutokset v2.207 - v2.208

%SYSTEM%\zpuwriz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{547aaa89-7e6b-42b4-b112-a64955f86a2a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{547aaa89-7e6b-42b4-b112-a64955f86a2a}"="adirondack"
%SYSTEM%\tkrsw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}"="clamourers"
%SYSTEM%\lrnjnzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4c46558-da01-4637-a85e-f1ccb1c7436a}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e4c46558-da01-4637-a85e-f1ccb1c7436a}"="hyams"
%SYSTEM%\afzdbl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8068bf35-3711-4dce-a2f3-f008cecfe894}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8068bf35-3711-4dce-a2f3-f008cecfe894}"="araca"
%SYSTEM%\ugofuq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c704547b-26c0-4222-a034-81653c07b494}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c704547b-26c0-4222-a034-81653c07b494}"="eperdument" (Already removed)
%SYSTEM%\gtawclv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e71aba09-d81a-4876-baa3-df133c1dfc48}"="enjoyment"
%SYSTEM%\vjxwnn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd2948f8-c949-464f-824a-6272608c739e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd2948f8-c949-464f-824a-6272608c739e}"="criticalness"
%SYSTEM%\fdpzgi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1c6fd4e6-49ce-4178-875b-df70eac260c5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1c6fd4e6-49ce-4178-875b-df70eac260c5}"="aguilarite"
O2 - BHO: (no name) - {34E6F97C-34E0-4CE5-B92B-F83634BEDC01} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01}]
%STARTMENU%\Programs\XXXAccess\
%PROGRAMFILES%\XXXAccess\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXAccess]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XXXAccess] (C:\Program Files\XXXAccess\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\XXXAccess]

Muutokset v2.206 - v2.207

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Messenger Service]
O2 - BHO: (no name) - {D61D7E1A-6613-49CA-B6F9-51DB248E209D} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Security Plug-in]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Secure Bar]
%SYSTEM%\wzhtjqo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}"="enlodgement"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.5.lnk
%STARTMENU%\VirusProtectPro 3.5.lnk
%STARTMENU%\Programs\VirusProtectPro 3.5\
%DESKTOP%\VirusProtectPro 3.5.lnk
%PROGRAMFILES%\VirusProtectPro 3.5\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00628C22-6886-439B-AA2E-3639367F02A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14B512A9-25CF-4C90-AE5F-418689DF0A8D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{39D23F6A-E2DE-4F5D-9118-ECDFAAE47E9C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B334543-06C2-4B5F-B7CB-8028A4570B39}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E79A538-7998-4BB7-B8A7-0E12243D7A99}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{42348314-FC64-4B2E-B314-3F872C321B87}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58BD1E88-EFEE-404E-BE17-DF639B57CB56}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64D947B2-5505-4347-80A5-E28EEBE38F2A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D3C0252-8850-440E-A386-4A0159C8A4DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9B8BE22F-B2BB-472B-8959-C0828C0ADDC7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CD68722-9A43-42E4-BD01-2DE85D9CB565}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A8502478-83BC-48DB-9937-6EEB77CED41E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF1B7AB6-9715-472D-B469-74DE8D030EB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEB46F7E-CF37-4E8F-BA48-D96F1A434224}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2315CDD-4F9A-4DDA-8671-252465FF0B5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF442B5E-B5C0-4469-85C8-4B0B2A579EE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CD3A8ECE-6016-469E-9964-C479F9157BCC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.5.exe 3.5]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.5] (C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.5]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Muutokset v2.205 - v2.206

%WINDOWS%\sconf32.dll
%WINDOWS%\wmplayer.dll
%WINDOWS%\wmsound.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C014816-5BD4-4166-85EA-62FE05E517C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C014816-5BD4-4166-85EA-62FE05E517C3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wmplayer"=-
"wmsound"=-
%SYSTEM%\psndz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa55d551-9698-48ac-b639-9b00cf1a6ea0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa55d551-9698-48ac-b639-9b00cf1a6ea0}"="grazable"
%SYSTEM%\cqsfk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cea2e5cd-e849-427b-80f0-59298caef1c4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cea2e5cd-e849-427b-80f0-59298caef1c4}"="convalescently"

Muutokset v2.204 - v2.205

%WINDOWS%\soundplugin.dll
%WINDOWS%\sounddrv.dll
%WINDOWS%\xvideo.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85E659D3-E110-4CE7-9D99-416FD61A1720}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85E659D3-E110-4CE7-9D99-416FD61A1720}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"sounddrv"=-
"xvideo"=-
%SYSTEM%\cefrjsh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1c16871-b797-4ec7-bbee-83852379c390}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a1c16871-b797-4ec7-bbee-83852379c390}"="formicivora"
%SYSTEM%\onljweo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}] (Already Removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{33b8d257-07f6-4c06-8605-94bc21728635}"="discommodiousness" (Already Removed)
%SYSTEM%\yhjbbzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f29a27-2451-4314-a480-8d2481ce6c81}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{49f29a27-2451-4314-a480-8d2481ce6c81}"="cyk"
%SYSTEM%\vgibz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4a9e875b-d032-45e4-8294-789fe3be5b19}"="dustuck"
%SYSTEM%\wpchz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5889f7b0-3277-4266-b4bd-1bf2d394aee6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5889f7b0-3277-4266-b4bd-1bf2d394aee6}"="hydronephrosises"

Muutokset v2.203 - v2.204

%SYSTEM%\surzzh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cfda6372-043c-48d2-ba3c-7bfe1cf71854}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cfda6372-043c-48d2-ba3c-7bfe1cf71854}"="inscenation"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.4.lnk
%STARTMENU%\VirusProtectPro 3.4.lnk
%STARTMENU%\Programs\VirusProtectPro\ (Already Removed)
%DESKTOP%\VirusProtectPro 3.4.lnk
%PROGRAMFILES%\VirusProtectPro 3.4\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A8C61AE-9639-4E4D-AF61-25B0CE935EAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DF3EB27-E122-4E77-9481-D9332351B606}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BA582C8-6240-4DC4-BB8E-1B764134A47B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F6BD5E9-CEBD-4EB8-94B5-9C4E9C219306}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DE68A1C-09C2-4724-BB80-CB5AAFB96D99}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{720B32BB-73D5-4551-B743-986224487121}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A238C6-F6A8-41D3-90FD-95F31F02FB33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76C8C569-C4B8-4E0C-AE87-E1166D7FE005}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79E77B74-D820-4E39-802F-084F9DDCE038}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F7AFA67-ADC0-4227-B799-34F7800EBC96}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C254C9C5-DE04-49F1-9FC1-72EF4F7F1F6C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA91A4F1-3DC6-4D10-8AE3-8545E86D9DB8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0E42329-DCA9-4825-B87D-04B789BBB169}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D92E0D32-8D1B-4B8B-AF26-0676C5158ADA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E082EF71-40AF-4A4E-B036-BB773F450B53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAB5EB70-E2F1-4ADA-B033-151A71B9AA3F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{795175C7-3F75-4F45-AB6C-4FFE32A85BCB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.4.exe 3.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.4] (C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.4]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.4"=-

Muutokset v2.202 - v2.203

O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E26CEADA-67B0-4543-BE8B-307F00265118}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E26CEADA-67B0-4543-BE8B-307F00265118}]
%SYSTEM%\wfcof.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}"="firstlings"
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F4DB301-0698-4AF4-A8A2-473996DF425A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F4DB301-0698-4AF4-A8A2-473996DF425A}]

Muutokset v2.201 - v2.202

%windir%\msddx.dll
%windir%\msqnx.dll
%windir%\qnxplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4118A625-1B64-4ED1-A2E9-76DEC529D2D2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4118A625-1B64-4ED1-A2E9-76DEC529D2D2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msddx"=-
"msqnx"=-
%SYSTEM%\drivers\svchost.exe
%USERPROFILE%\svchost.exe
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"autoload"=-
"autorun"=-
%SYSTEM%\myqlejy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98ca7898-6029-41ab-8f67-ea4f5e1afc22}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{98ca7898-6029-41ab-8f67-ea4f5e1afc22}"="biocomputing"

Muutokset v2.200 - v2.201

%SYSTEM%\winntify.exe
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winnotify]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winnotify]
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]
%SYSTEM%\xnvaogd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}"="coronally"
%SYSTEM%\lapmvzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fde1bd72-ca80-443f-9526-595337b73878}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fde1bd72-ca80-443f-9526-595337b73878}"="hieroglyphist"

Muutokset v2.199 - v2.200

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.3.lnk
%STARTMENU%\SpyLocked 4.3.lnk
%STARTMENU%\Programs\SpyLocked 4.3\
%DESKTOP%\SpyLocked 4.3.lnk
%PROGRAMFILES%\SpyLocked 4.3\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2BD02A28-2CE5-41E6-83DB-6763E671CB86}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D5D65CB-D4DE-46D9-985F-F80D9F34C979}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4249D82A-882F-467B-9AA3-DCC40078EA69}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FBE506D-6726-42B5-ADB0-0B56AF0AEFB7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54DA8FE1-16CC-4304-921D-88DD591884EA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6036EFF9-4750-435D-BA00-2E4971A17954}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67BFFC72-F133-4C2A-8C2C-EC9B46FFB80C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B619BBA-1BB8-47F4-85B2-AEEE204AFE3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8E02BA95-D9BC-4E9F-AE33-38DD988CC868}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90B449E1-A378-4DBB-BAE6-4F5492B954C4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99D26682-D444-4106-B346-A31B25B315E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A76871A-CBEB-479C-9984-253AEF6CB3E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9B11649A-0DA6-4581-9A17-9DA31AD7FD42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7152573-FA25-4BEA-8026-1EC8A5205D11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA7301E0-686C-4C7C-95B7-1B96D2ED1A61}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E831429A-73A3-44D4-8935-DEEC11216093}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A321A998-2771-4235-B458-6B09AF6463B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.3.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.3] (C:\Program Files\SpyLocked 4.3\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 4.3"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{100B21CD-3B97-44FB-B1C0-EA6249E482E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100B21CD-3B97-44FB-B1C0-EA6249E482E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XVideo]
%WINDOWS%\avp.exe
%WINDOWS%\mgrs.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avp"=-
"smgr"=-

