*
 
download.fi - Löydä ja lataa ohjelmia

Muutoshistoria ohjelmalle SmitFraudFix

<<Takaisin ohjelman lataussivulle

Muutokset v2.422 - v2.423

  • [-HKEY_CURRENT_USER\Software\ColdWare]
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "WinProtect"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "winupdate.exe"=-
  • "ColdWare"=-
  • %SYSTEM%\AVR09.exe
  • %SYSTEM%\msa.exe



Muutokset v2.421 - v2.422

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B1D95A2-F547-4e5e-8902-622B08354622}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B1D95A2-F547-4e5e-8902-622B08354622}]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
  • %STARTMENU%\Advanced Virus Remover.lnk
  • %DESKTOP%\Advanced Virus Remover.lnk
  • %PROGRAMFILES%\AdvancedVirusRemover\
  • [-HKEY_CURRENT_USER\Software\AVR]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Advanced Virus Remover"=-



Muutokset v2.418 - v2.419

  • %DESKTOP%\XP Deluxe Protector.lnk
  • %STARTMENU%\XP Deluxe Protector.lnk
  • %USERPROFILE%\XP Deluxe Protector\
  • [-HKEY_CURRENT_USER\Software\XP Deluxe Protector]
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "xpprotect "=-



Muutokset v2.417 - v2.418

  • Update: WS2Fix v1.3
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\UnVirex.lnk
  • %ALLUSERSTARTMENU%\Programs\UnVirex\
  • %ALLUSERSTARTMENU%\Programs\UnVirex.lnk
  • %ALLUSERDESKTOP%\UnVirex.lnk
  • %PROGRAMFILES%\UnVirex\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEAddon.DLL]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C0E56Ac2-9F72-436E-B6E7-Aec28Af9E4Eb}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCB5551D-8594-4999-85F9-1E3EABCB95AC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B184B9D-B7BD-4FEA-8D1F-5E27182206A5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3ED0E410-5C8E-47B6-A75D-D10B886E903C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEAddon.StatusBarPane]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEAddon.StatusBarPane.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCB5551D-8594-4999-85F9-1E3EABCB95AC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UnVirex]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\UnVirex]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DRVFLTIP]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DrvFltIp]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DrvFltIp]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
  • "UnVirex"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "UnVirex"=-



Muutokset v2.416 - v2.417

  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Presto TuneUp"=-
  • %WINDOWS%\pp10.exe
  • %SYSTEM%\SYSDLL.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "SYSDLL"=-



Muutokset v2.414 - v2.416

  • O2 - BHO: (no name) - {3B7AAEB1-9F3D-4491-9C06-C7165CA8D058} - C:\Program Files\Applications\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B7AAEB1-9F3D-4491-9C06-C7165CA8D058}]
  • %SYSTEM%\SYS32DLL.exe
  • %PROGRAMFILES%\PCenter\
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "SYS32DLL"=-
  • "agent.exe"=-



Muutokset v2.413 - v2.414

  • %SYSTEM%\DL32.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "DL32"=-



Muutokset v2.411 - v2.412

  • %HOMEDRIVE%\asasa.exe
  • %HOMEDRIVE%\syst.exe
  • %PROGRAMFILES%\Microsoft Security Adviser\
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "msctrl.exe"=-
  • "msavsc.exe"=-
  • "msscan.exe"=-
  • "msiemon.exe"=-
  • "msfw.exe"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "msctrl.exe"=-
  • "msavsc.exe"=-
  • "msscan.exe"=-
  • "msiemon.exe"=-
  • "msfw.exe"=-
  • %ALLUSERS%\ApplicationData\Tally software LTD\
  • %STARTMENU%\Programs\Extra Antivirus\
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\Extra Antivirus 3.0]
  • [-HKEY_CURRENT_USER\Software\Tally software LTD]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Extra Antivirus"=-



Muutokset v2.409 - v2.411

  • %STARTMENU%\Programs\AV AntiSpyware\
  • %ALLUSERS%\ApplicationData\LastSun Ltd\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AV AntiSpyware 1.8]
  • [-HKEY_CURRENT_USER\Software\LastSun Ltd]
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AV AntiSpyware"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\load1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\browser helper objects\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}]
  • %SYSTEM%\ipv6monl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\WiniBlueSoft]
  • [-HKEY_CURRENT_USER\Software\WiniBlueSoft]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiniBlueSoft]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "WiniBlueSoft"=-
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "setup2.exe"=-
  • %SYSTEM%\setup2.exe
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\WiniBlueSoft.lnk
  • %ALLUSERSTARTMENU%\Programs\WiniBlueSoft\
  • %ALLUSERDESKTOP%\WiniBlueSoft.lnk
  • %PROGRAMFILES%\WiniBlueSoft Software\



Muutokset v2.408 - v2.409

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\homeantivirus2009.lnk
  • %STARTMENU%\Programs\homeantivirus2009\
  • %DESKTOP%\homeantivirus2009.lnk
  • %PROGRAMFILES%\homeantivirus2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HomeAntivirus2009]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "HomeAntivirus 2009"=-



Muutokset v2.407 - v2.408

  • %SYSTEM%\ahtn.htm
  • %SYSTEM%\warning.gif
  • %SYSTEM%\frmwrk32.exe
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Framework Windows"=-
  • %STARTMENU%\Programs\MS AntiSpyware 2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusXP]
  • [-HKEY_CURRENT_USER\Software\AntivirusXP]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "AntivirusXP.exe"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusXP.lnk
  • %DESKTOP%\AntivirusXP.lnk
  • %STARTMENU%\Programs\AntivirusXP\
  • %PROGRAMFILES%\AntivirusXP\



Muutokset v2.405 - v2.406

  • Added: Option 6, ProxyDisable.exe
  • %WINDOWS%\ld03.exe
  • %WINDOWS%\pp06.exe
  • %SYSTEM%\winsource.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D263FA6D-84CC-48A8-9AF6-C664362B7A5B}]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\TSC.lnk
  • %DESKTOP%\TSC.lnk
  • %STARTMENU%\Programs\TSC\
  • %PROGRAMFILES%\TSC\
  • %SYSTEM%\userload.exe
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  • "restor"=-



Muutokset v2.404 - v2.405

  • %WINDIR%\ieocx.dll
  • [-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEocxApp.IEocx]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEocxApp.IEocx.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A54DC52D-7AAD-4D40-A126-337211631EDC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}]
  • %DESKTOP%\WinPC Defender.lnk
  • %STARTMENU%\WinPC Defender.lnk
  • [-HKEY_CURRENT_USER\Software\WinPC Defender]
  • %SYSTEM%\rs32net.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "rs32net"=-
  • %HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  • "rs32net"=-
  • [-HKEY_CURRENT_USER\Software\renus2008]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "renus2008.exe"=-



Muutokset v2.403 - v2.404

  • %USERPROFILE%\Application Data\sysrc32.exe
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Win32load"=-



Muutokset v2.402 - v2.403

  • %ProgramFiles%\AntiSpyware Pro
  • %PROGRAMFILES%\RegistryFox\
  • %ALLUSERDESKTOP%\RegistryFox.lnk
  • %USERPROFILE%\Application Data\RegistryFox\
  • %ALLUSERSTARTMENU%\Programmes\RegistryFox\
  • [-HKEY_CURRENT_USER\SOFTWARE\RegistryFox]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\6B4F6929EB6FE0E458263EBA6AF2EB30]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\6B4F6929EB6FE0E458263EBA6AF2EB30]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\RegistryFox]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9296F4B6-F6BE-4E0E-8562-E3ABA62FBE03}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "RegistryFox"=-



Muutokset v2.401 - v2.402

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • "Shell"="Explorer.exe svchostw.exe"
  • %SYSTEM%\svchostw.exe



Muutokset v2.400 - v2.401

  • %WINDOWS%\ld01.exe
  • %WINDOWS%\ld02.exe
  • %WINDOWS%\pp2.exe
  • %SYSTEM%\dll32.exe
  • %SYSTEM%\dll32.dll
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "dll"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "sysldtray"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "pp"=-
  • %STARTMENU%\Programs\Malware Defender 2009\
  • %DESKTOP%\Malware Defender 2009.lnk
  • %PROGRAMFILES%\Malware Defender 2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Defender 2009]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defender 2009]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "malwaredef"=-
  • %STARTMENU%\Programs\System Guard 2009\
  • %DESKTOP%\System Guard 2009.lnk
  • %PROGRAMFILES%\System Guard 2009\
  • %ALLUSERSPROFILE%\Application Data\Microsoft\Network\DLLs\iemodule.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Guard 2009]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\System Guard 2009]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "systemguard"=-



Muutokset v2.399 - v2.400

  • %WINDOWS%\iehost32.dll
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "system tool"=-



Muutokset v2.398 - v2.399

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\GenericMultiMedia]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "WmpTray"=-
  • %PROGRAMFILES%\MediaSystem\



Muutokset v2.397 - v2.398

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Microsoft Internet Agent"=-
  • %SYSTEM%\winagent.exe
  • %PROGRAMFILES%\HDQuality\
  • %STARTMENU%\Programs\HDQuality\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HDQuality]
  • [-HKEY_CURRENT_USER\SOFTWARE\HDQuality]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDQuality]



Muutokset v2.395 - v2.396

  • %PROGRAMFILES%\CMVideoPlugin
  • %PROGRAMFILES%\SmitFraudFixTool\
  • %ALLUSERDESKTOP%\SmitFraudFixTool.lnk
  • %USERPROFILE%\\Application Data\SmitFraudFixTool\
  • %ALLUSERSTARTMENU%\Programs\SmitFraudFixTool\
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "SmitFraudFixTool"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10EE433D-A290-4811-B562-8A1878AEE706}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{10EE433D-A290-4811-B562-8A1878AEE706}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB63BB6D-4A8A-4E69-9F4B-E099C874A2AA}]
  • [-HKEY_CURRENT_USER\Software\SmitFraudFixTool]



Muutokset v2.394 - v2.395

  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "systeminit.exe"=-



Muutokset v2.393 - v2.394

  • %PROGRAMFILES%\freshplay\
  • %STARTMENU%\Programs\freshplay
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\freshplay]
  • [-HKEY_CURRENT_USER\SOFTWARE\freshplay]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\freshplay]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  • "NoFolderOptions"=-
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  • "NoFolderOptions"=-
  • %ALLUSERPROFILE%\Application Data\CrucialSoft Ltd\
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\uninstall\MS AntiSpyware 2009 5.7]
  • [-HKEY_CURRENT_USER\Software\CrucialSoft Ltd]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "MS AntiSpyware 2009"=-



Muutokset v2.392 - v2.393

  • %WINDOWS%\sysguard.exe
  • %SYSTEM%\iehelper.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}]
  • [-HKEY_CURRENT_USER\Software\AvScan]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "sysguard"=-



Muutokset v2.391 - v2.392

  • %SYSTEM%\winsystems.dll
  • %STARTMENU%\Programs\IE-Security.lnk
  • %DESKTOP%\IE-Security.lnk
  • %PROGRAMFILES%\IE-Security\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE-Security]
  • [-HKEY_CURRENT_USER\Software\IE-Security]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "IE-Security"=-
  • %STARTMENU%\XP Police Antivirus.lnk
  • %DESKTOP%\XP Police Antivirus.lnk
  • %PROGRAMFILES%\XPPoliceAntivirus\
  • [-HKEY_CURRENT_USER\Software\XP Police Antivirus]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "PoliceAV"=-



Muutokset v2.388 - v2.391

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CMVideo.DLL]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{36B94DC8-FA3B-45DF-8F6B-215A2A469BCC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D23EE44-2319-4B6C-93D2-A572E0F5B0E0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B87FA0EF-26D7-4B2A-B7EE-38C7271C4843}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2EB32B07-6A19-4D18-9A19-4DE49F18A1FB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{638E0063-BA00-487C-BAFF-423E356F52F6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AC4A66D0-BB91-45E5-BB00-E0F091F630B8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.CMVideoPlugin.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CMVideo.XMLDOMDocumentEventsSink.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D23EE44-2319-4B6C-93D2-A572E0F5B0E0}]
  • [-HKEY_CURRENT_USER\Software\CMVideoPlugin]
  • %SYSTEM%\CMVideo.dll
  • %PROGRAMFILES%\totalvid\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Alert Manager]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser Toolbar]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "msiexec.exe"=-



Muutokset v2.387 - v2.388

  • %STARTMENU%\Programs\videosoft\
  • %PROGRAMFILES%\videosoft\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videosoft]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videosoft]
  • [-HKEY_CURRENT_USER\Software\videosoft]
  • %PROGRAMFILES%\Total Protect 2009\
  • %ALLUSERPROFILE%\StartMenu\Programs\Total Protect 2009\
  • %ALLUSERPROFILE%\Desktop\Run Total Protect 2009.lnk
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\totalprotect]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\totalprotect]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Protect 2009]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Total Protect 2009"=-



Muutokset v2.386 - v2.387

  • %WINDIR%\fd.dll



Muutokset v2.385 - v2.386

  • Update: Hostschk 0.2 (10 lines max in log)



Muutokset v2.383 - v2.385

  • Added: Agent.OMZ.Fix.exe tool to remove Zlob hidden folder.
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 360.lnk
  • %STARTMENU%\Antivirus 360\
  • %DESKTOP%\Antivirus 360.lnk
  • %PROGRAMFILES%\A360\



Muutokset v2.382 - v2.383

  • %PROGRAMFILES%\vrl32software\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4E6615B5-A259-4e55-905F-7F9CE60B379D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{305043E5-F9D9-4B3A-A618-C4D0DA8031CE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{536CBA8A-9DB6-45CF-8D65-F486C49242D5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B3A0AA5C-9FA3-408D-8193-2A948EF51D2D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vrl32Warning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vrl32Warning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vrl32]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E6615B5-A259-4e55-905F-7F9CE60B379D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vrl32]
  • [-HKEY_CURRENT_USER\Software\vrl32]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\vrl32software\vrl32.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\vrl32software\vrl32.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "vrl32"=-



Muutokset v2.381 - v2.382

  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Smax4"=-
  • %USERPROFILE%\Application Data\Google\kjzna1562565.exe
  • %USERPROFILE%\Application Data\Google\spcffwl.dll



Muutokset v2.380 - v2.381

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
  • "QuickTime Task"=-
  • "VMware hptray"=-
  • %PROGRAMFILES%\avrlabs\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D695B871-8020-4041-A6D2-59F922E1B2E2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avrlabsWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\avrlabsWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\avrlabs]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D695B871-8020-4041-A6D2-59F922E1B2E2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\avrlabs]
  • [-HKEY_CURRENT_USER\Software\avrlabs]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\avrlabs\avrlabs.exe"=-
  • [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
  • "C:\Program Files\avrlabs\avrlabs.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "avrlabs"=-



Muutokset v2.379 - v2.380

  • %PROGRAMFILES%\WebMediaViewer\
  • O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
  • O3 - Toolbar: Browser Toolbar - {2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E} - C:\Program Files\WebMediaViewer\browseul.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3B8FB116-D358-48A3-A5C7-DB84F15CBB04}]
  • %PROGRAMFILES%\AnvTrgrsoftware\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C8B2A9C-24A0-4991-A74B-1E4931BD3A57}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BAE92F67-539C-41CD-9183-162BB40AAA0C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AnvTrgrWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AnvTrgrWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AnvTrgrsoft]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95E9BCC0-2E84-4500-8A9C-0B7A96769124}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnvTrgrsoft]
  • [-HKEY_CURRENT_USER\Software\AnvTrgrsoft]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\AnvTrgrsoftware\AnvTrgr.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\AnvTrgrsoftware\AnvTrgr.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "AnvTrgr"=-



Muutokset v2.376 - v2.378

  • %PROGRAMFILES%\WMVideoPlugin\
  • %SYSTEM%\mws31209.dll
  • %SYSTEM%\ws31209.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC3081A6-AC0C-331D-860E-AEF4790E6B5B}]
  • [-HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{C77BD12E-4A3C-33E3-858C-F2D04591C6B5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0BB62EE8-3528-39F7-9070-F9F0C09329D5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC3081A6-AC0C-331D-860E-AEF4790E6B5B}]
  • %PROGRAMFILES%\AvirTrsoftware\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3A267370-076E-4af4-B986-77626B8E89DF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764BC8B4-1159-4736-8AF1-F124A7C8C3A8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF3F06C6-D443-48A8-BDF2-4E31F0554EBF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3ED86073-2FA7-4CF4-810B-28B030671678}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvirTrWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvirTrWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvirTrsoft]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A267370-076E-4af4-B986-77626B8E89DF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AvirTrsoft]
  • [-HKEY_CURRENT_USER\Software\AvirTrsoft]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\AvirTrsoftware\AvirTr.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\AvirTrsoftware\AvirTr.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "AvirTr"=-



Muutokset v2.375 - v2.376

  • %PROGRAMFILES%\msvideoplugin\
  • %PROGRAMFILES%\homeview\
  • %STARTMENU%\Programs\homeview\
  • %SYSTEM%\mws55681.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6733C78-821F-3BBF-ADE6-3DB71CAD887A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6733C78-821F-3BBF-ADE6-3DB71CAD887A}]
  • %SYSTEM%\msiconf.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "msiexec.exe"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\antivirustrigger 2.1.lnk
  • %STARTMENU%\antivirustrigger 2.1.lnk
  • %STARTMENU%\Programs\antivirustrigger 2.1\
  • %DESKTOP%\antivirustrigger 2.1.lnk
  • %PROGRAMFILES%\virtrigger\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0088C75C-6361-4dfb-B2CF-576CACFA3C55}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22C447D3-73A8-E1C7-C391-21BE4338CEBC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirTriggerWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirTriggerWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirTrigger]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0088C75C-6361-4dfb-B2CF-576CACFA3C55}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirTrigger]
  • [-HKEY_CURRENT_USER\Software\VirTrigger]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirTrigger\VirTrigger.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirTrigger\VirTrigger.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "VirTrigger"=-



Muutokset v2.374 - v2.375

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusTrigger 2.1.lnk
  • %STARTMENU%\VirusTrigger 2.1.lnk
  • %STARTMENU%\Programs\VirusTriggerBin\
  • %DESKTOP%\VirusTrigger 2.1.lnk
  • %PROGRAMFILES%\VirusTriggerBin\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE8A3F7B-E4AB-5C41-4926-3FAED82759F5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirusTriggerBinWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirusTriggerBinWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusTriggerBin]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusTriggerBin]
  • [-HKEY_CURRENT_USER\Software\VirusTriggerBin]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirusTriggerBin\VirusTriggerBin.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "VirusTriggerBin"=-



Muutokset v2.373 - v2.374

  • %PROGRAMFILES%\Google\googletoolbar1.dll
  • %PROGRAMFILES%\Google\setupcom.dat
  • %PROGRAMFILES%\Google\setupext.dat
  • %SYSTEM%\crypts.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt]
  • O2 - BHO: (no name) - {8710DF42-3171-4A3B-9079-3F7D7101552B} - C:\Program Files\Applications\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8710DF42-3171-4A3B-9079-3F7D7101552B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8710DF42-3171-4A3B-9079-3F7D7101552B}]
  • O3 - Toolbar: Internet Service - {E43B6656-814B-4839-8FF8-AFFDE0DA9A3F} - C:\Program Files\Applications\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{E43B6656-814B-4839-8FF8-AFFDE0DA9A3F}"=-



Muutokset v2.372 - v2.373

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Guard 2008]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard]
  • [-HKEY_CURRENT_USER\Software\Spyware Guard]
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  • "spywareguard"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "OLESys"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "Explorer"=-
  • %USERSTARTMENU%\Programs\Spyware Guard 2008\
  • %PROGRAMFILES%\Spyware Guard 2008\
  • %allusersprofile%\Application Data\Microsoft\Internet Explorer\olesys.dll
  • %allusersprofile%\Application Data\Microsoft\Protect\conf.sys
  • %allusersprofile%\Application Data\Microsoft\Protect\ie.dll
  • %allusersprofile%\Application Data\Microsoft\Protect\svhost.exe
  • %allusersprofile%\Application Data\Microsoft\Protect\track.sys
  • %allusersprofile%\Application Data\winlogon.exe
  • %DESKTOP%\Spyware Guard 2008.lnk
  • %WINDOWS%\reged.exe
  • %WINDOWS%\spoolsystem.exe
  • %WINDOWS%\sys.com
  • %WINDOWS%\syscert.exe
  • %WINDOWS%\sysexplorer.exe
  • %WINDOWS%\vmreg.dll
  • %SYSTEM%\wsc32x.exe



Muutokset v2.371 - v2.372

  • Removed: AntiXPVSTFix tool



Muutokset v2.370 - v2.371

  • %USERSTARTMENU%\Programs\sexvid\
  • %PROGRAMFILES%\sexvid\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sexvid]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sexvid]
  • [-HKEY_CURRENT_USER\Software\sexvid]
  • %TEMP%\winlogon.exe
  • %SYSTEM%\msansspc.dll
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Firewall auto setup"=-



Muutokset v2.369 - v2.370

  • %userprofile%\Application Data\Google\sccmsk.dll
  • %userprofile%\Application Data\Google\mupd1_2_1711951.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "asus32"=-
  • %USERSTARTMENU%\Personal Defender 2009.lnk
  • %USERSTARTMENU%\Programs\Personal Defender 2009\
  • %PROGRAMFILES%\Personal Defender 2009\
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Personal Defender 2009"=-



Muutokset v2.367 - v2.368

  • %DESKTOP%\SMS TRAP.url
  • %FAVORITES%\SMS TRAP.url
  • %STARTMENU%\SMS TRAP.url
  • %SYSTEM%\p.ico
  • %DESKTOP%\AntiVirus Sentry.lnk
  • %PROGRAMFILES%\AVS\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVS]
  • [-HKEY_CURRENT_USER\Software\AVS]



Muutokset v2.366 - v2.367

  • %SYSTEM%\ntload.dll
  • %SYSTEM%\sex1.ico.tmp
  • %SYSTEM%\sex2.ico.tmp
  • %SYSTEM%\update32.exe.tmp
  • %SYSTEM%\winupdate.exe
  • %SYSTEM%\wscmp.dll.tmp
  • %DESKTOP%\Uncensored porn.url
  • %DESKTOP%\BDSM galleries.url
  • %SYSTEM%\winupdate.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  • "run"=-



Muutokset v2.365 - v2.366

  • %WINDIR%\woprdagt.exe
  • %PROGRAMFILES%\TS-2009



Muutokset v2.364 - v2.365

  • %USERPROFILE%\Application Data\spyprotector\
  • %USERPROFILE%\Application Data\install.exe
  • %USERPROFILE%\Application Data\shellex.dll
  • %USERPROFILE%\Application Data\srcss.exe
  • %ALLUSERSTARTMENU%\Programs\spy protector\
  • %DESKTOP%\spy protector.lnk
  • %PROGRAMFILES%\spy protector\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Spy Protector]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107A1D63-2EAA-4694-8ABA-EC209C630D83}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CBE202A6-3B75-4189-B161-9B4DF370BEE9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Spy Protector]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Spy Protector]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\shellex.TBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\srcss.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CBE202A6-3B75-4189-B161-9B4DF370BEE9}]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\SpyProtector]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Spy Protector"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
  • "{107A1D63-2EAA-4694-8ABA-EC209C630D83}"=-



Muutokset v2.361 - v2.363

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRemover2008]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRemover2008]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
  • [-HKEY_CURRENT_USER\Software\VirusRemover2008]
  • [-HKEY_CURRENT_USER\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusRemover2008"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\virusremover2008.lnk
  • %USERPROFILE%\Application Data\virusremover2008\
  • %STARTMENU%\Programs\virusremover2008\
  • %DESKTOP%\virusremover2008.lnk
  • %PROGRAMFILES%\virusremover2008\
  • %ALLUSERSTARTMENU%\Programs\PC Protection Center 2008\
  • %ALLUSERDESKTOP%\PC Protection Center 2008.lnk
  • %PROGRAMFILES%\PC Protection Center 2008\
  • %SYSTEM%\vbzlib2.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Protection Center 2008]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Antivirus Software]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "PC Protection Center"=-
  • %WINDOWS%\ieguard.dll
  • %WINDOWS%\sysguard\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D032570A-5F63-4812-A094-87D007C23012}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ieguard.TIEAdvBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sysguard]
  • [-HKEY_CURRENT_USER\Software\sysguard]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • "Shell"=-



Muutokset v2.360 - v2.361

  • %SYSTEM%\msxml71.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XML.XML]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XML.XML.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
  • [-HKEY_CURRENT_USER\Software\XML]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "MSFox"=-



Muutokset v2.359 - v2.360

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk (Already removed)
  • %STARTMENU%\VirusResponse Lab 2009 2.1.lnk (Already removed)
  • %STARTMENU%\Programs\VirusResponse Lab 2009 2.1\ (Already removed)
  • %DESKTOP%\VirusResponse Lab 2009 2.1.lnk (Already removed)
  • %PROGRAMFILES%\virrl2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirRLWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VirRLWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirRL2009]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirRL2009]
  • [-HKEY_CURRENT_USER\Software\VirRL2009]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirRL2009\VirRL2009.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirRL2009\VirRL2009.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "VirRL2009"=-



Muutokset v2.358 - v2.359

  • %WINDIR%\karna.dat
  • %SYSTEM%\brastk.exe
  • %SYSTEM%\karna.dat
  • O20 - AppInit_DLLs: C:\WINDOWS\System32\karna.dat
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "brastk"=-



Muutokset v2.357 - v2.358

  • %WINDIR%\karna.dat
  • %SYSTEM%\brastk.exe
  • %SYSTEM%\karna.dat
  • O20 - AppInit_DLLs: C:\WINDOWS\System32\karna.dat
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "brastk"=-



Muutokset v2.356 - v2.357

  • %STARTMENU%\Programs\av2010\
  • %DESKTOP%\av2010.lnk
  • %PROGRAMFILES%\av2010\
  • %SYSTEM%\IEDefender.dll
  • %SYSTEM%\wingamma.exe
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEDefender.DLL]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{3C40236D-990B-443C-90E8-B1C07BCD4A68}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC8A493F-D236-4653-9A03-2BF4FD94F643}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7BC7565C-5062-43CE-8797-DC2C271140A9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{705FD64B-2B7B-4856-9337-44CA1DA86849}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEDefender.IEDefenderBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEDefender.IEDefenderBHO.1]
  • [-HKEY_CURRENT_USER\Software\AV2010]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC8A493F-D236-4653-9A03-2BF4FD94F643}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Windows Gamma Display"=-



Muutokset v2.355 - v2.356

  • Update: VACFix definition



Muutokset v2.352 - v2.354

  • %SYSTEM%\fbxrqtwn.exe
  • %SYSTEM%\MicroAV.cpl
  • %DESKTOP%\Micro Antivirus 2009.lnk
  • %PROGRAMFILES%\MicroAV\
  • [-HKEY_CURRENT_USER\Software\AntiVirus]
  • [-HKEY_CURRENT_USER\Software\uav]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus"=-
  • %PROGRAMFILES%\uav\
  • %DESKTOP%\Ultimate Antivirus 2008.lnk
  • %SYSTEM%\uav.cpl



Muutokset v2.351 - v2.352

  • %SYSTEM%\users64.dat
  • %SYSTEM%\sysppu?.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\pr]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow]
  • "10"=-
  • "di"=-
  • "u1"=-
  • "lk1"=-