Muutokset v2.198 - v2.199

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.3.lnk
%STARTMENU%\VirusProtectPro 3.3.lnk
%STARTMENU%\Programs\VirusProtectPro\ (Already Removed)
%DESKTOP%\VirusProtectPro 3.3.lnk
%PROGRAMFILES%\VirusProtectPro 3.3\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D52BB09-465C-4AA4-9FBD-71D1690CAED3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{24998748-6E8A-40D1-AA97-E9952EE9ED18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{287FFE0C-15D0-4BFD-BAA9-0582C6361BBB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45973D31-5CE3-4503-BC81-25E525119C48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46D4D563-1C43-4CEE-AF98-471385F2BC42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5596A310-2E54-4B75-ADA3-7EE0AD10E228}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C17F7D3-8460-4488-84EB-986A38BEDD2D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71DF187C-DC99-4A35-BDB2-C099821A435D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{74DF3F5E-99D7-4F4D-81C3-95201D4CDA88}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91478017-FF82-4C5D-9FFF-7801F8D99CCC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F9C8CF3-EB4A-4851-A4F6-2370F5BC79EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B1B9C911-CA24-4E1E-9F56-838486218327}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C78E49C0-AB82-4C79-A189-F1E34980643B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2A0598F-FBC4-4721-BC85-F75C0712C100}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7B2831E-A25A-430B-B3E3-3D414F9C4288}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EDC652FF-2EA2-4E46-8849-D9041B77B88E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{049FECE3-18C7-4023-A1BE-CFAA2C4EE387}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.3.exe 3.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.3] (C:\Program Files\VirusProtectPro 3.3\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusProtectPro 3.3"=-

Muutokset v2.196 - v2.197

%WINDOWS%\vpsnetwork.dll
%WINDOWS%\expro.dll
%WINDOWS%\vpssup.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1770FD6-A7CB-44DA-AD2C-692D2A2B521B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1770FD6-A7CB-44DA-AD2C-692D2A2B521B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"expro"=-
"vpssup"=-

Muutokset v2.195 - v2.196

O2 - BHO: (no name) - {CDE8EAB9-CEF3-4885-B12F-26960A25C800} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE8EAB9-CEF3-4885-B12F-26960A25C800}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDE8EAB9-CEF3-4885-B12F-26960A25C800}]
O2 - BHO: (no name) - {36ADA89D-2440-4DC4-820A-3A05E8630935} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36ADA89D-2440-4DC4-820A-3A05E8630935}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36ADA89D-2440-4DC4-820A-3A05E8630935}]
O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Image ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}"=-
%SYSTEM%\iauoi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ff419a8-1748-4ca7-99df-d269465b0e8b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9ff419a8-1748-4ca7-99df-d269465b0e8b}"="cornerer"
%SYSTEM%\igpfced.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bbe40fd-0416-4c3f-80ea-0c7ad5fb1aab}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8bbe40fd-0416-4c3f-80ea-0c7ad5fb1aab}"="crawley"
%SYSTEM%\cdwvhbf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3afa7405-68e8-4bdb-920e-0d506f552826}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3afa7405-68e8-4bdb-920e-0d506f552826}"="concise"
%SYSTEM%\gbjkog.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41eaa909-24be-4d24-877f-076a0576a6fd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{41eaa909-24be-4d24-877f-076a0576a6fd}"="castigating"
%SYSTEM%\tczij.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}"="farrandly"
%SYSTEM%\iwwvh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9c0c879c-9091-45d1-807f-2adc37d7d6d6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9c0c879c-9091-45d1-807f-2adc37d7d6d6}"="breadthes"
%SYSTEM%\xedasn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{33b8d257-07f6-4c06-8605-94bc21728635}"="drays"
%SYSTEM%\dooep.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44e670f2-d57b-4815-a576-955d17dbbf2d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{44e670f2-d57b-4815-a576-955d17dbbf2d}"="cankered"
%SYSTEM%\afkvvy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4688f900-0d0c-4788-b297-59cc10e70ccc}"="bipinnatifid"
%WINDOWS%\ddesupport.dll
%WINDOWS%\msole.dll
%WINDOWS%\msdde.dll
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49CF52D7-8D58-4E22-A874-AAD721F5B523}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49CF52D7-8D58-4E22-A874-AAD721F5B523}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSDNS] (C:\WINDOWS\main_uninstaller.exe 1) (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WINSP] (C:\WINDOWS\main_uninstaller.exe 2) (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msole"=-
"msdde"=-

Muutokset v2.194 - v2.195

Update: Generic Renos Fix 1.14
%SYSTEM%\yesgnhr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f396a67-f473-48c9-9950-636ce17e584e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6f396a67-f473-48c9-9950-636ce17e584e}"="hellenophile"
%SYSTEM%\xpuupdate.exe
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Video ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF4E7A0C-E233-4906-B4C1-A404356541FF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{DF4E7A0C-E233-4906-B4C1-A404356541FF}"=-
%WINDOWS%\wincom27.dll
%SYSTEM%\ext32inc.dll

Muutokset v2.192 - v2.193

%SYSTEM%\ckimzeb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5bf53d50-b1ec-47b6-a00a-0bd32baeb7ef}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5bf53d50-b1ec-47b6-a00a-0bd32baeb7ef}"="damkjernite"
%USERPROFILE%\Application Data\AdProtect NoSpam\
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\ContraVirus 2.0.lnk
%STARTMENU%\ContraVirus 2.0.lnk
%STARTMENU%\Programs\ContraVirus\
%DESKTOP%\ContraVirus 2.0.lnk
%PROGRAMFILES%\ContraVirus\
%SYSTEM%\xpuupdate.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad-protect.EXE] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEControl.DLL] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\spamdet.DLL]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ToolBarNotifier.EXE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6B677F1F-F86C-4757-BF24-7D865EF20639}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7C11C36C-2AE0-4489-9B09-A6129139D52D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C628512D-A058-4BD4-B47B-B036F45FA02B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE8C6A5-A75F-4e33-89C3-18CC58A0B952}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61877300-54DB-4746-BA42-03E03A2B269C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBBD3E11-D201-46C9-8471-091D33159287}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFCBB188-18E3-1DEB-59D5-BACE1CE655A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7ABE914-B8CF-4602-9145-6BDAAEDA21AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBE5BEE8-F032-11DB-826A-C4BB56D89593}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA038DDD-0FE0-41f5-BA60-FC3660529E71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61877300-54DB-4746-BA42-03E03A2B269C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63321A5C-D8FE-432C-8D2F-61C0FC264320}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F51BC478-D997-4C56-988D-79D9EEAAD1EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F82FD7D4-2EC8-40B3-A141-DE051C98DCE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD4DCB8B-C33A-4E70-A351-6FAB7E1071A4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{283ED043-D403-4808-BF28-FCDE29DCF1FB}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2C02E5FC-7FE3-4122-911F-829314FE9BBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{32BD20FD-41FD-47FB-9BC9-28DCBD7D55D7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B677F1F-F86C-4757-BF24-7D865EF20639}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DFCDA823-80C5-4F55-B328-7EFD4AFBD9A0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension.1] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCToolBand.SCToolBandObj]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCToolBand.SCToolBandObj.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ToolBarNotifier.Notifier]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ToolBarNotifier.Notifier.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ContraVirus.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBE5BEE8-F032-11DB-826A-C4BB56D89593}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContraVirus] (C:\Program Files\ContraVirus\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\ContraVirus]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\AdLoader]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Trace7]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell\1das]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell\dnl7]
[-HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins\Ad-Protect.Addin.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EA038DDD-0FE0-41f5-BA60-FC3660529E71}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ContraVirus"=-
"Windows Updater Servc"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyCrush 3.1.lnk
%STARTMENU%\SpyCrush 3.1.lnk
%STARTMENU%\Programs\SpyCrush\ (Already Removed)
%DESKTOP%\SpyCrush 3.1.lnk
%PROGRAMFILES%\SpyCrush 3.1\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}] (Already Removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14D6736F-9918-46D2-A96B-75713158DC9C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{33220D50-BB09-4F83-ABC2-E94011D088B5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35A2B3DD-3B38-4E9E-A547-6E459A6E91AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{472B58B5-B00C-4DC5-83ED-FE8185FFBCBE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB98812-6071-4D01-BC87-7E2CECB9C248}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DBE72DB-B023-47C2-AB01-D2323AADFA5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60F366A1-5D3B-4D3E-ACE3-CB8C25474FF6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{754E70B2-E0DF-45CE-9429-CCFE0DD7AEA5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7583195C-5F83-4AD6-82D1-3C2F553F93E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77CAC444-50CC-4E1C-955C-55E325360864}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7DF4D9FC-1B6F-4093-8BC7-6A0F750B59D8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91EF3AD8-9373-4B3F-AAF5-2984E3E34385}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAD385C7-7B45-43FC-BF4E-EABB990337FF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC2A49C8-5970-4DA5-B784-32CD8617B6B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F3FAE2B3-0961-40A7-94C7-67A28967BE58}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB65F713-07A1-404D-889A-5789E383AB02}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3C4CCBFA-2ADA-43F3-9A40-F729DD31EC5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyCrush 3.1.exe 3.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush 3.1] (C:\Program Files\SpyCrush 3.1\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush 3.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyCrush 3.1"=-

Muutokset v2.191 - v2.192

Added: Rustock, xpdx driver detection
%SYSTEM%\pkjcoxq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1d3b05d-4dd9-468d-982e-c342f05436e5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e1d3b05d-4dd9-468d-982e-c342f05436e5}"="crowsteps"

Muutokset v2.190 - v2.191

%SYSTEM%\ipmon.exe
O4 - HKLM\..\Run: [ipmon] ipmon.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ipmon"=-
%SYSTEM%\eeuydc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44e670f2-d57b-4815-a576-955d17dbbf2d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{44e670f2-d57b-4815-a576-955d17dbbf2d}"="auditioned"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.1.lnk
%STARTMENU%\SpyLocked 4.1.lnk
%STARTMENU%\Programs\SpyLocked 4.1\
%DESKTOP%\SpyLocked 4.1.lnk
%PROGRAMFILES%\SpyLocked 4.1\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D3F4979-14F0-4344-95F9-D019C75ED669}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1DEAC6D1-27B1-4804-8309-86F80E64D91F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21EE18CF-E24C-4AD8-A279-C34EEB5F18A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22489F95-AA2E-4DFE-A00C-4F5D0DFDAFD6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{273582F0-3C1E-4BFC-B2A4-8348AE47F717}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27491041-2CCB-4A37-9297-FB84134ECAD4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{464B2A01-EB39-4CF6-B6BB-6262776B79DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60DDD776-BD47-421A-9B75-C5965C1AAEB3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C2AD1F2-670F-4096-9CF5-6FBEA48D2E38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A45C94F8-E114-48EB-84C9-DE1B871E1A3A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B48F25A0-49A8-46AE-B506-A789F8E91A51}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D3F81C5A-3A2D-464C-B617-289495AE52DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6BC961E-2230-4A37-B7DC-F311773C7DBE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F8681E4A-3B1B-46C5-9A0E-E4BDCD240A92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA08D9EC-0C7B-4C37-8D7A-E7837B997E90}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC51DED7-D056-45E5-A4FF-A308E2DECFA5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9F99FD1A-5C53-4B82-981A-92A0F587D59B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.1.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.1] (C:\Program Files\SpyLocked 4.1\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 4.1"=-