Muutokset v2.350 - v2.351

  • O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - C:\Program Files\Applications\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{144A6B24-0EBC-4D89-BF09-A06A718E57B5}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{144A6B24-0EBC-4D89-BF09-A06A718E57B5}"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusResponse Lab 2009 2.1.lnk
  • %STARTMENU%\VirusResponse Lab 2009 2.1.lnk
  • %STARTMENU%\Programs\VirusResponse Lab 2009 2.1\
  • %DESKTOP%\VirusResponse Lab 2009 2.1.lnk
  • %PROGRAMFILES%\VirusResponseLab2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusResponseLab2009]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusResponseLab2009]
  • [-HKEY_CURRENT_USER\Software\VirusResponseLab2009]
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirusResponseLab2009\VirusResponseLab2009.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\VirusResponseLab2009\VirusResponseLab2009.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "VirusResponseLab2009"=-



Muutokset v2.349 - v2.350

  • %SYSTEM%\algg.exe
  • O2 - BHO: (no name) - {CFEE97A3-4911-444D-8BE8-E243A23D3DE2} - C:\Program Files\Applications\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}]
  • O3 - Toolbar: Internet Service - {0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87} - C:\Program Files\Applications\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{0CF79C5F-22AB-4E2A-82A5-BC9F4F3D4F87}"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Lab 2009 2.1.lnk
  • %STARTMENU%\AntiVirus Lab 2009 2.1.lnk
  • %STARTMENU%\Programs\AntiVirus Lab 2009 2.1\
  • %DESKTOP%\AntiVirus Lab 2009 2.1.lnk
  • %PROGRAMFILES%\AntiVirusLab2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A9759D-210A-0253-D944-8B76AC2B0D92}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVLWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirusLab2009]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A21C8D81-A9C7-46c6-A488-2A32FA0DAEB6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirusLab2009]
  • [-HKEY_CURRENT_USER\Software\AntiVirusLab2009]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "AntiVirusLab2009"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\AntiVirusLab2009\AntiVirusLab2009.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\AntiVirusLab2009\AntiVirusLab2009.exe"=-



Muutokset v2.346 - v2.347

  • %SYSDIR%\c.ico
  • %STARTMENU%\VIP Casino.url
  • %FAVORITES%\VIP Casino.url
  • %DESKTOP%\VIP Casino.url
  • %WINDOWS%\mqgldfvo.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "\YUR1.exe"=-
  • "\YUR2.exe"=-
  • "\YUR3.exe"=-
  • "\YUR4.exe"=-
  • "\YUR5.exe"=-
  • "\YUR6.exe"=-
  • "\YUR7.exe"=-
  • "\YUR8.exe"=-
  • "\YURA.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "\YUR1.exe"=-
  • "\YUR2.exe"=-
  • "\YUR3.exe"=-
  • "\YUR4.exe"=-
  • "\YUR5.exe"=-
  • "\YUR6.exe"=-
  • "\YUR7.exe"=-
  • "\YUR8.exe"=-
  • "\YURA.exe"=-
  • %DESKTOP%\BEST ZOO PORN.url
  • %DESKTOP%\QUALITY PORN.url
  • %SYSTEM%\YUR*.exe



Muutokset v2.345 - v2.346

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Antivirus-2009.lnk
  • %USERPROFILE%\Start Menu\Programs\Smart Antivirus 2009\
  • %DESKTOP%\Smart Antivirus-2009.lnk
  • %PROGRAMFILES%\Smart Antivirus 2009\
  • [-HKEY_CURRENT_USER\Software\Smart Antivirus 2009]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Smart Antivirus-2009.exe"=-



Muutokset v2.344 - v2.345

  • %SYSTEM%\Cpl32ver.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Cpl32ver"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Somefox]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Somefox"=-
  • %DESKTOP%\System Antivirus 2008.lnk
  • %PROGRAMFILES%\sav\
  • [-HKEY_CURRENT_USER\Software\AntiVirus] (Already removed)
  • [-HKEY_CURRENT_USER\Software\SAV]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus"=- (Already removed)
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus"=- (Already removed)



Muutokset v2.343 - v2.344

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareExpert.lnk
  • %ALLUSERPROFILE%\Start Menu\Programs\AntiSpywareExpert\
  • %DESKTOP%\AntiSpywareExpert.lnk
  • %PROGRAMFILES%\AntiSpywareExpert\
  • [-HKEY_CURRENT_USER\Software\AntiSpywareExpert]
  • [-HKEY_CURRENT_USER\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiSpywareExpert"=-
  • %USERPROFILE%\Application Data\printer.exe
  • %USERPROFILE%\Application Data\temp.dll
  • %SYSTEM%\mcrupdate.exe
  • %SYSTEM%\npad.exe
  • %ProgramFiles%\altcmd\
  • O2 - BHO: BhoApp Class - {3EDBF8E9-3130-72C8-ED30-32A3DB08ED44} - C:\Program Files\altcmd\altcmd32.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EDBF8E9-3130-72C8-ED30-32A3DB08ED44}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3EDBF8E9-3130-72C8-ED30-32A3DB08ED44}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adczaznsersgfm1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\adczaznsersgfm=]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BhoApp Class]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare]



Muutokset v2.339 - v2.343

  • %ProgramFiles%\aspch\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1FAB6BD-4A34-47ce-82AF-50B16A6BE77E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ThreatWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ThreatWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\aspch]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E1FAB6BD-4A34-47ce-82AF-50B16A6BE77E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\aspch]
  • [HKEY_CURRENT_USER\Software\aspch]
  • [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\aspch\ASpCh.exe"=-
  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  • "C:\Program Files\aspch\ASpCh.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "aspch"=-
  • %DESKTOP%\Total Secure 2009.lnk
  • %USERPROFILE%\Start Menu\Programs\Total Secure 2009.lnk
  • %ProgramFiles%\TotalSecure2009\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Total Secure 2009]
  • [-HKEY_CURRENT_USER\Software\TotalSecure2009]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "TotalSecure2009"=-
  • %ProgramFiles%\Power-Antivirus-2009\
  • %USERPROFILE%\Application Data\Power-Antivirus-2009\
  • %USERPROFILE%\Start Menu\Programs\Power-Antivirus-2009\
  • %desktop%\Power-Antivirus-2009.lnk
  • [-HKEY_CURRENT_USER\Software\Power-Antivirus-2009]
  • %ProgramFiles%\RichVideoCodec\ (Already removed)
  • %SYSTEM%\RichVideoCodec.dll (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\CodecBHO.DLL]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{e12b39a5-df4a-4f04-a85b-4ecf048e359f}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a37b3779-e4f3-424c-a495-a60ea8063476}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b65c5ebd-0989-40b5-a2a0-84642539bf82}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E46194A9-C4B1-4C0F-A75E-E9C5BDED7874}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7309FD6-0FD0-459D-A5E8-27D7A23215F1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B648A7F7-DD8F-4535-AFAD-CE5BA0E8320E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a37b3779-e4f3-424c-a495-a60ea8063476}]
  • [-HKEY_CURRENT_USER\Software\RichVideoCodec] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "\VIE2.exe"=-
  • "\VIE3.exe"=-
  • "\VIE4.exe"=-
  • "\VIE5.exe"=-
  • "\VIEA.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "\VIE2.exe"=-
  • "\VIE3.exe"=-
  • "\VIE4.exe"=-
  • "\VIE5.exe"=-
  • "\VIEA.exe"=-
  • %DESKTOP%\EXTREME FUCK.url
  • %DESKTOP%\TITS AND ASS.url
  • %SYSTEM%\1.ico
  • %SYSTEM%\2.ico
  • %SYSTEM%\VIEA.exe
  • %SYSTEM%\VIE5.exe
  • %SYSTEM%\VIE4.exe
  • %SYSTEM%\VIE3.exe
  • %SYSTEM%\VIE2.exe
  • %WINDOWS%\rvoelbxt.exe
  • O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BD44AB1-76A7-4E05-92F4-4B065FE72BD6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BD44AB1-76A7-4E05-92F4-4B065FE72BD6}]
  • O3 - Toolbar: Internet Service - {3BEBF2FE-7248-40E2-9752-8163EB6C4038} - C:\Program Files\Applications\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BEBF2FE-7248-40E2-9752-8163EB6C4038}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{3BEBF2FE-7248-40E2-9752-8163EB6C4038}"=-



Muutokset v2.338 - v2.339

  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "buritos"=-
  • %ALLUSERPROFILE%\Start Menu\Programs\Antivirus XP 2008\
  • %ALLUSERPROFILE%\Start Menu\Programs\Antivirus XP 2008.lnk
  • %AllUserDesktop%\Antivirus XP 2008.lnk
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk



Muutokset v2.336 - v2.338

  • Update: 404Fix v1.3
  • %Desktop%\FETISH PICS.url
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
  • "smile"=-
  • Update: IEDFix.C 1.1
  • O2 - BHO: (no name) - {300CF5C9-F02D-4CB8-ABED-9C229DA56825} - C:\Program Files\Applications\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{300CF5C9-F02D-4CB8-ABED-9C229DA56825}]
  • %SYSTEM%\scui.cpl
  • %ProgramFiles%\AV9\
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
  • %USERPROFILE%\Start Menu\Programs\Antivirus 2009\
  • %desktop%\Antivirus 2009.lnk
  • %SYSTEM%\winsrc.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}]



Muutokset v2.335 - v2.336



Muutokset v2.3324 - v2.335

  • tdssserv.sys Rootkit detection
  • %ProgramFiles%\IA\
  • %ProgramFiles%\Internet Antivirus\
  • %USERPROFILE%\Application Data\Internet Antivirus\
  • %ALLUSERPROFILE%\Desktop\Internet Antivirus.lnk
  • %ALLUSERPROFILE%\Start Menu\Programs\Internet Antivirus\
  • %USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
  • %USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png
  • %USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
  • %USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer\iv.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Antivirus_is1]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
  • "iv"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Internet Antivirus"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  • "3P_UDEC_IA"=-
  • %desktop%\GAY PORN.url
  • %desktop%\MASTURBATION VIDS.url
  • %ProgramFiles%\PCHealthCenter\
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "\Win2.exe"=-
  • "\Win3.exe"=-
  • "\Win4.exe"=-
  • "\Win5.exe"=-
  • "\Win6.exe"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "\Win2.exe"=-
  • "\Win3.exe"=-
  • "\Win4.exe"=-
  • "\Win5.exe"=-
  • "\Win6.exe"=-
  • %ProgramFiles%\VAV\
  • %desktop%\Vista Antivirus 2008.lnk
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus"=-



Muutokset v2.333 - v2.3324

  • Update: 404Fix v1.2
  • O3 - Toolbar: Internet Service - {254B87BB-510D-41FA-A887-52C5FA9BE585} - C:\Program Files\Applications\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{254B87BB-510D-41FA-A887-52C5FA9BE585}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{254B87BB-510D-41FA-A887-52C5FA9BE585}"=-
  • %SYSTEM%\ieupdates.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "ieupdate"=-



Muutokset v2.332 - v2.333

  • %ProgramFiles%\Applications\
  • O3 - Toolbar: Internet Service - {38BF827A-D7C5-46E1-A9A2-47B1B5BB5438} - C:\Program Files\Applications\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38BF827A-D7C5-46E1-A9A2-47B1B5BB5438}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{38BF827A-D7C5-46E1-A9A2-47B1B5BB5438}"=-



Muutokset v2.331 - v2.332

  • %ProgramFiles%\ASpyC\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F58FF278-2198-403b-9170-C95022A194C6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SpyWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ASpyC]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F58FF278-2198-403b-9170-C95022A194C6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASpyC]
  • [-HKEY_CURRENT_USER\Software\ASpyC]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "ASpyC"=-



Muutokset v2.330 - v2.331

  • Update: Generic Renos Fix 1.16



Muutokset v2.328 - v2.329

  • %ProgramFiles%\RichVideoCodec\ (Already removed)
  • %SYSTEM%\RichVideoCodec.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\RichVideoCodec.DLL]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A85A2972-D35F-4089-86AE-83DFEF054E23}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35DA02A8-1D27-43EB-8088-3210521AA154}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B2DBC9D-7D49-48F4-8DDC-1B15415FF253}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{926A61C9-5C20-4583-ACA7-ACE21088816E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{11446072-F8F2-4C03-8A8A-D337AD2B13F2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BAF84F6B-038B-40E2-9688-1E3BF20988D8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0EF350A6-8AF0-40B5-ADE7-CB82FD02C3AE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.VideoCodec]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.VideoCodec.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.XMLDOMDocumentEventsSi.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RichVideoCodec.XMLDOMDocumentEventsSink]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{926A61C9-5C20-4583-ACA7-ACE21088816E}]
  • [-HKEY_CURRENT_USER\Software\RichVideoCodec]
  • O3 - Toolbar: Internet Service - {85BDD81D-31FD-4A6B-A73C-3955B128D2EC} - C:\Program Files\Web Technologies\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85BDD81D-31FD-4A6B-A73C-3955B128D2EC}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{85BDD81D-31FD-4A6B-A73C-3955B128D2EC}"=-
  • O2 - BHO: (no name) - {E2090673-256B-4632-94EE-FEC7F551543C} - C:\Program Files\Web Technologies\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2090673-256B-4632-94EE-FEC7F551543C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2090673-256B-4632-94EE-FEC7F551543C}]



Muutokset v2.326 - v2.328

  • %STARTMENU%\Programs\LookForPorn\
  • %PROGRAMFILES%\LookForPorn\
  • [-HKEY_CURRENT_USER\Software\LookForPorn]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LookForPorn]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LookForPorn]
  • %SYSTEM%\CbEvtSvc.exe
  • [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CbEvtSvc]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CBEVTSVC]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbEvtSvc]