Muutokset v2.189 - v2.190

%PROGRAMFILES%\PornoPlayer\
%STARTMENU%\Programs\PornoPlayer\
[-HKEY_CURRENT_USER\SOFTWARE\PornoPlayer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PornoPlayer]

Muutokset v2.188 - v2.189

%PROGRAMFILES%\VideoPlugin\
%STARTMENU%\Programs\VideoPlugin\
%WINDIR%\ossmart.dll
%WINDIR%\pssms.dll
%WINDIR%\vpnconfig.dll
%WINDIR%\privacy_danger\ (Already removed)
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16789285-C094-4aa6-88B9-2BB9DC13A485}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{16789285-C094-4aa6-88B9-2BB9DC13A485}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ossmart"=-
"vpnconfig"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSDNS] (C:\WINDOWS\main_uninstaller.exe 1)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WINSP] (C:\WINDOWS\main_uninstaller.exe 2)

Muutokset v2.186 - v2.188

ded: xpdt driver detection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}"=-
%SYSTEM%\viuaoq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7058baa-49a4-40b7-95c2-eec95cdf51f3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d7058baa-49a4-40b7-95c2-eec95cdf51f3}"="infumate"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.0.lnk
%STARTMENU%\SpyLocked 4.0.lnk
%STARTMENU%\Programs\SpyLocked 4.0\
%DESKTOP%\SpyLocked 4.0.lnk
%PROGRAMFILES%\SpyLocked 4.0\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.0.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.0] (C:\Program Files\SpyLocked 4.0\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 4.0"=-

Muutokset v2.185 - v2.186

%PROGRAMFILES%\Security Tools\
%SYSTEM%\indwvm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25b7d2fd-4f71-46d1-801a-7de323e4ec82}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{25b7d2fd-4f71-46d1-801a-7de323e4ec82}"="equiparant"

Muutokset v2.184 - v2.185

Muutokset v2.183 - v2.184

Update: Generic Renos Fix 1.14

Muutokset v2.182 - v2.183

%PROGRAMFILES%\Image ActiveX Access\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image ActiveX Access]
O2 - BHO: (no name) - {B8C5186E-EC37-4889-9C2E-F73649FFB7BB} - C:\Program Files\Image ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8C5186E-EC37-4889-9C2E-F73649FFB7BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8C5186E-EC37-4889-9C2E-F73649FFB7BB}]
%SYSTEM%\dtjby.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0c5a0fff-9164-493b-93e0-17446374e0a0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0c5a0fff-9164-493b-93e0-17446374e0a0}"="inflexive"

Muutokset v2.181 - v2.182

%SYSTEM%\uimcu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6ad686b9-ab56-4ebc-a804-9f70b55b4577}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6ad686b9-ab56-4ebc-a804-9f70b55b4577}"="floripondio"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.9.lnk
%STARTMENU%\SpyLocked 3.9.lnk
%STARTMENU%\Programs\SpyLocked 3.9\
%DESKTOP%\SpyLocked 3.9.lnk
%PROGRAMFILES%\SpyLocked 3.9\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.9.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.9] (C:\Program Files\SpyLocked 3.9\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.9]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 3.9"=-

Muutokset v2.180 - v2.181

%WINDIR%\msdn.dll
%WINDIR%\bandserv.dll
%WINDIR%\loader.exe (Already removed)
%WINDIR%\tlhelp.dll
%WINDIR%\iereport.dll
%WINDIR%\main_uninstaller.exe (Already removed)
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D76F06D4-1659-482d-BCB2-3F731BFE0941}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bandserv.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bandserv.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D76F06D4-1659-482d-BCB2-3F731BFE0941}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"tlhelp"=-
"iereport"=-

Muutokset v2.179 - v2.180

%SYSTEM%\antzozc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa4fbf53-c766-4622-8011-a87a805eebf0}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa4fbf53-c766-4622-8011-a87a805eebf0}"="deboner"
%PROGRAMFILES%\Protection Tools\
%PROGRAMFILES%\Video ActiveX Access\
O2 - BHO: (no name) - {7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8} - C:\Program Files\Video ActiveX Access\iesplg.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}]
O3 - Toolbar: Protection Bar - {31615D5C-5126-448A-818A-A7CDFEE85A9B} - C:\Program Files\Video ActiveX Access\iesbpl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31615D5C-5126-448A-818A-A7CDFEE85A9B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{31615D5C-5126-448A-818A-A7CDFEE85A9B}"=-

Muutokset v2.178 - v2.179

%SYSTEM%\kgkdbsk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{735e980d-45d2-4777-af82-9923d3c8d3ae}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{735e980d-45d2-4777-af82-9923d3c8d3ae}"="heterandrous"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.7.lnk
%STARTMENU%\SpyLocked 3.7.lnk
%STARTMENU%\Programs\SpyLocked 3.7\
%DESKTOP%\SpyLocked 3.7.lnk
%PROGRAMFILES%\SpyLocked 3.7\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.7.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6] (Already removed - C:\Program Files\SpyLocked 3.7\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.7]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 3.7"=-

Muutokset v2.176 - v2.177

%SYSTEM%\egzcqg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ede8bed5-92cf-4482-8f51-a01cd9b3ea37}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ede8bed5-92cf-4482-8f51-a01cd9b3ea37}"="antiforeigner"
O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - C:\Program Files\Video AX Object\bpvol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9}]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiped 6.1.lnk
%STARTMENU%\MalwareWiped 6.1.lnk
%STARTMENU%\Programs\MalwareWiped 6.1\
%DESKTOP%\MalwareWiped 6.1.lnk
%PROGRAMFILES%\MW\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{035C1836-0D78-DABC-F4A7-D5D0517EE1F9}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A3C742D-8A14-4DD6-806C-CAEC606F6F83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16398BFE-0D35-45A1-AD20-3E5B605D79C5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{347D361F-EC65-450D-9121-AF8E20A3F1C1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E2F7E84-20BA-45FA-A72E-9C09B3891E30}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F84EE83-FD4B-4223-B76E-F23F645DCCB3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50CE778D-7505-4374-ABDB-99C6A5139374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58ADBAFD-D14D-49A2-94EC-4FE8165FD336}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6BEAC051-C197-4951-AF23-4B0522F0303D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{768C89B1-97D9-4153-ACB4-A03FBBFDE184}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{98198A41-C7DB-4F67-AF6C-80F90FEFE047}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A13D839A-E2F0-4E33-B615-592F5CCA5B26}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0E59B82-9A6A-4DFC-94EE-1753A82269A8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C70A5BCF-0F65-4F9E-B869-119D60184E1F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DB9996C3-E22F-4096-8349-C3821C08B1E2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5C6D1A4-502C-4EC2-A472-D14BE3311335}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE0BB4EE-ECC6-4696-BED1-A802ACFECA80}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A538B417-2054-4F1D-9843-0BC8F94B9889}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiped 6.1.exe 6.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiped 6.1] (C:\Program Files\MW\MalwareWiped 6.1\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWiped 6.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWiped 6.1"=-

Muutokset v2.175 - v2.176

%SYSTEM%\xuoce.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{da3b49f6-8c54-4429-a275-21a86dcca413}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{da3b49f6-8c54-4429-a275-21a86dcca413}"="admissibility"

Muutokset v2.174 - v2.175

%WINDIR%\iedns.dll
%WINDIR%\loader.exe (Already removed)
%WINDIR%\main_uninstaller.exe (Already removed)
%WINDIR%\msdn32.dll
%WINDIR%\msdns.dll
%WINDIR%\tlhelper.dll
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msdn32.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msdn32.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDNS.MSDNSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}"=- (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msdns"=-
"iedns"=-

Muutokset v2.173 - v2.174

%WINDIR%\browsers.dll
%WINDIR%\ieproxy.dll
%WINDIR%\loader.exe (Already removed)
%WINDIR%\main_uninstaller.exe (Already removed)
%WINDIR%\msie.dll
%WINDIR%\service.dll
%DESKTOP%\Error Cleaner.lnk (Already removed)
%DESKTOP%\Privacy Protector.lnk (Already removed)
%DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5574E139-F59C-4bee-9A61-150B0D3A16C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\browsers.StockBar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\browsers.ToolBar.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDNS.MSDNSApp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5574E139-F59C-4bee-9A61-150B0D3A16C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}"=- (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msie"=-
"ieproxy"=-

Muutokset v2.172 - v2.173

Update: Generic Renos Fix 1.13
%SYSTEM%\lcsrsrv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}"="huet"

Muutokset v2.171 - v2.172

%SYSTEM%\ilmpjy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4233ac08-a2c4-4742-a0b4-83719613d62c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4233ac08-a2c4-4742-a0b4-83719613d62c}"="grassily"
%SYSTEM%\rcohty.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b23dc537-3e13-44c7-bf67-d8405eb377f7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b23dc537-3e13-44c7-bf67-d8405eb377f7}"="bedstead"
%SYSTEM%\dxovx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{716002db-288c-4bf0-80cd-a467e78d8b55}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{716002db-288c-4bf0-80cd-a467e78d8b55}"="depreciable"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.6.lnk
%STARTMENU%\SpyLocked 3.6.lnk
%STARTMENU%\Programs\SpyLocked 3.6\
%DESKTOP%\SpyLocked 3.6.lnk
%PROGRAMFILES%\SpyLocked 3.6\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{062BC936-7CE4-421C-944E-BD388EC91C86}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22F1A770-B823-48D4-8693-B953902A06EF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A7A14FD-7FEC-48CF-A06F-210344DE6E75}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41E4ADCD-CCC2-4DA0-97C3-83051A4C35F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54D2D4FC-914C-432C-B638-599F48D77A08}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F342C0C-EF49-49E2-B3F1-FE28F193B974}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F61B413-1DFE-4C4C-8CD4-B97BE0B17504}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764CE36A-C778-42A8-B3B2-4B09A4B10469}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87EA76C9-411E-44D0-8270-EA2DF3941133}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94792C8E-6FE0-462C-9D20-AD560608DDA1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99EAEF8C-652D-407C-8319-781A2BB30FF7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A392D107-AFBF-4E1B-8092-DB508BC890A5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD2AA1CD-22FF-4562-A616-1C64A42985BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2D197C9-8570-4AC8-A121-92F9A8CCD857}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CBCCB1D8-AB10-4B4C-9982-A8DEA99F3111}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F198A883-6BCF-4B94-A890-D8ED007FBCF7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DA226F0-FE43-4F80-A94A-1848039DE0DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.6.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6] (C:\Program Files\SpyLocked 3.6\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.6]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked 3.6"=-

Muutokset v2.170 - v2.171

%SYSTEM%\yuspej.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3baa1ad8-ee49-4772-bf0b-f55083e0f7aa}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3baa1ad8-ee49-4772-bf0b-f55083e0f7aa}"="ephemeran"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.5.lnk
%STARTMENU%\SpywareLocked 3.5.lnk
%STARTMENU%\Programs\SpywareLocked 3.5\
%DESKTOP%\SpywareLocked 3.5.lnk
%PROGRAMFILES%\SpywareLocked 3.5\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02743820-2E7C-42C6-B60C-726D67379EDB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D8286F5-9606-46C5-89D8-9B6379877732}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{521C4C7E-D2CF-4EB1-A078-6E126269E0AD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67E054FA-0F1E-4AF8-899B-0B52660D7043}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{697C34C8-BBAC-418C-999A-A5525F4FF8C3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{711C2540-AA7D-4C40-A8C0-9B1BC920378D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80A2BFBD-7906-48EF-9F76-49B9F822393B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87A8C087-37C2-40C4-9CDF-97437A9F54BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8ED3825E-77A7-41D4-BDCB-FD8CC2B0D183}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2E56D03-930A-4BBF-8C8E-4D63D15F88EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ABAE0DAF-A6BA-481F-B3BA-0666D0D1B2EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5B6AA2C-F0C7-44B9-A861-261958ECD0B8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BD8C66A5-617B-4ABF-B56D-F547597FE0FA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D675FD26-7200-466F-A380-182FE49AF8AA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8073D3D-D957-45BE-82CA-BB44FD0E9C4B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF906CF9-6EEB-4626-9A17-2E48C11D2995}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A74E275-351B-4072-8F0B-CBE2B7231B37}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLocked 3.5.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.5] (C:\Program Files\SpywareLocked 3.5\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.5]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked 3.5"=-
%PROGRAMFILES%\Video AX Object\
O2 - BHO: (no name) - {D34F5D71-99E4-4D96-91CA-F4104F69B8AE} - C:\Program Files\Video AX Object\bpvol.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}]
O3 - Toolbar: Protection Bar - {F0993251-2512-4710-AF6E-0A13EA199D02} - C:\Program Files\Video AX Object\splug.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0993251-2512-4710-AF6E-0A13EA199D02}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0993251-2512-4710-AF6E-0A13EA199D02}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video AX Object]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert]
[-HKEY_CURRENT_USER\Software\Protection Tools]

Muutokset v2.169 - v2.170

NTFS Bug Correction
%SYSTEM%\czxtyx.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e4e5110-a772-4c4a-a7dc-137fe10abd6e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0e4e5110-a772-4c4a-a7dc-137fe10abd6e}"="calocarpum"

Muutokset v2.168 - v2.169

%WINDOWS%\dxdiag.dll
%WINDOWS%\iebrowser.dll
%WINDOWS%\iecontext.dll
%WINDOWS%\loader.exe
%WINDOWS%\main_uninstaller.exe (Already removed)
%DESKTOP%\Privacy Protector.url
%DESKTOP%\Spyware&Malware Protection.url
%DESKTOP%\Error Cleaner.url
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06CB2908-DD90-4293-8C98-9ABA1025F163}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3828496C-9E4F-4278-8C85-0DF3A3CB41EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{477D1353-BA0E-43CC-8F40-DEA6BF81ADEE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD7DB09-1199-41E2-BE9D-AB1D29DD0C3E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C42E5047-FCAD-4B62-A4B0-1052C76A9E1B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F301710A-1204-44C8-A611-E89E58FEFFDA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"iebrowser"=-
"iecontext"=-

Muutokset v2.167 - v2.168

Update: Generic Renos Fix 1.12
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.4.lnk
%STARTMENU%\SpywareLocked 3.4.lnk
%STARTMENU%\Programs\SpywareLocked 3.4\
%DESKTOP%\SpywareLocked 3.4.lnk
%PROGRAMFILES%\SpywareLocked 3.4\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{212DF34E-EAD7-4831-89D8-70CB70581D82}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69F0456D-B449-4FAC-AF03-B0FBB4B39C53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7A3BABC0-3D33-4B9D-B11E-EF36E1BFFFBF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F71D7E5-202B-4B8D-94EB-2B30E4212C18}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8FF07C20-5965-476E-84E8-82374C559BE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ADA0950-D83C-4C52-83AE-D8258A4B527E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A829592E-08BA-4D4D-87C8-6524687D90E6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AC66E7A3-928B-4F20-B7AC-B3A86298005C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B14649A3-BD2E-4483-B8D6-BF80F82F5D24}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B87C48D1-28E3-48FC-9B27-EEDBB7619A17}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA091197-32FE-48D8-8696-AF64D8A1CA44}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF4DDC95-8A4B-47C1-A89E-0CBF849DE042}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D74998BF-0AB6-4C8D-801D-EB50CB73FFDF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E849D321-F077-4946-94EF-696F864F0BE5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA5973F9-1064-4393-838F-1B44CB09A1DE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0091942-BEF6-447E-8F73-B844A4F62851}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{04B12611-E1E1-45E3-9376-91984B957880}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLock.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.4] (C:\Program Files\SpywareLocked 3.4\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.4]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked 3.4"=-

Muutokset v2.166 - v2.167

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brave-Sentry]
[-HKEY_CURRENT_USER\Software\Brave-Sentry]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Brave-Sentry"=-
%SYSTEM%\ygjun.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"

Muutokset v2.165 - v2.166

%PROGRAMFILES%\MovieBox\
%STARTMENU%\Programs\MovieBox\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MovieBox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MovieBox] (C:\Program Files\MovieBox\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\MovieBox]

Muutokset v2.164 - v2.165

%SYSTEM%\pkgvyg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0ded443-5e68-4001-a81b-0a0001621ab8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b0ded443-5e68-4001-a81b-0a0001621ab8}"="excreted"

Muutokset v2.162 - v2.164

%WINDOWS%\iesettings.dll
%WINDOWS%\iesupport.dll
%WINDOWS%\iedebug.dll
%WINDOWS%\main_uninstaller.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F90B57B-3F17-4D9B-8909-1A32AFD6EC0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF0D1E98-4FAF-44BD-8ECA-E745820E63DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"iesupport"=-
"iedebug"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{234FF2FC-BB16-4A7C-AC09-A833CB3D56FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27CF2E73-9839-404B-85A8-8FB7EE27474C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F86727C-57A3-410E-AB91-176730DAEB45}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B5D099E3-B033-4DB3-A7A6-465859B7A477}]
%SYSTEM%\qzviz.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd0fc212-0a36-4232-83cc-2063fb9282e0}"="curdler"
Spy-Locked.exe
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.3.lnk
%STARTMENU%\SpywareLocked 3.3.lnk
%STARTMENU%\Programs\SpywareLocked 3.3\
%DESKTOP%\SpywareLocked 3.3.lnk
%PROGRAMFILES%\SpywareLocked 3.3\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0118155F-254E-4899-B4B0-C12A7D27BD43}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0F4C207D-8105-4A69-9597-CA35DD7D40E0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1767B8C0-D7CA-4714-B50E-E10883B49423}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{222B2001-A14D-40AB-A97A-866C31E64B6C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38CD31E1-73C2-48C0-B0DF-80BD6BA93F40}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5799265E-3E51-4B72-8420-75A71EE94E26}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{866B2BD1-5F33-4472-80E5-3216A92373E8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9894863A-C28A-4D01-B3C5-E6222A789AFE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2266AD8-EAA6-4934-98E3-34CF67E08374}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC25B50A-E1AE-4345-BB9B-0778DF760BE1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C108A1D9-28AD-40E5-B257-ED9062A14244}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CED85FB9-B4C0-4CFC-A7BE-2C73BAE15D51}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7473324-9D79-45B6-AD7F-333EF7D1A64B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D753CDA9-396B-415B-8379-AAF5902814DA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F33B0E47-DB00-4DF3-B930-A3C558D58B33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FBC8307B-4BD0-46F1-8350-122585D75DB2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE68E48B-1A55-49D7-BF9F-A8DFDA47A91F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Spy-Locked.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.3] (C:\Program Files\SpywareLocked 3.3\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked 3.3"=-

Muutokset v2.161 - v2.162

Added: DNS IP to detect: (69.50.x.x, 195.95.x.x)

Muutokset v2.159 - v2.161

Added: Check for DNS Hijack and configure to DHCP
%SYSTEM%\yronl.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1cb82d6d-f9a3-40c4-8ad5-6d7ea00ed6ad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1cb82d6d-f9a3-40c4-8ad5-6d7ea00ed6ad}"="haefner"

Muutokset v2.158 - v2.159

Added: HostsChk.exe (filter for WhiteList hosts)
%SYSTEM%\oyopu.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4}\InProcServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4}"="homina"

Muutokset v2.157 - v2.158

Update: Generic Renos Fix 1.11
%SYSTEM%\qvjpt.dll
[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{07a582e8-bae3-457d-9d29-2048de45a369}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{07a582e8-bae3-457d-9d29-2048de45a369}"="grithbreach"