Muutokset v2.325 - v2.326

  • %favorites%\Antivirus Scan.url
  • %startmenu%\Antivirus Scan.url
  • %desktop%\Antivirus Scan.url
  • %startmenu%\Online Spyware Test.url
  • %desktop%\Online Spyware Test.url
  • %WINDOWS%\pebgkxwq
  • %WINDOWS%\neltabxw.exe
  • %PROGRAMFILES%\Web Technologies\
  • O2 - BHO: (no name) - {A49E097A-D6EF-4B2F-8B0F-1230E998587F} - C:\Program Files\Web Technologies\iebt.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}]
  • O3 - Toolbar: Internet Service - {F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B} - C:\Program Files\Web Technologies\iebr.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{F99D0C20-F8E1-43B6-AB24-3F16BFAEA77B}"=-
  • [-HKEY_CURRENT_USER\Software\Web Technologies]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9989F1F6-70DE-4244-AC9F-6672983681A0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning32.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning32.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\e405.e405mgr]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.lnk
  • %STARTMENU%\AntiSpyCheck 2.1.lnk
  • %STARTMENU%\Programs\AntiSpyCheck 2.1\
  • %DESKTOP%\AntiSpyCheck 2.1.lnk
  • %PROGRAMFILES%\AntiSpyCheck 2.1\
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiSpyCheck 2.1"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "AUTORUN_VAL"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck 2.1.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck 2.1]
  • [-HKEY_CURRENT_USER\Software\AntiSpyCheck 2.1]



Muutokset v2.324 - v2.325

  • Update: IEDFix.C



Muutokset v2.323 - v2.324

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpyCheck 2.1.0.lnk
  • %STARTMENU%\AntiSpyCheck 2.1.0.lnk
  • %STARTMENU%\Programs\AntiSpyCheck 2.1.0\
  • %DESKTOP%\AntiSpyCheck 2.1.0.lnk
  • %PROGRAMFILES%\AntiSpyCheck\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FA7933-DC3E-403b-8D47-BB5E3F345A21}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF-70C1EDD8B2E8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning.WarningBHO]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEWarning.WarningBHO.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56FA7933-DC3E-403b-8D47-BB5E3F345A21}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck]
  • [-HKEY_CURRENT_USER\Software\AntiSpyCheck]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiSpyCheck 2.1.0"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "AntiSpyCheck"=-



Muutokset v2.320 - v2.323

  • New Componant: Policies.exe
  • This tool is run first (then it runs SmitfraudFix.cmd) to restore some policies that prevent command line execution.



Muutokset v2.319 - v2.320

  • %WINDOWS%\spwoqbmv.exe
  • %WINDOWS%\xbaqktfv.exe
  • %WINDOWS%\qadovnel.dll
  • VirusHeat 4.4.exe
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.4.lnk
  • %STARTMENU%\VirusHeat 4.4.lnk
  • %STARTMENU%\Programs\VirusHeat 4.4\
  • %DESKTOP%\VirusHeat 4.4.lnk
  • %PROGRAMFILES%\VirusHeat 4.4\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DFBA66B-DB48-4292-831A-E7186D8A61AE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46F309AE-9D11-4C10-9D20-2C084B1C8BCE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB95561-AF37-4BBD-823C-1E355A744A43}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76157861-4996-4711-90E4-6D868B877B24}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{81DA01DB-8100-4865-B9B0-A83F54378435}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{910EF37B-A486-41FC-8A1B-28C5581AB3AC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6B2BC38-7F2A-4202-9B43-A28615727FEE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B11DA4C8-52DC-44A2-B21B-02BF7A93EB5B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5ADBFCA-C6DE-4E5A-A2DA-70AA2933B696}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5AE5932-F1B3-45E4-842A-59EEA65B13A8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA18BA7B-9567-4408-9B87-3D3990C3969E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D56509AB-9821-4DB0-BF2F-115159804140}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DFF203EA-222C-44FA-8B78-ED88B4587AA2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EB22B708-E0D3-4FCE-800B-6DD0C5B30D42}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EA02F8-E536-4828-BFB7-3DE7FA4D4B09}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6E18622-DFA8-4DBA-B05E-D3D147E16D44}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{23624BD0-2A69-4F91-BE6A-9F1F22B72C13}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.4.exe 4.4]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.4]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.4]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusHeat 4.4"=-



Muutokset v2.318 - v2.319

  • %DESKTOP%\IE AntiVirus 3.2.lnk
  • %STARTMENU%\Programs\IE AntiVirus 3.2.lnk
  • %PROGRAMFILES%\IEAntiVirus
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE AntiVirus]
  • [-HKEY_CURRENT_USER\Software\IEAntiVirus]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "antispy"=-



Muutokset v2.317 - v2.318

  • Update: VACFix definition
  • %WINDOWS%\wxvgsdbq.exe
  • %WINDOWS%\olgdqarf.exe



Muutokset v2.314 - v2.315

  • %SYSTEM%\892267\
  • O2 - BHO: 892267 helper - {25E0128D-AAFC-49FF-AB11-1F12C2FCC391} - C:\WINDOWS\System32\892267\892267.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25E0128D-AAFC-49FF-AB11-1F12C2FCC391}]



Muutokset v2.313 - v2.314

  • %DESKTOP%\Malware Bell 3.2.lnk
  • %STARTMENU%\Programs\Malware Bell 3.2.lnk
  • %PROGRAMFILES%\MalwareBell
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malware Bell]
  • [-HKEY_CURRENT_USER\Software\MalwareBell]



Muutokset v2.312 - v2.313

  • %SYSTEM%\403445\
  • O2 - BHO: 403445 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\403445\403445.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E654A16-4765-4EAA-94EC-D5A6578053A4}]



Muutokset v2.311 - v2.312

  • Update: IEDFix Signatures



Muutokset v2.310 - v2.311

  • %WINDOWS%\config.ini
  • %WINDOWS%\mywallpaper.bmp
  • %WINDOWS%\sysabmpmfr.exe
  • %WINDOWS%\sysahbecjh.exe
  • %WINDOWS%\sysatjsicj.exe
  • %WINDOWS%\sysavxjgdu.exe
  • %WINDOWS%\sysawechod.exe
  • %WINDOWS%\zysalwhkkw.exe
  • %WINDOWS%\zysaoxcjiy.exe
  • %WINDOWS%\zysapghucv.exe
  • %WINDOWS%\zysaxyczld.exe
  • [-HKEY_CURRENT_USER\Software\CrystalRealityCleaner]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "{DD651081-A909-45ad-BD71-2335B0ADE043}"=- (Already removed)
  • "{9754B85A-3B34-4969-BE1F-CD03227E9470}"=- (Already removed)
  • "{7DD4A7AC-A3F1-4495-884A-7947C5B89108}"=-
  • "{2C70168B-97CE-4f31-B85D-1FEC5002721D}"=-
  • "{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}"=-



Muutokset v2.309 - v2.310

  • %SYSTEM%\215651\
  • O2 - BHO: 215651 helper - {0BC5E8C9-6EFF-4976-9A3C-D74148442CE7} - C:\WINDOWS\System32\215651\215651.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BC5E8C9-6EFF-4976-9A3C-D74148442CE7}]
  • O3 - Toolbar: Internet Service - {51D81DD5-55B7-497F-95DB-D356429BB54E} - C:\Program Files\NetProject\wamdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51D81DD5-55B7-497F-95DB-D356429BB54E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{51D81DD5-55B7-497F-95DB-D356429BB54E}"=-



Muutokset v2.308 - v2.309

  • O2 - BHO: (no name) - {7C109800-A5D5-438F-9640-18D17E168B88} - C:\Program Files\NetProject\sbmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}]
  • %SYSTEM%\375013\
  • O2 - BHO: 375013 helper - {74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B} - C:\WINDOWS\System32\375013\375013.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74F7DB6B-86E9-4B91-9D9F-B0D954D7AA5B}]



Muutokset v2.307 - v2.308

  • %WINDOWS%\sysqyzwud.exe
  • %WINDOWS%\config.ini
  • %WINDOWS%\sysscpmqn.exe
  • %WINDOWS%\syssngbeh.exe
  • %WINDOWS%\sysutrnez.exe
  • %WINDOWS%\syszweuas.exe
  • %WINDOWS%\xcbhwuq.exe
  • %WINDOWS%\xewuaqj.exe
  • %WINDOWS%\xfjzrby.dll
  • %WINDOWS%\xhbxcnv.exe
  • %WINDOWS%\mywallpaper.bmp
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  • "{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}"=-
  • "{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}"=-
  • "{DD651081-A909-45ad-BD71-2335B0ADE043}"=-
  • "{9754B85A-3B34-4969-BE1F-CD03227E9470}"=-



Muutokset v2.305 - v2.307

  • %SYSTEM%\tdidrv32.sys
  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {DF47DD37-AC11-4A93-8E16-2B2364AF0897} - C:\Program Files\Helper\??????????.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF47DD37-AC11-4A93-8E16-2B2364AF0897}]
  • %WINDOWS%\norlatmx.exe
  • %WINDOWS%\fmrcjmdc.exe



Muutokset v2.304 - v2.305

  • %USERPROFILE%\Application Data\?????.exe (Awola6 Dropper, Random filename)
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Microsoft Windows Adapter 5.1.3214"=-
  • %USERPROFILE%\Application Data\Awola6\
  • %STARTMENU%\Programs\Awola6\
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Awola6"=-
  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - C:\Program Files\Helper\??????????.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8}]



Muutokset v2.303 - v2.304

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • "{DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow]
  • "*.securewebinfo.com"=-
  • "*.safetyincludes.com"=-
  • "*.securemanaging.com"=-



Muutokset v2.300 - v2.301

  • O4 - HKCU\..\Run: [Pest-Capture] C:\Program Files\PestCapture\PestCapture.exe
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Pest-Capture"=-
  • %SYSTEM%\sysockeu.exe
  • %SYSTEM%\sysokuaw.exe
  • %SYSTEM%\sysodkcs.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "[1029BB4B-16A9-4E77-AA3D-96930BD68EEC]"=-
  • "[2177F056-0AA6-4D6C-A944-13F71F341C29]"=-
  • "[852EBF20-A95D-4F1F-B9C2-B2CD24350F3E]"=-
  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {8F10DE2B-E923-4548-B524-4D9C5FA80777} - C:\Program Files\Helper\??????????.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F10DE2B-E923-4548-B524-4D9C5FA80777}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8F10DE2B-E923-4548-B524-4D9C5FA80777}



Muutokset v2.299 - v2.300

  • %SYSTEM%\mgmrwmrv.exe
  • F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,



Muutokset v2.298 - v2.299

  • Update: IEDFix.exe 1.5
  • O2 - BHO: Windows Media Player - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\wmpdxm.dll
  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {03B902B1-9B25-4173-9468-56775C85A8D4} - C:\Program Files\Helper\??????????.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03B902B1-9B25-4173-9468-56775C85A8D4}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03B902B1-9B25-4173-9468-56775C85A8D4}



Muutokset v2.297 - v2.298

  • Update: VAC Fix 0.5



Muutokset v2.295 - v2.296

  • C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\RomAvp.dll
  • C:\WINDOWS\Installer\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff24a0f4-b93e-4b4b-9bfb-e398e98db703}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "RomAvp"=-



Muutokset v2.292 - v2.293

  • %WINDOWS%\764.exe
  • %WINDOWS%\7search.dll
  • %WINDOWS%\absolute key logger.lnk
  • %WINDOWS%\aconti.exe
  • %WINDOWS%\aconti.ini
  • %WINDOWS%\aconti.log
  • %WINDOWS%\aconti.sdb
  • %WINDOWS%\acontidialer.txt
  • %WINDOWS%\adbar.dll
  • %WINDOWS%\cbinst$.exe
  • %WINDOWS%\daxtime.dll
  • %WINDOWS%\default.htm
  • %WINDOWS%\dp0.dll
  • %WINDOWS%\eventlowg.dll
  • %WINDOWS%\fhfmm-Uninstaller.exe
  • %WINDOWS%\fhfmm.exe
  • %WINDOWS%\flt.dll
  • %WINDOWS%\hcwprn.exe
  • %WINDOWS%\hotporn.exe
  • %WINDOWS%\iexplorr23.dll
  • %WINDOWS%\ie_32.exe
  • %WINDOWS%\jd2002.dll
  • %WINDOWS%\kkcomp$.exe
  • %WINDOWS%\kkcomp.dll
  • %WINDOWS%\kkcomp.exe
  • %WINDOWS%\kvnab$.exe
  • %WINDOWS%\kvnab.dll
  • %WINDOWS%\kvnab.exe
  • %WINDOWS%\liqad$.exe
  • %WINDOWS%\liqad.dll
  • %WINDOWS%\liqad.exe
  • %WINDOWS%\liqui-Uninstaller.exe
  • %WINDOWS%\liqui.dll
  • %WINDOWS%\liqui.exe
  • %WINDOWS%\ngd.dll
  • %WINDOWS%\pbar.dll
  • %WINDOWS%\pbsysie.dll
  • %WINDOWS%\settn.dll
  • %WINDOWS%\spredirect.dll
  • %WINDOWS%\vxddsk.exe
  • %WINDOWS%\wbeCheck.exe
  • %WINDOWS%\wbeInst$.exe
  • %WINDOWS%\wml.exe
  • %WINDOWS%\xadbrk.dll
  • %WINDOWS%\xadbrk.exe
  • %WINDOWS%\xadbrk_.exe
  • %WINDOWS%\xxxvideo.exe
  • %SYSTEM%\ace16win.dll
  • %SYSTEM%\acespy\
  • %SYSTEM%\ESHOPEE.exe
  • %SYSTEM%\msole32.exe
  • %SYSTEM%\rxjddnvj.exe
  • %SYSTEM%\vxddsk.exe
  • %SYSTEM%\winfrun32.bin
  • %SYSTEM%\wml.exe
  • %PROGRAMFILES%\3721\
  • %PROGRAMFILES%\Accoona\
  • %PROGRAMFILES%\akl\
  • %PROGRAMFILES%\amsys\
  • %PROGRAMFILES%\e-zshopper\
  • %PROGRAMFILES%\p2pnetworks\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-d9e3-4bc6-a0bd-3d0ca4be5271}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000012-890e-4aac-afd9-eff6954a34dd}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{029e02f0-a0e5-4b19-b958-7bf2db29fb13}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06dfedaa-6196-11d5-bfc8-00508b4a487d}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12F02779-6D88-4958-8AD3-83C12D86ADC7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1adbcce8-cf84-441e-9b38-afc7a19c06a4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51641ef3-8a7a-4d84-8659-b0911e947cc8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53C330D6-A4AB-419B-B45D-FD4411C1FEF4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54645654-2225-4455-44A1-9F4543D34546}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{669695bc-a811-4a9d-8cdf-ba8c795f261e}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6abc861a-31e7-4d91-b43b-d3c98f22a5c0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{944864a5-3916-46e2-96a9-a2e84f3f1208}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4a435cf-3583-11d4-91bd-0048546a1450}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8875bfe-b021-11d4-bfa8-00508b8e9bd3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bb936323-19fa-4521-ba29-eca6a121bc78}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2680e10-1655-4a0e-87f8-4259325a84b7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c4ca6559-2cf1-48b6-96b2-8340a06fd129}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5af2622-8c75-4dfb-9693-23ab7686a456}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca1d1b05-9c66-11d5-a009-000103c1e50b}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d8efadf1-9009-11d6-8c73-608c5dc19089}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9147a0a-a866-4214-b47c-da821891240f}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9306072-417e-43e3-81d5-369490beef7c}]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • Cleaning Userinit or deleting if empty
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • Cleaning Userinit



Muutokset v2.291 - v2.292

  • %SYSTEM%\txdkfh.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d9f6ce57-0718-4bd1-916f-5fb1f86911c2}"="arborize"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 4.3.lnk
  • %STARTMENU%\VirusHeat 4.3.lnk
  • %STARTMENU%\Programs\VirusHeat 4.3\
  • %DESKTOP%\VirusHeat 4.3.lnk
  • %PROGRAMFILES%\VirusHeat 4.3\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EC085A8-9818-43B7-B975-EC7555EDA4D2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1A74C41C-0837-4FBE-BA50-621EB70F01CE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25297614-1B76-4C2C-82C6-62738AA0E8F0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37F89457-1208-4670-9245-58C62BD6D870}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45477032-ABD0-454D-9CE4-EA34C10322F8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69E34747-0B27-4B30-AE20-1023BF29E246}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79BE5B3B-80B2-4B77-A042-EFC90F6E0DE7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C0EC6BF-81B9-4FE0-9447-4ED29A36BF5D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7EBB34CF-1728-4136-A968-48F231DAD1B4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88DAA291-B413-4C46-B378-3BE66F65369E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{936A2F4A-53F8-4D2F-92AA-2F9DE889841C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AFCC3FA7-82A9-42D5-A405-78711E97A5D6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC05A4A3-7B28-488F-AB02-6AAEDB86ACCF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E80114AA-6653-4952-9E97-5F1DC63BEE0F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9109A2A-432B-4ADD-A6FA-06BA22DCD2D9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FCA3958A-8D38-4D14-8B81-CCD7F68A8A01}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CBD02E9B-37EF-47D2-96B0-3ABBB2EB92BF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 4.3.exe 4.3]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 4.3]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 4.3]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusHeat 4.3"=-



Muutokset v2.290 - v2.291

  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\??????????.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C566C34-7D72-4DC1-9BBE-1121A76698F8}
  • %STARTMENU%\Programs\SearchVideo\
  • %Programs%\SearchVideo
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchVideo]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchVideo]
  • [-HKEY_CURRENT_USER\Software\SearchVideo]
  • %SYSTEM%\svxmhpz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67dc0736-075a-4647-95f5-d5421b838fed}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{67dc0736-075a-4647-95f5-d5421b838fed}"="esperantido"



Muutokset v2.289 - v2.290

  • %STARTMENU%\Programs\SearchPorn\
  • %Programs%\SearchPorn
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchPorn]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchPorn]
  • [-HKEY_CURRENT_USER\Software\SearchPorn]



Muutokset v2.288 - v2.289

  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {8BD4438C-2511-4B93-AD34-2BDCD0FF78D2} - C:\Program Files\Helper\1203020309.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB} (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1 (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8BD4438C-2511-4B93-AD34-2BDCD0FF78D2}
  • %STARTMENU%\Programs\ChristmasPorn\
  • %Programs%\ChristmasPorn
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChristmasPorn]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ChristmasPorn]
  • [-HKEY_CURRENT_USER\Software\ChristmasPorn]
  • %SYSTEM%\eeioq.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{917f93bf-6714-4e11-8982-59db2e0f88fc}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{917f93bf-6714-4e11-8982-59db2e0f88fc}"="epistylar"



Muutokset v2.287 - v2.288

  • %PROGRAMFILES%\Helper\ (Already removed)
  • O2 - BHO: e404 helper - {C03FD59D-9104-44B7-929A-9EAA0BA05211} - C:\Program Files\Helper\1202750081.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E404.e404mgr.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C03FD59D-9104-44B7-929A-9EAA0BA05211}]



Muutokset v2.282 - v2.283

  • %SYSTEM%\iinqyl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27cb634d-c84e-4c00-9b53-f5523601dbad}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{27cb634d-c84e-4c00-9b53-f5523601dbad}"="cariniana"
  • %SYSTEM%\wuuawkz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{747e1fbe-b70f-441d-bbca-6e536c04924a}"="didact"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusHeat 3.9.lnk
  • %STARTMENU%\VirusHeat 3.9.lnk
  • %STARTMENU%\Programs\VirusHeat 3.9\
  • %DESKTOP%\VirusHeat 3.9.lnk
  • %PROGRAMFILES%\VirusHeat 3.9\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E94EB13E-D78F-0857-7734-5E67A49FFFF1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0979850F-6C3E-4294-B225-B3D3C4A6F2A1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BB2DA5F-B78F-44EA-BDA1-771CBE1DEC68}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A4E73C5-BA3C-4391-B7E5-FFE8D3BD6245}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{44A923CA-F430-4F85-9F84-5153ECDB882E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E6E21EC-9D72-4164-8A53-74786A467872}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{631E9E48-B066-43DA-92AC-6DADF61B173B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{65C1361C-E696-4AF0-9E21-81910193F352}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DCE805-C8CE-48AA-A47F-BFA6CC7704B3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D42769F-07D8-494D-AAB4-AA1652C541FA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1922071-390C-418D-916D-91209E95D286}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1F8CD95-CFB3-43D1-A956-63441CC058C1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A63B46AD-96A7-4A2C-BD8F-8CD097E1593A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A65F98DD-2360-468C-B76E-B1B84C0D547C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE2AEED0-BE1B-4BA2-826E-20D1991081B8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7F73787-6206-4BBA-BDC0-7CFA9940DBCB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E770F739-2968-4ED9-A63C-DC1938DC82A2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CFAFA83C-855B-4E3D-92B9-A587995B675A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusHeat 3.9.exe 3.9]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusHeat 3.9]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusHeat 3.9]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusHeat 3.9"=-



Muutokset v2.280 - v2.281

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132E4218-F960-4E17-B3F6-0F05431D81C6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{435DEA43-7D14-47F0-8223-B416BD296464}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82FC6E1B-7C32-4144-B95D-22D757327778}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D604E3C4-21ED-43D4-8CDF-759954DE7E88}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{132E4218-F960-4E17-B3F6-0F05431D81C6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB41490A-2B8A-414F-BFFB-D3527364EE25}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19C93F79-69BC-4994-B6C6-8D9CCCD9C454}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CB7E3AA3-D273-428B-A0DD-579689D26EC1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bsdw]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{AB41490A-2B8A-414F-BFFB-D3527364EE25}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DD6CD4E-6AAA-44DC-A804-88EB672341D7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE78CF65-D188-487A-9A39-5DBFC77BF015}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{15EE94F8-5660-47F1-8358-0D386BC64247}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AEEDB2-C2BA-4F27-B591-44EA89388299}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AB01356-C318-4E73-998C-8E54C8EB5E64}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA97E13E-1DED-4851-B684-BAD36D8E29B3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.brgk]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{5FF6FACA-CFF7-499D-AB5B-8EEA9CE80739}"=-
  • %SYSTEM%\ctfmona.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "ctfmona"=-
  • %PROGRAMFILES%\IECodec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F27B120-0DED-4701-85B4-4CC58D92534C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9D18326E-AD27-4757-8564-79929B2F6363}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45490C66-3E2A-46cb-880B-547D69157450}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VSCHelp]
  • [-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL] (Already removed)
  • [-HKEY_CURRENT_USER\Software\Classes\AppID\{A45C8C0C-E056-4892-A589-E389355E1E31}]
  • [-HKEY_CURRENT_USER\Software\Classes\CLSID\{45490C66-3E2A-46cb-880B-547D69157450}]
  • [-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO] (Already removed)
  • [-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1] (Already removed)



Muutokset v2.277 - v2.278

  • Changelog is now private.
  • Some people were using informations of this page to include malware files and keys to update and develop their tools.



Muutokset v2.276 - v2.277

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center]
  • [-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
  • [-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8113B5DE-F7EB-4154-A311-497FB80D8BD0}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{8113B5DE-F7EB-4154-A311-497FB80D8BD0}"=-
  • O2 - BHO: SXG Advisor - {EF39E67B-8383-4A49-AAC6-29349FA7F623} - C:\WINDOWS\dntpkwodpx.dll
  • O3 - Toolbar: ekxdvft - {F25117E3-2A27-4A0C-88EE-D9307F678DD0} - C:\WINDOWS\ekxdvft.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F25117E3-2A27-4A0C-88EE-D9307F678DD0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27DBACCC-358C-4C2A-98FB-C79AFD3691C9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6A74AFE4-24A0-49E7-9FC9-2A603F486441}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8323182A-2264-4A99-B9F8-40F3A425FCD7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1385D09E-8B2D-45E1-B235-49E12B248AD5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A98CC268-6435-4453-8DB5-A31C3DEB74BA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.bwtn]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ekxdvft.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF39E67B-8383-4A49-AAC6-29349FA7F623}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{F25117E3-2A27-4A0C-88EE-D9307F678DD0}"=-
  • %WINDOWS%\fxtqdrl.exe
  • %WINDOWS%\agrlmvp.dll
  • %WINDOWS%\bmlvqkn.dll
  • O21 - SSODL: agrlmvp - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\agrlmvp.dll
  • O21 - SSODL: bmlvqkn - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bmlvqkn.dll



Muutokset v2.275 - v2.276

  • VideoAccessCodec update.



Muutokset v2.274 - v2.275

  • Update: IEDFix v1.3



Muutokset v2.273 - v2.274

  • Update: IEDFix v1.1. The tool will now detected new generic files and registry keys/subkeys without updates.



Muutokset v2.272 - v2.273

  • %WINDOWS%\pdswin.dll



Muutokset v2.270 - v2.271

  • %WINDOWS%\websrc32.dll



Muutokset v2.269 - v2.270

  • %SYSTEM%\cjuvwa.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0123eb75-964c-4cb3-b796-431cc9099570}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{0123eb75-964c-4cb3-b796-431cc9099570}"="disgorging"
  • %WINDOWS%\corpol.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E330678D-C3B1-4AC1-AD7B-2F9CAC58F889}]



Muutokset v2.268 - v2.269

  • %WINDOWS%\pmspl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38583F22-1B12-4893-9D7A-BD3FA2A114C7}]



Muutokset v2.266 - v2.267

  • Added: IEDFix.exe tool to remove IE Defender keys and BHO from registry.
  • %SYSTEM%\sysvideo32.dll



Muutokset v2.265 - v2.266

  • %WINDOWS%\msvideo.dll
  • O2 - BHO: Video - {80590BC5-F4BA-4AD1-B216-C19EE86E2A77} - C:\WINDOWS\msvideo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\msvideo.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msvideo.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{80590BC5-F4BA-4AD1-B216-C19EE86E2A77}]



Muutokset v2.264 - v2.265

  • %WINDOWS%\windivx.dll
  • O2 - BHO: Video - {F5E81149-92B2-47D2-A12B-1B966AB46EA7} - C:\WINDOWS\windivx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5E81149-92B2-47D2-A12B-1B966AB46EA7}]



Muutokset v2.263 - v2.264

  • %WINDOWS%\windivx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4AB15165-917A-4AE4-AE42-7FF13F61805B}]