Muutokset v2.156 - v2.157

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.2.lnk
%STARTMENU%\SpywareLocked 3.2.lnk
%STARTMENU%\Programs\SpywareLocked\
%DESKTOP%\SpywareLocked.lnk
%PROGRAMFILES%\SpywareLocked\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15A6894B-53B5-46C0-8C38-050E21DDD201}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17468406-36B6-4BD1-9B6C-3CC320CF28F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F3FF99D-E078-4968-B9C1-87A74C7736CB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34A0B812-915E-46F2-9F29-DF0F0CF97611}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46018FD4-1675-4020-85DC-A3A0EEB7BDA0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54F04ACA-CC8C-4C70-A8BC-D5C53D381EE7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{655C070F-6724-45BC-BD5E-23609B6D4A3F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78C9E0DA-3BB5-4156-A03C-8326322F10DD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F21289A-BB27-49E9-92C3-2BF7910B6072}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88C13519-616E-4A0D-B9EF-441D04891B6F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94E13FCA-4BAC-4C2A-A5DF-746460090F9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CEBEA6DB-DAE7-4146-BABA-1FBCD1D50426}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D152938D-32E1-43A6-81C7-898502AABF9A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD348AC9-1D04-439A-B451-9A83BD66423B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB2FC31-CCC1-4D85-869F-D288E2386DBD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9A34E6B-4C2A-4F58-B302-79CACCD62C5A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0181CF2-4A15-4CB5-88D7-15EAA2D08A46}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLocked.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked] (C:\Program Files\SpywareLocked\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareLocked"=-

Muutokset v2.155 - v2.156

Added: Process List
Added to Process Killed: isamntr.exe, pmmnt.exe, pmsnrr.exe
%SYSTEM%\AntiSpy.exe
%SYSTEM%\Spykiller.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"value"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"value"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"value"=-
%SYSTEM%\tahxqcj.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d6fac42-a7be-4702-87ef-75d8dc14249e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9d6fac42-a7be-4702-87ef-75d8dc14249e}"="hemine"

Muutokset v2.154 - v2.155

%SYSTEM%\bhoSearchSpy.dll
O2 - BHO: IE SecPlugin - {F5BDC469-1EC5-4193-824B-2E209993D183} - C:\WINDOWS\system32\bhoSearchSpy.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5BDC469-1EC5-4193-824B-2E209993D183}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bhoSearchSpy.IESecPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5BDC469-1EC5-4193-824B-2E209993D183}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE SecPlugin_is1]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwaresWipeds 5.3.lnk
%STARTMENU%\MalwaresWipeds 5.3.lnk
%STARTMENU%\Programs\MalwaresWipeds\
%DESKTOP%\MalwaresWipeds.lnk
%PROGRAMFILES%\MalwaresWipeds\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DDBC9CF-30B8-8733-7445-754FC2F405F2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07F8DED2-2140-400E-86F3-6C6E5AD2B002}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23BFD4B1-C4EA-453A-89BD-EC9D536891B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D5B03F2-3D12-4BC2-8A89-8D40AFE15190}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E699B22-FC07-4A9B-B98C-E9B965BFFE7C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{32C42863-E65F-453C-A8FF-60A8F035F57D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{350C54AD-E069-454C-A613-CA8154149E7A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{404A6E3F-1747-4D1B-8285-2C4B8A4B21D4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{776E27AE-419C-4529-9B18-4E71A5EA64A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BC72975-C801-4534-B103-476EF5D0D17D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BF1461E-228F-4509-8C58-4EB1FBFC19F3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ECD20CF-AF6D-40E1-A1B8-7B6BEABB793E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC158F0C-319D-42A9-8532-134D746D136D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF1A0A91-ABFB-4717-B7B9-D88647EA2529}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C492F812-B194-4C72-81EF-B17D9D973777}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D57FD11F-52DA-42F6-B12E-2447593B402B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1B13777-B021-41E1-BFE6-896E5C1CF163}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A366DE26-3628-46F9-9ABA-0BD450247999}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwaresWipeds.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwaresWipeds] (C:\Program Files\MalwaresWipeds\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwaresWipeds]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwaresWipeds"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyHeals 2.3.lnk
%STARTMENU%\SpyHeals 2.3.lnk
%STARTMENU%\Programs\SpyHeals\
%DESKTOP%\SpyHeals.lnk
%PROGRAMFILES%\SpyHeals\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{161D399B-0789-4402-864E-F4347690BD48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyHeals.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHeals] (C:\Program Files\SpyHeals\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyHeals]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyHeals"=-

Muutokset v2.151 - v2.152

%STARTMENU%\Programs\MovieCommander\
%PROGRAMFILES%\MovieCommander\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MovieCommander]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MovieCommander] (C:\Program Files\MovieCommander\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\MovieCommander]
%STARTMENU%\Programs\SiteEntry\
%PROGRAMFILES%\SiteEntry\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SiteEntry]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SiteEntry] (C:\Program Files\SiteEntry\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\SiteEntry]
%SYSTEM%\mshlpp.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-wordapp]
%STARTMENU%\Programs\PrivateVideo\
%PROGRAMFILES%\PrivateVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PrivateVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PrivateVideo] (C:\Program Files\PrivateVideo\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\PrivateVideo]

Muutokset v2.150 - v2.151

%WINDOWS%\iexplorer.exe
%WINDOWS%\ielocales.dll
%WINDOWS%\policies.dll
%WINDOWS%\policyverifier.exe
%SYSTEM%\policies\
%SYSTEM%\policies\ppdriver.sys (ppdriver service)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"PolicyVerifier"=-
O2 - BHO: SmartPics Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\Policies.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}]
O2 - BHO: TMSN Class - {B72549CE-5644-4116-B8A4-A2B042321EC4} - C:\WINDOWS\Policies.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B72549CE-5644-4116-B8A4-A2B042321EC4}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B72549CE-5644-4116-B8A4-A2B042321EC4}]
O2 - BHO: TKTS System - {A717DBE3-D78D-4aa7-BDCF-2CC06B36371B} - C:\WINDOWS\Policies.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}]
O2 - BHO: VPNS System - {366B2151-E1C7-44a3-86A3-E5686C2A3D2F} - C:\WINDOWS\iedrives.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}]
O2 - BHO: MSNM System - {A646CE7E-951E-44d1-B93C-F7136DA41E58} - C:\WINDOWS\ielocales.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A646CE7E-951E-44d1-B93C-F7136DA41E58}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A646CE7E-951E-44d1-B93C-F7136DA41E58}]
%SYSTEM%\onwtj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}"="chitosan"
%SYSTEM%\fyxkaah.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b292ec9f-a074-4115-8342-1f459702d8d2}"="characterizing"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.1.lnk
%STARTMENU%\SpyLocked 3.1.lnk
%STARTMENU%\Programs\SpyLocked\
%DESKTOP%\SpyLocked.lnk
%PROGRAMFILES%\SpyLocked\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C5B5226-045D-4A46-B4FC-228B0891FEEC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{314120E4-5A05-492C-9BF2-22558CF0F202}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{392D4A36-6ADF-4A99-A820-3014A53E62E3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3BF6C840-4D12-4FB5-88A2-E2BC03461DC2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{42F16135-D0A4-43A2-990C-27FCABD9C19F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43DF1CEE-70B3-4E2D-A740-4AC468786207}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D31CCA1-C42B-4796-851F-CA8ED4CD2A7E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5CA1A9F6-10F8-4008-B884-755B25B6848A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{630CBF61-54CC-4AC3-97B0-D4071345807C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AFB5B8E-ACFD-4489-91B3-DAA1388A31EC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{815B01A0-BF97-41E9-ACF2-32B76F98A960}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5BF4465-5322-462F-B41F-459F649F3996}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4703CF2-7F82-4AD7-B317-8EC1CBC9B619}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9817993-83FF-4343-B14E-6CDFB378B21D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EDE2A2B4-B1CB-4BF8-93D1-154E49284A71}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5D23930-23C6-440E-AB55-D019E1171539}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{50450F27-B90B-422B-A4C9-5EC5A5B78001}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked] (C:\Program Files\SpyLocked\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyLocked"=-
%SYSTEM%\wincrt.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Critical Alert"=-

Muutokset v2.149 - v2.150

%SYSTEM%\msdrives\
%SYSTEM%\msdrives\driverpp.sys (driverpp service)
%WINDOWS%\iedrives.dll
%WINDOWS%\msdrv.exe
%WINDOWS%\msdrvctrl.exe
%PROGRAMFILES%\NewMediaCodec
%SYSTEM%\drives\
%SYSTEM%\drives\pnpdrv.sys (pnpdrv service)
%WINDOWS%\iedrv.exe
%WINDOWS%\iedrvctrl.exe
%WINDOWS%\iexploree.dll
%WINDOWS%\mslog.exe
%DESKTOP%\PrivacyProtector.url
%DESKTOP%\SystemDoctor.url
%DESKTOP%\WinAntiSpyware 2007.url
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5845A98-EBDA-4670-9DE6-5201C506E741}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5845A98-EBDA-4670-9DE6-5201C506E741}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"iedrvctrl"=-
"ielogger"=-
"IExplorer"=-
"msdrvctrl"=-

Muutokset v2.147 - v2.148

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoAXObject.Chl]
O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}]

Muutokset v2.145 - v2.147

%SYSTEM%\geplxss.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aed6f6a3-183c-488d-9f90-23db99f56e7f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aed6f6a3-183c-488d-9f90-23db99f56e7f}"="apathies"
%SYSTEM%\tvomnc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{634be415-da12-496b-b89e-329b73c4807f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{634be415-da12-496b-b89e-329b73c4807f}"="cam"

Muutokset v2.144 - v2.145

%SYSTEM%\tcpipmon.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tcpipmon"=-

Muutokset v2.143 - v2.144

%PROGRAMFILES%\Internet Security
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"user32.dll"=-
"rare"=-

Muutokset v2.142 - v2.143

%PROGRAMFILES%\Video Access ActiveX Object
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videoaccessactivex.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Access ActiveX Object] (C:\Program Files\Video Access ActiveX Object\uninst.exe)
%SYSTEM%\higehsg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2016a466-91a2-43c6-97d8-2fd380f065ef}"="eitheror"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eitheror"="{2016a466-91a2-43c6-97d8-2fd380f065ef}"
%SYSTEM%\xkrdk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8329660f-e248-4872-98cc-fb9c4fec7ba8}"="didynamia"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"didynamia"="{8329660f-e248-4872-98cc-fb9c4fec7ba8}"

Muutokset v2.141 - v2.142

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyDawn 3.1.lnk
%STARTMENU%\SpyDawn 3.1.lnk
%STARTMENU%\Programs\SpyDawn\
%DESKTOP%\SpyDawn.lnk
%PROGRAMFILES%\SpyDawn\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1DF2728-8510-0773-96D8-5D0C1F27821B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyDawn.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyDawn] (C:\Program Files\SpyDawn\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyDawn]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyDawn"=-