Muutokset v2.260 - v2.262

  • %WINDOWS%\windivx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\windivx.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37FB07D0-16B8-4975-A848-1DB62FEE0048}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{76BFB9CF-A8AB-4826-B2AB-02E04A202C73}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\windivx.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{632F6863-1E54-49FC-A72F-BDEE592EAD52}]
  • %WINDOWS%\jokvip.exe
  • %WINDOWS%\blopenvt??.dll
  • %WINDOWS%\retnsrp.dll
  • %WINDOWS%\nopzet.dll
  • %WINDOWS%\leorop.dll
  • O2 - BHO: OFK System - {29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A} - C:\WINDOWS\blopenvtlv.dll
  • O3 - Toolbar: The retnsrp - {5FCD26F2-55C1-40F3-838A-FB4FD8833A53} - C:\WINDOWS\retnsrp.dll
  • O21 - SSODL: nopzet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopzet.dll
  • O21 - SSODL: leorop - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\leorop.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A914309-35E8-4A15-A175-56F7C7631A5F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4E7132F-BC0F-4464-81AC-25F677AA7500}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18A7928B-2F6D-4B65-8DBB-96579CE0702D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D2CF7C5-E65C-470A-86FE-56C68CF07CBD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31820FB5-5CBD-49FF-92AD-795165A01C92}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D7FDFC0-2192-4150-B573-DEE0661876C3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F48D75B5-D574-4059-8D6B-6FA61DC0EAE0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{88BB4245-F609-48CF-9C95-FAE9735037F8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E8C85D6-5E9F-467B-896E-7127AED75504}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DD0501B8-8D05-446E-A510-EDCC0E43618D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.blos]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\retnsrp.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{5FCD26F2-55C1-40F3-838A-FB4FD8833A53}"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "nopzet"=-
  • "leorop"=-
  • %ProgramFiles%\IECodec\
  • O2 - BHO: IECodecBHO - {4507C219-24AA-4813-9561-A2003F9920C3} - C:\Program Files\IECodec\IECodec.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DA5EAB81-9E79-4751-8E06-3E68FF0CFFB6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7C12A866-F10B-43B4-A9D0-8857C318AF17}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4507C219-24AA-4813-9561-A2003F9920C3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IECodec]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\IECodec]
  • [-HKEY_CURRENT_USER\Software\Classes\AppID\IECodec.DLL]
  • [-HKEY_CURRENT_USER\Software\Classes\AppID\{9F264A67-6126-451A-8D14-D6EE64364CD0}]
  • [-HKEY_CURRENT_USER\Software\Classes\CLSID\{4507C219-24AA-4813-9561-A2003F9920C3}]
  • [-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO]
  • [-HKEY_CURRENT_USER\Software\Classes\IECodec.IECodecBHO.1]



Muutokset v2.258 - v2.260

  • %SYSTEM%\uglgs.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76fbb79c-2ec6-4962-a324-fd4362588e1c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{76fbb79c-2ec6-4962-a324-fd4362588e1c}"="graphologists"
  • %SYSTEM%\ncrjf.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8b87dcc7-9b89-4205-aa82-076b2a1edfe0}"="caribi"
  • %SYSTEM%\tvtpwp.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}\InProcServer32]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}"="eaton"
  • O2 - BHO: (no name) - {E8249E69-A809-4544-832F-64EB65747A92} - C:\Program Files\Online Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E8249E69-A809-4544-832F-64EB65747A92}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8249E69-A809-4544-832F-64EB65747A92}]
  • O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
  • O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}]
  • %WINDOWS%\stream32a.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\stream32a.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D23D68-9E03-4FF0-8035-C6184C8784EF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{60B18D81-366A-4156-83B9-CF310ED9A8B7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stream32a.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6430CCA7-032A-4EB0-BCFF-838998E73EF5}]
  • %WINDOWS%\vipext???.dll (Already removed)
  • O2 - BHO: OFK System - {014F04C1-4440-4901-9A39-D08B116C1BA0} - C:\WINDOWS\vipextgpk.dll
  • O3 - Toolbar: The voipwet - {476B38B7-6E7C-46B4-8080-F61ED0E814F2} - C:\WINDOWS\voipwet.dll (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{014F04C1-4440-4901-9A39-D08B116C1BA0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{476B38B7-6E7C-46B4-8080-F61ED0E814F2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7ADB274-7419-4788-906D-C880FBAD11B9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEEEB14B-DB9F-48BB-B56D-CCDA3B942592}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{209A3C3B-B2C9-4451-9DD8-7B1C585ACC8E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{25474AF2-E3DE-4E68-8DE8-0B0786735E01}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5846BDF0-1EBB-4112-B601-2DA11EEF610E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CE5A74B-1E8B-4FD5-8C10-F49A2092FF8A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF809BE5-B8E2-4CD1-92DB-68129F895A64}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{13FD02D1-7E01-4CEA-B81D-595847E04645}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4795C864-D705-4009-B0A2-5F432FE6B61B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5383337F-EEC2-4B25-9C42-8992B49C7AFA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bmrl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{014F04C1-4440-4901-9A39-D08B116C1BA0}]



Muutokset v2.257 - v2.258

  • %SYSTEM%\ymmzwd.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{075a465d-0af2-4b79-8db3-2fda0fd8d74c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{075a465d-0af2-4b79-8db3-2fda0fd8d74c}"="arsenicism"
  • %SYSTEM%\zcwlnic.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d66c22b6-2217-4d1a-9a90-1a54de1fc706}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d66c22b6-2217-4d1a-9a90-1a54de1fc706}"="edgers"
  • %WINDOWS%\vipext???.dll
  • O2 - BHO: MSVPS System - {00A00BA9-9D58-4B56-8FC6-C280650A8BD7} - C:\WINDOWS\vipextpnk.dll
  • O3 - Toolbar: The voipwet - {167F6405-019D-4F32-8FBE-23B3C63CD8FD} - C:\WINDOWS\voipwet.dll
  • O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll (Already removed)
  • O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{167F6405-019D-4F32-8FBE-23B3C63CD8FD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EB24324-3394-4C5F-B69C-744A74797952}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C37AC-F6DC-4C75-B61A-8F86BC5A9E9A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{133621C3-9F52-4497-A814-97D268F8CACE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{36009226-067D-47C0-A497-7B2E5D3FAF03}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63115489-CFBF-4B7F-8B2F-EC1811041239}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A98BEE2D-F5D8-4BBB-B041-077CEFF0CA41}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE58E4D5-E8E1-4F59-AC3F-6315810A7889}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{603C15E0-CC27-45BB-82FD-8B2B6143E574}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A930694-495D-4C93-A483-D72FEF0EF1CE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EFD7B225-FD88-40C7-931F-1FEEA9585D5C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.bros]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A00BA9-9D58-4B56-8FC6-C280650A8BD7}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{167F6405-019D-4F32-8FBE-23B3C63CD8FD}"=-



Muutokset v2.256 - v2.257

  • %SYSTEM%\sysdivx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\sysdivx.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{609F107D-88EE-4D19-B56F-6C21A3E9DC1F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F94E2B67-3D7A-4F94-AF35-5BBEDAAD3AC4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sysdivx.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A23A1E8-B2AB-4C50-AD12-9E19B747E17C}]
  • %WINDOWS%\nretcip.exe
  • %WINDOWS%\vipextoxn.dll
  • %WINDOWS%\voipwet.dll
  • %WINDOWS%\jetctrl.dll
  • %WINDOWS%\kopmet.dll
  • O2 - BHO: MSVPS System - {5EF40AC5-1BBE-4436-A9E3-F129C0D605D8} - C:\WINDOWS\vipextoxn.dll
  • O3 - Toolbar: The voipwet - {D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C} - C:\WINDOWS\voipwet.dll
  • O21 - SSODL: kopmet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\kopmet.dll
  • O21 - SSODL: jetctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\jetctrl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C5B3552-E18F-45BE-BEA8-78ACEC1F2C6B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D79308A2-F924-4CD6-A52A-158C68EF41F8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{602F5204-5CD4-4160-9506-2CA8266FAC4D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60C84877-62D8-4996-88E5-BAF3D115F09F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AEA32A1-63D2-4DE6-A1F8-C2132972C15F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9924DC07-F8D2-4A19-A396-9871B55612D7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B039EF74-B33F-468E-BE93-2A4F0D61DF59}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{212B4E0F-BEA8-4894-800D-2C7E2EF097AD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3DD88B10-20E4-4085-BB2C-5A58B49910A9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5216FD0F-3915-4F95-95CF-4F09659F58C3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.btgn]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\voipwet.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5EF40AC5-1BBE-4436-A9E3-F129C0D605D8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{D4170A6E-8CE3-444B-ACA4-B3A0AF12C55C}"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "gormet"=-
  • "pmkret"=-
  • %WINDOWS%\oprevpfm.dll
  • O2 - BHO: MSVPS System - {3CE12841-9438-48A0-9DA9-D3D2D3D562CC} - C:\WINDOWS\oprevpfm.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CE12841-9438-48A0-9DA9-D3D2D3D562CC}]
  • %WINDOWS%\werbetpwg.dll (already removed)
  • O2 - BHO: MSVPS System - {7EB8B2AC-28EE-45F1-9834-418FC9D72DDF} - C:\Windows\werbetpwg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EB8B2AC-28EE-45F1-9834-418FC9D72DDF}]
  • %WINDOWS%\hdtip.dll (already removed)
  • O3 - Toolbar: The hdtip - {E3E087D3-CA1D-4ECA-9960-D85944C2554C} - C:\Windows\hdtip.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E3E087D3-CA1D-4ECA-9960-D85944C2554C}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{E3E087D3-CA1D-4ECA-9960-D85944C2554C}"=-



Muutokset v2.255 - v2.256

  • %SYSTEM%\ivrllc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b585105c-0e84-4ef0-9c6a-fbe134a72945}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b585105c-0e84-4ef0-9c6a-fbe134a72945}"="ineffulgent"
  • %SYSTEM%\PowerVideo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{323301C5-CB6B-490C-B59F-E7FAD4D69C93}]
  • O3 - Toolbar: IE Custom Tools - {EFAF6EA3-615D-4F83-8748-2F7A576FCEA6} - C:\Program Files\Video Add-on\ictmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • {EFAF6EA3-615D-4F83-8748-2F7A576FCEA6}=-



Muutokset v2.254 - v2.255

  • %WINDOWS%\monhop.exe
  • %WINDOWS%\werbet???.dll
  • %WINDOWS%\hdtip.dll
  • %WINDOWS%\gormet.dll
  • %WINDOWS%\pmkret.dll
  • O2 - BHO: MSVPS System - {A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE} - C:\WINDOWS\werbetdqw.dll
  • O3 - Toolbar: The hdtip - {85B2F289-7128-4C5A-A330-F9FC01432D3A} - C:\WINDOWS\hdtip.dll
  • O21 - SSODL: gormet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\gormet.dll
  • O21 - SSODL: pmkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\pmkret.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F25839C-CB93-4394-A938-2194851C544F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85B2F289-7128-4C5A-A330-F9FC01432D3A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9024FB63-4FBA-4A65-B607-5D13B76CF13F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19D21F2D-455C-4AAA-8DF0-58F3D76962B4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D78A01B-FD57-464B-B5F2-BFC1702F26DF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A5ED75E-2562-4266-A85D-4D66E33C50FC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B983DE8B-60CD-4F7F-B09A-F8A33B26845C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA978B5D-E354-47FD-9E95-ACE61FC665DF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7AAFD5DA-55D0-4FAB-8AEF-9643707042F6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE73C3E4-88F7-41A0-AF79-87BE6826B8DF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F7A3BB37-D5C6-4946-AF22-DFCF804C67AB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.bpnv]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hdtip.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A477EBE4-ABE9-4A9D-B1B4-0EB1D0D025CE}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{85B2F289-7128-4C5A-A330-F9FC01432D3A}"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "gormet"=-
  • "pmkret"=-
  • %WINDOWS%\oprevxlw.dll
  • O2 - BHO: MSVPS System - {27A5292F-0C87-4E81-A34E-3131DBFCE994} - C:\WINDOWS\oprevxlw.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A5292F-0C87-4E81-A34E-3131DBFCE994}]
  • %WINDOWS%\bonsws.dll
  • O3 - Toolbar: The bonsws - {2181E54F-274D-48B7-9E51-BC374933CD24} - C:\WINDOWS\bonsws.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2181E54F-274D-48B7-9E51-BC374933CD24}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{2181E54F-274D-48B7-9E51-BC374933CD24}"=-
  • %WINDOWS%\oprevgkx.dll
  • O2 - BHO: MSVPS System - {1658DABA-FC4C-46C6-BC48-246CFEA0C436} - C:\WINDOWS\oprevgkx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1658DABA-FC4C-46C6-BC48-246CFEA0C436}]
  • O3 - Toolbar: The bonsws - {3FDA21ED-312C-44DD-9030-A2DC90FD1CCD} - C:\WINDOWS\bonsws.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{3FDA21ED-312C-44DD-9030-A2DC90FD1CCD}"=-
  • %WINDOWS%\oprevnpx.dll
  • O2 - BHO: MSVPS System - {F675EED8-4A4B-4A11-801B-08297749B83D} - C:\WINDOWS\oprevnpx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F675EED8-4A4B-4A11-801B-08297749B83D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F675EED8-4A4B-4A11-801B-08297749B83D}]
  • O3 - Toolbar: The bonsws - {05E9894E-9C5F-454B-A6E1-7BEF518EC87E} - C:\WINDOWS\bonsws.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{05E9894E-9C5F-454B-A6E1-7BEF518EC87E}"=-
  • %WINDOWS%\ddkret.dll
  • O21 - SSODL: ddkret - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ddkret.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "ddkret"=-
  • %WINDOWS%\nopctrl.dll
  • O21 - SSODL: nopctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\nopctrl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "nopctrl"=-
  • %WINDOWS%\sawkip.exe
  • %WINDOWS%\jokwmp.dll
  • O3 - Toolbar: The jokwmp - {6BA27973-068D-4F85-BE84-1251E0B20FD3} - C:\WINDOWS\jokwmp.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BA27973-068D-4F85-BE84-1251E0B20FD3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{6BA27973-068D-4F85-BE84-1251E0B20FD3}"=-
  • %WINDOWS%\popnetmtq.dll
  • O2 - BHO: MSVPS System - {6A78E352-B1FA-4C18-9C48-96DD03979770} - C:\WINDOWS\popnetmtq.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A78E352-B1FA-4C18-9C48-96DD03979770}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A78E352-B1FA-4C18-9C48-96DD03979770}]
  • %WINDOWS%\rmvgor.dll
  • O21 - SSODL: rmvgor - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\rmvgor.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "rmvgor"=-
  • %WINDOWS%\sapnet.dll
  • O21 - SSODL: sapnet - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\sapnet.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "sapnet"=-
  • O3 - Toolbar: The jokwmp - {AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34} - C:\WINDOWS\jokwmp.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34}"=-
  • %WINDOWS%\popnetkqw.dll
  • O2 - BHO: MSVPS System - {A4D00A75-F69A-49FD-9058-AB925712CCFF} - C:\WINDOWS\popnetkqw.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4D00A75-F69A-49FD-9058-AB925712CCFF}]
  • %WINDOWS%\popnetnlf.dll
  • O2 - BHO: MSVPS System - {AEAAD087-D66D-4FA3-A366-8F47C32E9E5F} - C:\WINDOWS\popnetnlf.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEAAD087-D66D-4FA3-A366-8F47C32E9E5F}]



Muutokset v2.253 - v2.254

  • %SYSTEM%\PowerVideo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PowerVideo.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F627A939-3F63-42E2-B77B-F733CB2439C9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FADC335E-6A47-47EF-97B8-704C72D1E725}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerVideo.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{741403DD-46A4-4D58-8FA7-427335C3BBF6}]
  • O2 - BHO: (no name) - {23B760D6-C98B-450B-9B32-26C7775CDF83} - C:\Program Files\Video Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23B760D6-C98B-450B-9B32-26C7775CDF83}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{23B760D6-C98B-450B-9B32-26C7775CDF83}]
  • O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70CC76D5-A4EE-4F25-9931-B109A63E298E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{70CC76D5-A4EE-4F25-9931-B109A63E298E}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • {70CC76D5-A4EE-4F25-9931-B109A63E298E}=-
  • %SYSTEM%\bubbj.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{1817ab5d-25bf-4d5e-ba90-6e5fe658fc5f}"="exegeses"
  • %SYSTEM%\ijftc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{a6a36d4a-1a41-4d0e-adf2-e797f230c20a}"="bigfeet"
  • %SYSTEM%\fftktmk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}"="doglike"
  • %SYSTEM%\moywh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"="haeckel"
  • %SYSTEM%\ucmbegr.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d653e105-3e53-480a-b129-54d957d174bb}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d653e105-3e53-480a-b129-54d957d174bb}"="groutiest"
  • %SYSTEM%\rldyt.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0883848-1466-4470-a418-3fe7d36694b9}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b0883848-1466-4470-a418-3fe7d36694b9}"="bemocked"



Muutokset v2.252 - v2.253

  • %ProgramFiles%\RichVideoCodec
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtect 3.8.lnk
  • %STARTMENU%\VirusProtect 3.8.lnk
  • %STARTMENU%\Programs\VirusProtect 3.8\
  • %DESKTOP%\VirusProtect 3.8.lnk
  • %PROGRAMFILES%\VirusProtect 3.8\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21688E5D-A895-4B60-B127-B76607420334}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{40E563B2-61B2-4215-819A-A7E24CF8AA3E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45FBEFBF-E8B6-44A5-B0A1-A143E1A74816}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5146B43E-B36D-4A2A-B617-CC05CC500150}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B8BED0F-5F18-4051-9908-C5C569A1AAE9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63667718-EBF2-4CAB-B1E8-994D41589C24}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{972F0BE3-976F-40B8-8EB4-88A25987416E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F80EA2D-53CF-4AA5-A154-F4FBF1EF6A5A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A35F8FAC-755D-4F90-A5D3-F7E18D9EB100}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C269F4C1-7558-4DFC-9FB6-4C149B482586}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CE92A296-3142-493C-B64E-6ED73EAFB9AE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7C0DF6C-91FF-48BD-AD98-E35769394138}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8EC2704-B249-4495-A7A4-A90857BDDF4D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D91E9F36-9E44-44AB-803C-0D941FDA7988}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0757BDD-69BE-4C3F-AFC6-50D6524FA9B6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2F8C877-B06C-4B5E-95E7-AACFC9E8219D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3B8E549E-0C73-4AAB-8939-5EA2ED102CC6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtect 3.8.exe 3.8]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtect 3.8]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtect 3.8]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusProtect 3.8"=-



Muutokset v2.250 - v2.252

  • %SYSTEM%\VideoMP3.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\VideoMP3.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64130BE8-2B67-4A65-9CA5-1CC6948C1471}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4E54D728-1FA3-4125-B468-C8B43C123E65}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoMP3.MP3]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F}]
  • %SYSTEM%\fnczfh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6fddce1-36ae-41c1-87d3-f49e514273d4}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{a6fddce1-36ae-41c1-87d3-f49e514273d4}"="citrinous"
  • %SYSTEM%\xovdzz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1977ce08-a38f-43db-a856-f4aa6122131b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{1977ce08-a38f-43db-a856-f4aa6122131b}"="bothrops"
  • %SYSTEM%\vtewupi.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{831b4681-6ab9-436c-b2f1-6139158e3a91}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{831b4681-6ab9-436c-b2f1-6139158e3a91}"="eulalia"
  • %WINDOWS%\qdertu.exe
  • %WINDOWS%\ipwypkmg.dll
  • O2 - BHO: MSVPS System - {7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2} - C:\WINDOWS\ipwypkmg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19A236AD-F37B-40A8-A11A-7E9ABFD56CB0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8955B427-6C0C-413E-A0A7-0DC2948ADA3D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE1A8EBF-5AC3-488E-8226-F38C167B6C5F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E1C6E3E-FD4E-42C8-B60B-5EC7D23728D2}]
  • %WINDOWS%\bonrep.dll (Already removed)
  • O3 - Toolbar: The bonrep - {2357FC16-D8FC-4BF6-AFCA-573F9BD52644}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2357FC16-D8FC-4BF6-AFCA-573F9BD52644}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0E1B3BA-3D8E-456B-BCC5-163B09308240}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F575BBB6-A0A5-42C1-8406-CEDC8579FD75}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7586FC82-2EF8-4731-BAE1-22607AC0CC4A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E317C0F8-81DD-4AE8-87C7-B575A64B3696}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02A78E77-525D-4AF0-A822-CD04678CD638}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B141181-E967-42FD-AD64-52F283E12AAB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7B0446D3-68BB-4A03-B907-EEE372655460}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichVideoCodec]
  • %WINDOWS%\advrepkon.dll
  • O2 - BHO: MSVPS System - {6BE306E6-555D-41B1-98FF-6453622F4F4B} - C:\WINDOWS\advrepkon.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6BE306E6-555D-41B1-98FF-6453622F4F4B}]
  • %WINDOWS%\advrepgds.dll
  • O2 - BHO: MSVPS System - {FC91E698-C4BA-4564-9B85-659E38FCE154} - C:\WINDOWS\advrepgds.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC91E698-C4BA-4564-9B85-659E38FCE154}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC91E698-C4BA-4564-9B85-659E38FCE154}]
  • %WINDOWS%\ipwypwpk.dll
  • O2 - BHO: MSVPS System - {1BD6031F-BD9B-4DDF-A164-1D3A6701F374} - C:\WINDOWS\ipwypwpk.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1BD6031F-BD9B-4DDF-A164-1D3A6701F374}]



Muutokset v2.249 - v2.250

  • O2 - BHO: (no name) - {D1BD315B-8706-4C47-B443-A0784865CD04} - C:\Program Files\Video Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1BD315B-8706-4C47-B443-A0784865CD04}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1BD315B-8706-4C47-B443-A0784865CD04}]
  • %WINDOWS%\advreprwd.dll
  • O2 - BHO: MSVPS System - {7A22D62B-562F-4D55-8B1E-3AAA6C2BA688} - C:\WINDOWS\advreprwd.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A22D62B-562F-4D55-8B1E-3AAA6C2BA688}]
  • %WINDOWS%\advrepvto.dll
  • O2 - BHO: MSVPS System - {E6E59F48-7BF8-4BEE-B906-273526C25DA4} - C:\WINDOWS\advrepvto.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E6E59F48-7BF8-4BEE-B906-273526C25DA4}]
  • %WINDOWS%\movctrlknq.dll
  • O2 - BHO: MSVPS System - {AC546B33-036A-41DA-B1CC-C1D15659520E} - C:\WINDOWS\movctrlknq.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC546B33-036A-41DA-B1CC-C1D15659520E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AC546B33-036A-41DA-B1CC-C1D15659520E}]
  • %WINDOWS%\ipwypktx.dll
  • O2 - BHO: MSVPS System - {9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E} - C:\WINDOWS\ipwypktx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F2EA14C-CC8D-4EC6-B8F9-90760A3DAF9E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27B9F7C0-3728-48DB-BEEE-FA1279B7E62C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC9A032C-651A-41C7-AA02-781AF6F0B132}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FB301567-C982-4C81-A21A-BDAF829299D0}]
  • %WINDOWS%\bonrep.dll
  • O3 - Toolbar: The bonrep - {6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86B93136-309C-4763-8F63-DD95DA7D4A91}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bonrep.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{6BBD76F0-FDBB-4D2D-AD36-5C922F510AF5}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F3EEF4B8-F62A-471A-8565-48BDF3BFE163}]
  • %PROGRAMFILES%\VideoAccessCodec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55C68B1E-8FE7-46FE-8269-FBDE29BF6300}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B98015-F9F4-4B36-A9D8-EE9BCA7C2AC6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C14EEF3C-32F1-47DF-AFE1-ED8EEC9F0C0C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD2D9F83-5761-4291-B713-A2C5044DD722}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BCF3C064-B623-4934-A025-56F151FA3778}]
  • %WINDOWS%\neobus.dll
  • O21 - SSODL: neobus - {5D1C9A4F-438B-4C5C-BE66-FAAA08D4BF49} - C:\WINDOWS\neobus.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "neobus"=-
  • %WINDOWS%\kbdctrl.dll
  • O21 - SSODL: kbdctrl - {A3023D18-B93F-4892-B89B-56FB36382B8F} - C:\WINDOWS\kbdctrl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "kbdctrl"=-



Muutokset v2.248 - v2.249

  • %SYSTEM%\eulbn.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48a7a70a-e118-4506-a373-c9d4e8a212a1}\InProcServer32]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{48a7a70a-e118-4506-a373-c9d4e8a212a1}"="arturo"
  • %WINDOWS%\advrepnok.dll
  • O2 - BHO: MSVPS System - {CFF8726A-9262-441C-8163-C6371E9EDE47} - C:\WINDOWS\advrepnok.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF8726A-9262-441C-8163-C6371E9EDE47}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFF8726A-9262-441C-8163-C6371E9EDE47}]
  • %SYSTEM%\mp3avi.dll
  • O2 - BHO: Mp3 Video - {D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF} - C:\WINDOWS\system32\mp3avi.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\mp3avi.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mp3avi.MP3]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF}]



Muutokset v2.247 - v2.248

  • %SYSTEM%\bqrcr.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2dcea392-ea10-4e6d-aba4-329ac377119c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{2dcea392-ea10-4e6d-aba4-329ac377119c}"="brachypyramid"
  • %PROGRAMFILES%\EZVideo\
  • %STARTMENU%\Programs\EZVideo\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EZVideo]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EZVideo]
  • [-HKEY_CURRENT_USER\Software\EZVideo]
  • %SYSTEM%\a3gpcodec.dll
  • O2 - BHO: 3GP - {5D67E2E7-0C2B-4491-87C4-37F2AC6033D2} - C:\WINDOWS\system32\a3gpcodec.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\a3gpcodec.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\a3gpcodec.a3GP]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D67E2E7-0C2B-4491-87C4-37F2AC6033D2}]
  • %DESKTOP%\IE Defender 2.3.lnk
  • %STARTMENU%\Programs\IE Defender 2.3.lnk
  • %PROGRAMFILES%\IE Defender
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Defender]
  • [-HKEY_CURRENT_USER\Software\IEDefender]



Muutokset v2.246 - v2.247

  • Update, due to legit software (XunLei, a Chinese downloader) , using the same CLSID as the infection, this one is not removed anymore:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]
  • %SYSTEM%\dx50codec.dll
  • O2 - BHO: RealMedia - {87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95} - C:\WINDOWS\system32\dx50codec.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\dx50codec.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dx50codec.RealMedia]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95}]
  • %SYSTEM%\yneid.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41591d7f-9e25-4bd0-af53-9908fcf3a738}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{41591d7f-9e25-4bd0-af53-9908fcf3a738}"="complacential"
  • %PROGRAMFILES%\Image Add-on\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image Add-on]
  • O2 - BHO: (no name) - {43BF8E0C-886D-4103-8DDB-2DFE0E8A0168} - C:\Program Files\Image Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43BF8E0C-886D-4103-8DDB-2DFE0E8A0168}]
  • %WINDOWS%\bndsrpfn.dll
  • %WINDOWS%\advrepdow.dll
  • O2 - BHO: MSVPS System - {CF368FC4-3241-409B-B1D6-0EA4FE33A555} - C:\WINDOWS\advrepdow.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CF368FC4-3241-409B-B1D6-0EA4FE33A555}]
  • %WINDOWS%\advrepgpd.dll
  • O2 - BHO: MSVPS System - {93205C3F-1221-43F4-847F-007C6A4CE9A5} - C:\WINDOWS\advrepgpd.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93205C3F-1221-43F4-847F-007C6A4CE9A5}]
  • %WINDOWS%\sdrmod.dll
  • O3 - Toolbar: The sdrmod - {210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{210F79EC-C4B8-4AD5-B5B7-2B228F4376E9}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\sdrmod.ToolBar.1]
  • %WINDOWS%\hupsrv.dll
  • O21 - SSODL: hupsrv - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hupsrv.dll
  • %WINDOWS%\bindmod.dll
  • O21 - SSODL: bindmod - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bindmod.dll
  • %SYSTEM%\proper.exe
  • F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\proper.exe
  • %SYSTEM%\bronto.dll
  • O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\System32\bronto.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D27987B8-7244-4DE0-AE10-39B826B492F1}]
  • %SYSTEM%\winter.exe
  • O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe
  • O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\System32\winter.exe
  • %USERPROFILE%\StartMenu\Program\Startup\infos.exe
  • O4 - Startup: infos.exe
  • %AllUsers%\StartMenu\Program\Startup\autos.exe
  • O4 - Global Startup: autos.exe
  • %SYSTEM%\skuns.dat
  • O20 - AppInit_DLLs: C:\WINDOWS\System32\skuns.dat



Muutokset v2.245 - v2.246

  • %SYSTEM%\XunLeiBHO_Now.dll
  • O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\WINDOWS\system32\XunLeiBHO_Now.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\XunLeiBHO_Now.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{0EEDB911-C5FA-486F-8334-57288578C627}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EEDB911-C5FA-486F-8334-57288578C627}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xunleiBHO_Now.XunLei]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EEDB911-C5FA-486F-8334-57288578C627}]



Muutokset v2.244 - v2.245

  • %WINDIR%\movctrlqtn.dll
  • O2 - BHO: MSVPS System - {24038BE3-4EF2-41E2-A603-4CE3BDD9E874} - C:\WINDOWS\movctrlqtn.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24038BE3-4EF2-41E2-A603-4CE3BDD9E874}]
  • O3 - Toolbar: The nssfrch - {1699137C-B90E-4488-97BC-575C896C2B5C} - C:\WINDOWS\nssfrch.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1699137C-B90E-4488-97BC-575C896C2B5C}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{1699137C-B90E-4488-97BC-575C896C2B5C}"=-
  • %WINDIR%\movctrlnkd.dll
  • O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{077F45D5-5CC9-4FC8-A7BB-9D79836A6066}]
  • O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD}"=-
  • %WINDIR%\movctrlwxq.dll
  • O2 - BHO: MSVPS System - {90CF5384-7C70-4CD6-A30D-B2F14537B5C3} - C:\WINDOWS\movctrlwxq.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90CF5384-7C70-4CD6-A30D-B2F14537B5C3}]
  • O3 - Toolbar: The nssfrch - {7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC} - C:\WINDOWS\nssfrch.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{7D61C1B5-86AF-439F-9ACF-D19FDB5F55CC}"=-



Muutokset v2.243 - v2.244

  • %SYSTEM%\IntelVideo.dll
  • %SYSTEM%\sysinit32.exe
  • O2 - BHO: IntelVideoCodec - {04F7FAC5-F506-4F29-9094-9CB9144B192C} - C:\WINDOWS\system32\IntelVideo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IntelVideo.dll]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8388594E-D5C0-4933-A977-867D32D8FF19}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAEDDCA3-3989-4FF4-A773-3AC188C70A16}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IntelVideo.IntelVideoCodec]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04F7FAC5-F506-4F29-9094-9CB9144B192C}]



Muutokset v2.241 - v2.242

  • %PROGRAMFILES%\Video Add-on\
  • %PROGRAMFILES%\Video Add-on Setup\
  • O3 - Toolbar: IE Custom Tools - {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16} - C:\Program Files\Video Add-on\ictmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16}=-
  • O3 - Toolbar: IE Custom Tools - {062F3F8B-CB94-4D76-A98A-EF800A438F01} - C:\Program Files\Video Add-on\ictmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{062F3F8B-CB94-4D76-A98A-EF800A438F01}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{062F3F8B-CB94-4D76-A98A-EF800A438F01}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • {062F3F8B-CB94-4D76-A98A-EF800A438F01}=-
  • O3 - Toolbar: IE Custom Tools - {23ED2206-856D-461A-BBCF-1C2466AC5AE3} - C:\Program Files\Video Add-on\ictmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23ED2206-856D-461A-BBCF-1C2466AC5AE3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{23ED2206-856D-461A-BBCF-1C2466AC5AE3}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • {23ED2206-856D-461A-BBCF-1C2466AC5AE3}=-
  • O2 - BHO: (no name) - {B499D34E-58EF-4927-AB9F-7AF52B2C4C82} - C:\Program Files\Online Video Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B499D34E-58EF-4927-AB9F-7AF52B2C4C82}]
  • %SYSTEM%\ugbtna.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{75a65a53-15c9-4a0c-bb40-a7ca8b24f544}"="boardwalk"
  • %WINDIR%\bndsrfst.dll
  • %WINDIR%\bndsrsvk.dll
  • %WINDIR%\bndsrdkq.dll
  • %WINDIR%\bndsrgxt.dll
  • %WINDIR%\bndsrkwm.dll
  • %WINDIR%\bndsrtvd.dll
  • %WINDIR%\bndsrvnl.dll
  • %WINDIR%\bndsrwlq.dll
  • %WINDIR%\movctrlswd.dll
  • %WINDIR%\movctrlfqd.dll
  • %WINDIR%\ntspknlg.dll
  • %WINDIR%\ntspklqs.dll
  • %WINDIR%\ntspkfnd.dll
  • O2 - BHO: MSVPS System - {15272B08-F6FE-4E71-B2BD-A59AD23EBE3C} - C:\WINDOWS\bndsrfst.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15272B08-F6FE-4E71-B2BD-A59AD23EBE3C}]
  • O2 - BHO: MSVPS System - {05F79890-CFA6-4D53-87BC-2F390DA6645E} - C:\WINDOWS\bndsrsvk.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05F79890-CFA6-4D53-87BC-2F390DA6645E}]
  • O2 - BHO: MSVPS System - {480598DD-AE28-48B7-82F7-6ADDA1AA6B66} - C:\WINDOWS\ntspknlg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{480598DD-AE28-48B7-82F7-6ADDA1AA6B66}]
  • O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64DE95E5-0A25-4DD9-A472-97BC1D419101}]
  • O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EB10F79-5E53-4F76-B146-409EFCDCB957}]
  • O3 - Toolbar: The netadv - {D1413F77-5B69-4562-84E1-78F997794E9D} - C:\WINDOWS\netadv.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1413F77-5B69-4562-84E1-78F997794E9D}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{D1413F77-5B69-4562-84E1-78F997794E9D}"=-
  • O3 - Toolbar: The netadv - {899B0EF2-E0BE-41BA-BB41-0ABFB232813C} - C:\WINDOWS\netadv.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{899B0EF2-E0BE-41BA-BB41-0ABFB232813C}"=-
  • %WINDOWS%\kthemup.exe
  • %WINDOWS%\nssfrch.dll
  • O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\nssfrch.ToolBar.1]
  • O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
  • O21 - SSODL: hostctrl - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hostctrl.dll
  • O21 - SSODL: hstsys - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\hstsys.dll
  • O21 - SSODL: bxsbang - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\bxsbang.dll
  • O21 - SSODL: ocgrep - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\ocgrep.dll



Muutokset v2.240 - v2.241

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusRay 3.8.lnk
  • %STARTMENU%\VirusRay 3.8.lnk
  • %STARTMENU%\Programs\VirusRay 3.8\
  • %DESKTOP%\VirusRay 3.8.lnk
  • %PROGRAMFILES%\VirusRay 3.8\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{97C6E0E9-1D24-48CA-11E7-DC22C5308ABA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D723C81-2C9F-44DD-8F94-A2D3A06845E9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41FC2EBD-79F5-4FE0-8558-708DCB7FE255}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45DB217B-965D-4917-A653-C2A871534B4C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48A95844-A761-4D96-8191-0913D493823E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60FD2747-818B-4242-A041-4C1209F3D3A6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{70F731FD-6C5F-4D46-A29C-6B97FABEF0D0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77F6ABAA-C14B-4E0C-975E-0CFFA568B0BE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78AA9209-DED5-4F37-93A0-89FBEE57E4FC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{869B656B-142E-47E6-B4F6-973D17E80BBF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89F84A04-F5EF-4F4A-AF97-7DA43DD0371F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F9C1393-41D7-4BE1-8752-098BC97514D2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9097FA96-8EFD-4D04-8024-C920AB56BBEA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACD5D550-4481-4F05-B6D8-A78566BD81D3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE096ECD-D62E-4B2D-BBA5-CBF9BFA4AB23}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DDA20808-84A0-48C3-902A-7E31FF47EA6B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9C4CBEB-7BDF-47FF-8EDF-D72B50BB50EF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1AE427B0-E3B7-4D2E-A6B9-36605B0F214E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusRay 3.8.exe 3.8]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRay 3.8]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusRay 3.8]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusRay 3.8"=-
  • %SYSTEM%\beahahl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb4c6870-721f-4989-9c90-8cbfa46d0298}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{eb4c6870-721f-4989-9c90-8cbfa46d0298}"="anomuran"
  • %SYSTEM%\dfrep.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab75cc7d-2751-4144-a278-5462d5a5884c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ab75cc7d-2751-4144-a278-5462d5a5884c}"="bokard"
  • %SYSTEM%\mxhfjy.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7999c5e2-b500-4ba5-8e9a-99639eca65fc}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{7999c5e2-b500-4ba5-8e9a-99639eca65fc}"="celtiberi"
  • %system%\gaaplp.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e0e6e3da-f3af-4fb4-9411-2cf92fdeefc2}"="forayer"
  • %SYSTEM%\nczupfw.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6d478c6-7961-4fe9-be4b-e621dd640112}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{a6d478c6-7961-4fe9-be4b-e621dd640112}"="benzaldoxime"
  • %SYSTEM%\clbrcek.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{12a8c4e6-06c8-4ab3-9274-a0cde148e3da}"="inquisitionist"
  • %SYSTEM%\siiyal.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1adb94e-0dc6-487c-b274-981bee6301a1}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e1adb94e-0dc6-487c-b274-981bee6301a1}"="armillifer"
  • %SYSTEM%\sttwrd.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{f0c5ef8b-f4bb-4612-9ea8-361fff3da3d5}"="designers"
  • %SYSTEM%\rrtrit.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ee6bd1ad-1992-4f2c-8ea2-edc6eee4548b}"="eurymus"



Muutokset v2.239 - v2.240

  • %WINDIR%\bndsrvqt.dll
  • %SYSTEM%\flirek.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34ec76b6-53c4-4686-822f-910c790683fb}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{34ec76b6-53c4-4686-822f-910c790683fb}"="evangeliarium"
  • %SYSTEM%\gdrtul.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a47e7ce0-263d-40aa-86bc-27c1f6433143}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{a47e7ce0-263d-40aa-86bc-27c1f6433143}"="chinned"
  • %SYSTEM%\hteogat.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02e155c1-202c-43a5-a212-58bb67d4341c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{02e155c1-202c-43a5-a212-58bb67d4341c}"="bearlike"



Muutokset v2.238 - v2.239

  • %SYSTEM%\fifzqip.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16be3225-e902-4d2a-ac98-aab162796927}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{16be3225-e902-4d2a-ac98-aab162796927}"="ataxics"
  • %SYSTEM%\hymww.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{79cdca21-5055-4cae-b609-e1685ef55cf7}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{79cdca21-5055-4cae-b609-e1685ef55cf7}"="hydria"
  • %SYSTEM%\veptlh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92050ffb-b796-4146-ae27-7e5e1d93b8a8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{92050ffb-b796-4146-ae27-7e5e1d93b8a8}"="endopsychic"
  • %PROGRAMFILES%\WinMsg\
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "sware"=-
  • "sclick"=-



Muutokset v2.237 - v2.238

  • O2 - BHO: (no name) - {CFE15135-C591-4000-A55E-A50E5F9F82BC} - C:\Program Files\Online Video Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFE15135-C591-4000-A55E-A50E5F9F82BC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFE15135-C591-4000-A55E-A50E5F9F82BC}]
  • %WINDIR%\bndsronw.dll
  • %WINDIR%\wsremover.exe
  • %WINDIR%\netadv.dll
  • O2 - BHO: MSVPS System - {3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A} - C:\WINDOWS\bndsronw.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}]
  • O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - netadv.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABF529BE-6245-465A-BBD4-238C4EAB0F0A}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{ABF529BE-6245-465A-BBD4-238C4EAB0F0A}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\netadv.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\netadv.ToolBar.1]



Muutokset v2.236 - v2.237

  • Update: WS2Fix v1.1



Muutokset v2.235 - v2.236

  • %WINDOWS%\svhjdsah.exe
  • %WINDOWS%\afxp.dll
  • %WINDOWS%\msvb.dll
  • %WINDOWS%\sysdx.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "msvb"=-
  • "sysdx"=-
  • %PROGRAMFILES%\Online Add-on\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Add-on]



Muutokset v2.234 - v2.235

  • %WINDIR%\exploeee.exe
  • %SYSTEM%\explore.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "DoNotDelete"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "DoNotDelete"=-
  • O4 - Startup: info.exe
  • O4 - Global Startup: info.exe
  • O20 - AppInit_DLLs: C:\WINDOWS\System32\sulimo.dat
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\sulimo.dat"
  • %SYSTEM%\mvwqn.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0f691d7-01bf-4fed-926c-7368034a45e3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e0f691d7-01bf-4fed-926c-7368034a45e3}"="barbican"
  • O2 - BHO: MSVPS System - {ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1} - C:\WINDOWS\div32.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1}]



Muutokset v2.233 - v2.234

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirGear 3.8.lnk
  • %STARTMENU%\AntiVirGear 3.8.lnk
  • %STARTMENU%\Programs\AntiVirGear 3.8\
  • %DESKTOP%\AntiVirGear 3.8.lnk
  • %PROGRAMFILES%\AntiVirGear 3.8\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BC3AC5B-3BBB-9DBE-8166-EC650E3B9B48}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A0FC1A4-41D4-4793-9AC5-0B55CDC95AE9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14F47CA3-2291-4B3E-9ED4-8C7E6AE80851}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2447284F-3590-4E8C-A869-049BD87CAD07}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38EEEF46-CA24-4ACA-A90D-540978DF7252}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D5E5AE1-5DED-4520-BDC2-B9292EA708CA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{409A05EF-1B48-4198-B6BF-993B8B52790C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{47A93011-1004-440C-9960-BD3B0348A7C2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50B388D5-4A80-4191-8BCC-5DD031D7F3EE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58A1ACE6-0