Muutokset v2.140 - v2.141

%SYSTEM%\svshost.dll (Backdoor.Win32.Small.ls)
%SYSTEM%\wininet.exe (Backdoor.Win32.Small.ls)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SysRun"=-
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyCrush 5.1.lnk
%STARTMENU%\SpyCrush 5.1.lnk
%STARTMENU%\Programs\SpyCrush\
%DESKTOP%\SpyCrush.lnk
%PROGRAMFILES%\SpyCrush\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}] (Already removed with SpywareQuake)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyCrush.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush] (C:\Program Files\SpyCrush\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyCrush"=-

Muutokset v2.139 - v2.140

Update: remove from hosts file computing.net, spywareinfo.com,
lavasoftsupport.com, majorgeeks.com, microsoft.com, pandasoftware.com,
wilderssecurity.com
Add: Update mirror
%WINDOWS%\dr.exe
%WINDOWS%\user32.exe
%WINDOWS%\Tasks\At1.job
%WINDOWS%\Tasks\At2.job
%PROGRAMFILES%\dr.exe
%PROGRAMFILES%\dr.exe~
%PROGRAMFILES%\patcher.exe
%PROGRAMFILES%\serial.dat
%PROGRAMFILES%\serial.zip
%PROGRAMFILES%\user32.exe
%PROGRAMFILES%\widupdate.exe
%PROGRAMFILES%\widupdate.exe~

Muutokset v2.138 - v2.139

Update: remove following servers from hosts file:
arovax.com, bleepingcomputer.com, boskak.za.net, bullguard.com, castlecops.com,
compu-docs.com, dell.com, depannetonpc.net, digitaltrends.com, ewido.net,
geekstogo.com, greyknight17.com, idg.pl, infos-du-net.com, innovative-sol.com,
lockergnome.com, mytechsupport.ca, prevx.com, siri.urz.free.fr, spybot.info,
stevengould.org, sunbelt-software.com, spywareinfo.dk, superantispyware.com, techguy.org,
techsupportforum.com, tomcoyote.org
%SYSTEM%\cwgppb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2acf3add-34a1-4f2f-99cf-cc69785d1e90}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2acf3add-34a1-4f2f-99cf-cc69785d1e90}"="exemplars"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"exemplars"="{2acf3add-34a1-4f2f-99cf-cc69785d1e90}"

Muutokset v2.137 - v2.138

Update: Generic Renos Fix
%SYSTEM%\vblhanf.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}"="didymiums"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"didymiums"="{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVermeans 2.1.lnk
%STARTMENU%\AntiVermeans 2.1.lnk
%STARTMENU%\Programs\AntiVermeans\
%DESKTOP%\AntiVermeans.lnk
%PROGRAMFILES%\AntiVermeans\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82C9202F-07E7-C95D-0A61-7FCBB3DC4E2A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E109276-830E-4543-980D-660F305D052C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21E5890D-B0C0-43FC-9FFA-971E53757CEC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A7C0BB3-BAB7-4203-BF09-AE0F7187A76B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{349FB887-0A21-47FF-95AD-F311B68E1B0C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73F1B1C8-D0FF-466A-91C0-2995ECE1D7E7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{796854B1-D0B2-471A-9047-9FAABA829DDD}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7B519915-0E5C-429B-AF50-2B1FD12A80C7}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82B8F5FA-8541-4E3E-BB71-9237B638E51C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91251C12-212A-4847-AB34-6C0DE694F83D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92F553B0-3499-4E89-A25D-AB0865DD8A69}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0305F7E-4BEF-49AB-9FC1-3CD0964FEE9E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A426E333-4E91-4995-9662-E709BBDAA549}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6CA4EAC-3168-4F1B-B8CF-84765E1781C8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C24E6ABD-2409-478E-91C2-9AFF9817C10A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E20C255D-E938-49DB-89BA-1A1B27ABDCF3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3A2FFC7-5B66-4150-AA51-5D4CED1E73EB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9A4EC679-4D9A-4165-8562-9584E13A9CEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVermeans.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVermeans] (C:\Program Files\AntiVermeans\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVermeans]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVermeans"=-

Muutokset v2.136 - v2.137

Bug correction in huy32 service detection
%STARTMENU%\Programs\SpyMarshal\
%DESKTOP%\SpyMarshal.lnk
%PROGRAMFILES%\SpyMarshal\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyMarshal] (C:\Program Files\SpyMarshal\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\Install] (Already removed)
[-HKEY_CURRENT_USER\Software\SpyMarshal]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpyMarshal"=-

Muutokset v2.135 - v2.136

Added: huy32 driver detection.
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWipePro 4.3.lnk
%STARTMENU%\MalwareWipePro 4.3.lnk
%STARTMENU%\Programs\MalwareWipePro\
%DESKTOP%\MalwareWipePro.lnk
%PROGRAMFILES%\MalwareWipePro\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DFD0A51-6176-5770-217C-A5BCD7E6F3E2}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{01AEC716-82E6-4D7D-AAE9-E7A3C77669FC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{158CB0F8-4E71-483B-8A1F-E5F6A2925186}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43B4B286-7D63-49BF-925C-76DB02FB913C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E308A8E-090D-41D4-9566-0CF5DBCE77BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B457C20-B311-47D6-8462-2A58D14444F3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6570C315-8FE3-4C92-8772-B2EE963CE446}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D4714BE-DA43-41F5-BCF3-5AEF3C95EC42}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86861886-7780-4650-BFED-60E07AE63ED3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94C6F9C7-CDE7-4E81-A5B0-8245E3001B23}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E0A6A56-E495-41B1-A72C-DDBFF7B1147D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A62C8043-EDE3-45B8-8477-FD77CB8746C6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD9BDAB2-76A9-400C-8F4D-F12733D33526}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C8296F61-C691-498E-A509-C1C0C1A879A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCBF4AEA-E9E3-4D8A-9F51-7D20C4415C2C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D65BDB94-8AE3-4509-B0CA-2AC8A3B758EE}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC780A3C-EE81-47B9-97F0-4886EE215105}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E6CD430B-4CDF-4D5E-9071-16085471B882}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWipePro.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWipePro] (C:\Program Files\MalwareWipePro\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWipePro]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWipePro"=-
%STARTMENU%\Programs\VideoBox\
%PROGRAMFILES%\VideoBox\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoBox]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoBox] (C:\Program Files\VideoBox\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\VideoBox]
%PROGRAMFILES%\WinAntiSpyPro\
mstss.exe
plugin.exe
updchk.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mstss"="C:\Program Files\WinAntiSpyPro\mstss.exe"
[-HKEY_CURRENT_USER\Software\WinRAR SFX]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpySoldier.lnk
%USERPROFILE%\Local Settings\Application Data\SpySoldier\
%ALLUSERSTARTMENU%\Programs\SpySoldier\
%DESKTOP%\SpySoldier.lnk
%PROGRAMFILES%\SpySoldier\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpySoldier_is1] (C:\Program Files\SpySoldier\unins000.exe)
[-HKEY_CURRENT_USER\Software\SpySoldier]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareKnight.lnk
%USERPROFILE%\Local Settings\Application Data\SpywareKnight\
%ALLUSERSTARTMENU%\Programs\SpywareKnight\
%DESKTOP%\SpywareKnight.lnk
%PROGRAMFILES%\SpywareKnight\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareKnight_is1] (C:\Program Files\SpywareKnight\unins000.exe)
[-HKEY_CURRENT_USER\Software\SpywareKnight]
%STARTMENU%\Programs\PestCapture\
%DESKTOP%\PestCapture.lnk
%PROGRAMFILES%\PestCapture\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PestCapture] (C:\Program Files\PestCapture\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\Install]
[-HKEY_CURRENT_USER\Software\PestCapture]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PestCapture"=-
O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Video ActiveX Object\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{84938242-5C5B-4A55-B6B9-A1507543B418}"=-

Muutokset v2.134 - v2.135

Update: Detection of new version of the CTDrive key and drv???.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctpmon"=-

Muutokset v2.133 - v2.134

%SYSTEM%\ctpmon.exe
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Svshostt.arty]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctpmon"=-
%SYSTEM%\RegistryCleanerSetup.exe
%DESKTOP%\Registry Cleaner.lnk
%STARTMENU%\Programs\Registry Cleaner\
%PROGRAMFILES%\RegistryCleaner\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegistryCleaner] (C:\Program Files\RegistryCleaner\uninstall.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\RegistryCleaner]

Muutokset v2.132 - v2.133

%SYSTEM%\gwquvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8d8c2387-7f80-4022-9be6-43630a969558}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"carbinyl"="{8d8c2387-7f80-4022-9be6-43630a969558}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8d8c2387-7f80-4022-9be6-43630a969558}"="carbinyl"
%SYSTEM%\axlet.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8670ee50-01f9-47da-ac1e-cf8549e9e521}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"eupeptic"="{8670ee50-01f9-47da-ac1e-cf8549e9e521}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8670ee50-01f9-47da-ac1e-cf8549e9e521}"="eupeptic"
%SYSTEM%\oksrqqu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c4f2cbc-f32d-4a03-9812-86f39379811b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"breadthes"="{5c4f2cbc-f32d-4a03-9812-86f39379811b}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5c4f2cbc-f32d-4a03-9812-86f39379811b}"="breadthes"
%SYSTEM%\nbbrhbd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hirtellous"="{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"="hirtellous"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVerminser 2.1.lnk
%STARTMENU%\AntiVerminser 2.1.lnk
%STARTMENU%\Programs\AntiVerminser\
%DESKTOP%\AntiVerminser.lnk
%PROGRAMFILES%\AntiVerminser\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01775F16-B10C-B483-63E3-AFCED5DCDEF2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{118601E4-0BC8-4B98-AAEC-723EBA43ED33}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15548C74-5C8B-4911-AE88-739DD473E2BA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{468164CC-476E-47D5-9269-278D0DB22A13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{478B7D17-F00A-4AB3-B802-46972CAB1AE9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FCD9AB0-0765-4117-A612-DB3B4FAC1EE3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D89BA32-C9F8-48CC-B22A-18C808DF6D83}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{698664FF-F50E-4BDC-B9C0-C00F96A64B84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89AE8B3E-3EE8-4068-8932-60CA9E6AC40B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{93362B42-9631-4BAE-92EF-7726E5DD747D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{999E9507-216C-4A7A-B103-57D3FF617E49}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A5A2382E-6EA1-40C9-9EEB-FCE758A7A3F1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C20782A3-B65D-41AB-8D04-BBE3122363C2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C54890B0-B9F8-4E58-9715-8C58B52A4D5D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D037BE5C-7E06-4D4D-8729-FD1EE7E59C89}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D108017B-1769-4BFB-8A4C-0E6202FDBD08}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DECC44F4-E972-4E5C-8F5F-238295C5ADD5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{823B335C-00DE-4886-BE7A-FBDC0F69294E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVerminser.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVerminser] (C:\Program Files\AntiVerminser\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVerminser]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVerminser"=-

Muutokset v2.131 - v2.132

%SYSTEM%\autosys.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AutoSys"=-
%FAVORITES%\Online Security Test.url
%STARTMENU%\Programs\SiteTicket\
%PROGRAMFILES%\SiteTicket\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SiteTicket]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SiteTicket] (C:\Program Files\SiteTicket\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\SiteTicket]
%STARTMENU%\Programs\DirectVideo\
%PROGRAMFILES%\DirectVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DirectVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectVideo] (C:\Program Files\DirectVideo\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\DirectVideo]
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiped 5.2.lnk
%STARTMENU%\MalwareWiped 5.2.lnk
%STARTMENU%\Programs\MalwareWiped\
%DESKTOP%\MalwareWiped.lnk
%PROGRAMFILES%\MalwareWiped\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{035C1836-0D78-DABC-F4A7-D5D0517EE1F9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B5398C2-D494-426C-A32B-4C27687ABE1B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{12BFCFD5-4661-430F-A6C9-75CBA2396880}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1B845818-D6E1-4B94-B3BE-65B184165B13}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22E02478-B924-4878-B671-6C620BAC5F46}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{314009BF-F3FC-4C90-82E0-2DE859FD1ED8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{363FFCD3-D837-4949-BB15-9FF91D8D3D6F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{434FB119-3862-46DD-A420-D8A1836549E5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{612CA5DF-DDBD-4BA3-BEB6-F879CB521AE0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D5247D5-609B-4C07-A04B-D8EAE34A2E10}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80361051-7283-4C4F-A774-7392FC2B1703}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8EB34398-737F-46DD-BC79-FFF8CDE2782A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1B5425B-9D99-4419-B3E6-24C0944EF382}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B74B7120-D7B8-4BF7-8CC0-8B49196E1642}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0EE9256-C6A0-491D-B28A-48807B5572BF}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2220318-770B-45C7-B2CF-66022CE7E073}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF42E571-31B5-4BF6-B80A-19B83F030DB0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B73CD73D-026D-43A5-97D4-D175A5DEC129}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiped.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiped] (C:\Program Files\MalwareWiped\uninst.exe)
[-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWiped]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MalwareWiped"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VAXObject.Chl]
%PROGRAMFILES%\Image ActiveX Object\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IAXObject.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image ActiveX Object] (C:\Program Files\Image ActiveX Object\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Key Generator\isaddon.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]
O3 - Toolbar: Safety Bar - {fbea0445-4c4a-4136-864a-c72a4a182a84} - C:\Program Files\Safety Bar\SafetyBar.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fbea0445-4c4a-4136-864a-c72a4a182a84}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{fbea0445-4c4a-4136-864a-c72a4a182a84}"=-
O3 - Toolbar: Safety Bar - {18668683-731c-48fa-b1b9-ad013748fb00} - C:\Program Files\Safety Bar\SafetyBar.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18668683-731c-48fa-b1b9-ad013748fb00}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{18668683-731c-48fa-b1b9-ad013748fb00}"=-
O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\VideoKeyCodec\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}"=-
%SYSTEM%\cthkpcv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"buprestidae"="{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"
%SYSTEM%\ownyhr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a4b860b-b18e-4afe-9b26-2a19268eb6be}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cecropia"="{9a4b860b-b18e-4afe-9b26-2a19268eb6be}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9a4b860b-b18e-4afe-9b26-2a19268eb6be}"="cecropia"
%SYSTEM%\vwfps.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{951a98d0-dad6-4a77-8280-a494279a884b}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{951a98d0-dad6-4a77-8280-a494279a884b}"="beeper"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"beeper"="{951a98d0-dad6-4a77-8280-a494279a884b}"

Muutokset v2.130 - v2.131

Update: Generic Renos Fix 1.10
%SYSTEM%\cvnzie.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe288882-f661-4522-88f3-20cfb7866fa4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fe288882-f661-4522-88f3-20cfb7866fa4}"="gutturalness"
%SYSTEM%\hjpprpu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}"="haematobia"
%SYSTEM%\kuhmk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}"="discriminable"
AntiVermins changes:
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A1949AB-8B12-4A6F-9B5D-12D4115CCCEA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1724E437-1FCE-4D21-95E2-6E2452C25628}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1ECABCEE-5F00-449B-BBE3-9C35E160E832}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D652EC7-AF61-487A-B82A-0C4A6A9FF3C8}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{500B879D-86C3-4C45-943F-3FC3BF793B38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50FE5318-DC2A-440A-AC94-B9041819EE48}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59DAA331-B3F9-408E-81DF-ADE79D129600}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B768BE7-942B-4838-89BF-40AB729A62AB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C0B132E-86CB-4B3B-9CAF-CB7F57A60C81}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78E2412E-3C9A-4EE8-AD97-3ABD95EC49D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85524659-53E5-40AF-835B-2F0B8745DF0B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A9D1422-D311-4673-8579-61FCDB76BD0D}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6CDDF17-9F1A-47CA-8E3D-FF6BD1B05D3F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D6BD48FC-DD6F-4242-90B0-6CBE4AD43362}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7D22218-EBF0-454C-B948-11BB8FC3118B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ECA8F1E3-C03F-47E6-842D-7B2BCF0445CA}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B112EBD-0C90-4AC4-A969-F36797F00006}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiVermins"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus-Golden"=-

Muutokset v2.129 - v2.130

%SYSTEM%\olnohdw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}"="astral"

Muutokset v2.128 - v2.129

%SYSTEM%\qrzsyr.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01b55afa-f451-474b-9e91-c35b24d02641}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{01b55afa-f451-474b-9e91-c35b24d02641}"="boob"
%SYSTEM%\rosdzop.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb720bab-2f75-456b-a850-04d77b20f6b8}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bb720bab-2f75-456b-a850-04d77b20f6b8}"="impasse"
O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - C:\WINDOWS\system32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4d74aaa-a178-4463-846b-b4bc87a024e0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4d74aaa-a178-4463-846b-b4bc87a024e0}]
O3 - Toolbar: Protection Bar - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - C:\Program Files\Video ActiveX Object\iesplugin.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}"=-

Muutokset v2.127 - v2.128

SYSTEM%\vcehaeb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d635a36-6b3c-4146-8625-f3aaf507bbf8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"flammei"="{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"
%SYSTEM%\xqpauzx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2efa195-4785-4db1-9316-b48c64bb71da}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f2efa195-4785-4db1-9316-b48c64bb71da}"="blippers"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"blippers"="{f2efa195-4785-4db1-9316-b48c64bb71da}"
%SYSTEM%\mlraakb.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}"="gloomily"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gloomily"="{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}"

Muutokset v2.126 - v2.127

Now detect and remove: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kd???.exe"
O2 - BHO: (no name) - {1a1ddc19-5893-43ab-a73f-f41a0f34d115} - C:\Program Files\Video ActiveX Object\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
O2 - BHO: (no name) - {67270207-b9ee-4d26-9270-860fdb060ca1} - C:\WINDOWS\system32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67270207-b9ee-4d26-9270-860fdb060ca1}]

Muutokset v2.125 - v2.126

Export of: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kd???.exe"
%PROGRAMFILES%\Video ActiveX Object\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Object] (C:\Program Files\Video ActiveX Object\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\Video ActiveX Object\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Object] (C:\Program Files\Video ActiveX Object\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\Brain Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brain Codec] (C:\Program Files\Brain Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\Key Generator\
%DESKTOP%\Key Generator.lnk
%STARTMENU%\Programs\Key Generator\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Key Generator] (C:\Program Files\Key Generator\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\My Pass Generator\
%DESKTOP%\My Pass Generator.lnk
%STARTMENU%\Programs\My Pass Generator\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Pass Generator] (C:\Program Files\My Pass Generator\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\VideoAccess\
%STARTMENU%\Programs\VideoAccess\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoAccess]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoAccess] (C:\Program Files\VideoAccess\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\VideoAccess]
O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}-C:\WINDOWS\System32\ixt0.dll
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}]

Muutokset v2.124 - v2.125

%SYSTEM%\xxfgmy.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{588599f4-de26-4c28-ba14-f4eb17e33481}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{588599f4-de26-4c28-ba14-f4eb17e33481}"="emptins"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"emptins"="{588599f4-de26-4c28-ba14-f4eb17e33481}"
%SYSTEM%\dbqlrij.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{af4fd984-a939-4c32-82b2-8bae7abe9aec}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{af4fd984-a939-4c32-82b2-8bae7abe9aec}"="benumbment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"benumbment"="{af4fd984-a939-4c32-82b2-8bae7abe9aec}"
%SYSTEM%\tpedvf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a01a98c-4f25-42e1-971a-185cf63569b2}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1a01a98c-4f25-42e1-971a-185cf63569b2}"="expatriates"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"expatriates"="{1a01a98c-4f25-42e1-971a-185cf63569b2}"
%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Bursters 6.3.lnk
%STARTMENU%\Virus-Bursters 6.3.lnk
%STARTMENU%\Programs\Virus-Bursters\ (Already removed)
%DESKTOP%\Virus-Bursters.lnk (Already removed)
%PROGRAMFILES%\Virus-Bursters\ (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{150D28AC-7C2D-4B57-B837-C74DCE7CC728}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{276D86B8-010B-4576-8444-9A670070A3F4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D9CAF75-4B36-455B-ADEF-0CFD7ADF3154}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38CD62AA-98AC-4B47-9CB8-8E1F108AD32F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41F834DA-AF4B-4C04-BD2E-9FA131FF39E5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48CE44BF-E439-46DE-8CD8-88CB5B3D6D6E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F7FA7BF-007C-46E6-A49C-B8E7373C046E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F412259-081E-4B21-815D-93AE1E71AE95}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78EA0C93-1AAA-4922-84F0-42CBA685F6BC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{887D7071-FB68-49F6-A77C-E12D0A83BF91}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ECEF347-16E8-45B3-BB6D-AE9DDFC4EC11}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9EE20753-220C-4A2C-87DC-F86FB78F3774}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A4BB2045-C8B4-4A9F-B509-7A626797B961}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BED38B7D-66E0-47B2-A7EF-8682B62828D6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D87A739B-AD9A-4973-B8C5-9D55B3EC0401}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC6921C1-F723-49C9-B760-274DE8238ED6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C97C3B7C-E022-4FA8-B1A7-1C28270FFAFF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virus-bursters.exe] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Bursters] (C:\Program Files\Virus-Bursters\uninst.exe)
[HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Bursters] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Virus-Bursters"="C:\Program Files\Virus-Bursters\virus-bursters.exe /h"

Muutokset v2.123 - v2.124

O2 - BHO: (no name) - {ae18da4e-be15-4925-81bb-890c04af0200} - C:\Program Files\Gold Codec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae18da4e-be15-4925-81bb-890c04af0200}]
O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Programfiler\Perfect Codec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{74a49269-9779-48b4-a0e6-3a5af2a3ade6}"=-
O3 - Toolbar: Protection Bar - {96ebbe6a-2864-4345-b32b-26ee9be524b5} - C:\Program Files\Gold Codec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{96ebbe6a-2864-4345-b32b-26ee9be524b5}"=-
%PROGRAMFILES%\Gold Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gold Codec] (C:\Program Files\Gold Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\Silver Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Silver Codec] (C:\Program Files\Silver Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

Muutokset v2.122 - v2.123

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Bursters 6.2.lnk
%STARTMENU%\Virus-Bursters 6.2.lnk
%STARTMENU%\Programs\Virus-Bursters\
%DESKTOP%\Virus-Bursters.lnk
%PROGRAMFILES%\Virus-Bursters\
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}] (Already removed)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0249BEB1-A2AA-45A3-9EC5-95D9C4A40A62}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{082DA6AF-F994-4C6C-A2B0-DFC3B3FF540A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0C9A71B1-8A8A-48A1-AA3F-0C83CE1C0BBD}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EF25077-DA22-4FF2-B6FF-6FC1C26F5740}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{20DC1F8E-4640-4FFF-9858-05E7B978CC71}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2613CF74-4FC5-4251-9F48-260496364852}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27D8CD06-82E3-4E1E-8917-86A9B3AE41F6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CAEFBCD-55A9-4A68-AA02-E69B12B3BE57}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{898272CF-3ACE-4A7B-98FA-9EB8DB8B26DC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8CBF5BAC-E609-4863-ABC9-68A7BD13B1D0}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9981DDEF-81C4-4CC8-A5F2-62A7912D8037}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CB68DF7-F336-45A2-BDE2-5DCA3998986F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B4BB620F-3AE7-4910-8171-F9FC8120D9EF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D838D7A3-1551-4B32-BF7A-7F4F769BB885}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1751F23-00E6-4F6C-AD78-CA7D8A96FD3E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED639B1F-1B3F-473F-BD8D-6DE9C2D1972A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F83E8F99-AE49-45D6-92B4-59854BF0A759}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virus-bursters.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Bursters] (C:\Program Files\Virus-Bursters\uninst.exe)
[HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Bursters]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Virus-Bursters"="C:\Program Files\Virus-Bursters\virus-bursters.exe /h"
%SYSTEM%\dcvwaah.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40dcff6e-af8d-4183-8ebe-a82270ac449e]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{40dcff6e-af8d-4183-8ebe-a82270ac449e}"="gimmicks"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"gimmicks"="{40dcff6e-af8d-4183-8ebe-a82270ac449e}"
%SYSTEM%\fmrmhc.dll
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0bad5052-665d-40d4-a9bd-a2891eaafb42}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{0bad5052-665d-40d4-a9bd-a2891eaafb42}"="boucicault"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"boucicault"="{0bad5052-665d-40d4-a9bd-a2891eaafb42}"
%SYSTEM%\oebxpba.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fc003c3-87a0-489c-85cd-878246eb2d18}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4fc003c3-87a0-489c-85cd-878246eb2d18}"="amaranthaceous"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"amaranthaceous"="{4fc003c3-87a0-489c-85cd-878246eb2d18}"

Muutokset v2.121 - v2.122

%USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiper 4.3.lnk
%STARTMENU%\MalwareWiper 4.3.lnk
%STARTMENU%\Programs\MalwareWiper\
%DESKTOP%\MalwareWiper.lnk
%PROGRAMFILES%\MalwareWiper\
HKLM\SOFTWARE\Classes\AppID\MalwareWipe.EXE (Already removed)
HKLM\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5} (Already removed)
HKLM\SOFTWARE\Classes\CLSID\{1FC4ADE1-15D3-057E-81D5-DD934DE6542E}
HKLM\SOFTWARE\Classes\Interface\{04DA0CE8-87C6-4379-9CBD-5D6E93C919E8}
HKLM\SOFTWARE\Classes\Interface\{0678CAB9-7825-467E-9310-CDD2DCA855D0}
HKLM\SOFTWARE\Classes\Interface\{1386F568-F1AB-477D-B69E-31D66B6E4DAA}
HKLM\SOFTWARE\Classes\Interface\{210E3B48-776B-4F4B-B80A-2BB59F1A676D}
HKLM\SOFTWARE\Classes\Interface\{2E3C5BE8-3EA7-48A7-97FA-7E2AB0A88392}
HKLM\SOFTWARE\Classes\Interface\{576BB1E3-B26D-4BCB-A0BD-B49FF2469936}
HKLM\SOFTWARE\Classes\Interface\{5F8BD6DC-6D30-4A6F-9D07-3822DFA605D7}
HKLM\SOFTWARE\Classes\Interface\{694E0F65-5EF7-40FB-9412-48AFCE704720}
HKLM\SOFTWARE\Classes\Interface\{74878382-B258-484B-A614-475D8DCF104B}
HKLM\SOFTWARE\Classes\Interface\{7B8A51F7-0700-4CEB-978E-E0A3C88CB4B4}
HKLM\SOFTWARE\Classes\Interface\{87FF9647-1710-4EB6-97C9-65484F9C61E9}
HKLM\SOFTWARE\Classes\Interface\{A7358DCF-6343-45AE-930D-5C2BB96B9116}
HKLM\SOFTWARE\Classes\Interface\{B4BFACA9-37BA-45BC-8EE6-6F9910651B0B}
HKLM\SOFTWARE\Classes\Interface\{BE18EBF9-4F98-4333-8DD2-AEBA2911A80B}
HKLM\SOFTWARE\Classes\Interface\{DDC17036-3DE8-4FEB-948E-D225CF5BCC95}
HKLM\SOFTWARE\Classes\Interface\{E8194604-B6D1-4D63-ABC7-8C2D89E6D497}
HKLM\SOFTWARE\Classes\TypeLib\{96467F12-0518-4E85-AC6A-4858017F1400}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiper.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiper] (C:\Program Files\MalwareWiper\uninst.exe)
HKLM\SOFTWARE\MalwareWiper
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"MalwareWiper"=-
%PROGRAMFILES%\JPEG Encoder\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JPEGEncoder.Chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JPEG Encoder] (C:\Program Files\JPEG Encoder\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\Perfect Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Perfect Codec] (C:\Program Files\Perfect Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\Super Codec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Codec] (C:\Program Files\Super Codec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

Muutokset v2.120 - v2.121

Update: Bug correction in CTDrive Fix routine (causes a jump to the scan part while fixing)
O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\QualityCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
O2 - BHO: (no name) - {2810fba5-55ec-4bee-8263-0e2fa5883768} - C:\Program Files\QualityCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
O2 - BHO: (no name) - {4734044c-7427-43d8-adbe-df942e52bef2} - C:\Program Files\QualityCodec\isaddon.dll (file missing)
[-HKEY_CLASSES_ROOT\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4734044c-7427-43d8-adbe-df942e52bef2}]
O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Program Files\QualityCodec\iesplugin.dll
[-HKEY_CLASSES_ROOT\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf1ced2c-4b3f-4079-a330-864eda5a4cff}"=-
%SYSTEM%\jbtazy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"featherweed"="{ab340860-fd81-4a65-b345-82eb77a66b5e}"
%SYSTEM%\cfltygd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cussers"="{ff170564-36c8-43f7-9100-559e166405cf}"

Muutokset v2.119 - v2.120

%SYSTEM%\yosdjh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"anatolian"="{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"anatolian"="{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}"
O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - C:\WINDOWS\system32\ixt?.dll
[-HKEY_CLASSES_ROOT\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Program Files\iVideoCodec\isaddon.dll
O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Program Files\QualityCodec\isaddon.dll
[-HKEY_CLASSES_ROOT\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
%PROGRAMFILES%\QualityCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QualityCodec] (C:\Program Files\QualityCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%USERPROFILE%\StartMenu\Programs\FreeVideo\
%PROGRAMFILES%\FreeVideo\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeVideo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeVideo] (C:\Program Files\FreeVideo\Uninstall.exe)
[-HKEY_CURRENT_USER\Software\FreeVideo]
%PROGRAMFILES%\EliteCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EliteCodec] (C:\Program Files\EliteCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)

Muutokset v2.117 - v2.119

%PROGRAMFILES%\iVideoCodec\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iVideoCodec] (C:\Program Files\iVideoCodec\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
%PROGRAMFILES%\VidCodecs\
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VidCodecs] (C:\Program Files\VidCodecs\uninst.exe)
[-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
Update: Generic Renos Fix 1.9
%SYSTEM%\sacskza.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01d8d081-0f76-4ab5-b5e4-9b23a709670e}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"detachments"="{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"="detachments"
%SYSTEM%\impgsje.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"archenteric"="{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"="archenteric"
%SYSTEM%\okkmtv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bonspells"="{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"="bonspells"

<<Takaisin ohjelman lataussivulle

Suosittuja ohjelmia

Uusimmat ohjelmat

Lisää uusia ohjelmia

Suosittuja hakuja

cccleaner cc-cleaner u torrent media player vlc player movie maker unzip freeware pdf picasa word 2007 pakkaus video converter altair topfield adaware directx 11 winrar windows 7 avg free rekisteri korjaus virustentorjunta torrent

Lisää suosittuja hakuja..

Toimiiko ohjelma koneessani?

64-bit, 32-bit, Windows 10, Portable, Windows XP, Vista, ...

Menikö sormi suuhun lyhenteiden ja käsitteiden kanssa? Lue oppaamme ohjelmien yhteensopivuudesta

Muutoshistoria ohjelmalle SmitFraudFix

Suosittuja ohjelmia

Uusimmat ohjelmat

Suosittuja hakuja

Toimiiko ohjelma koneessani?

Avusta

Osiot:

Seuraa meitä: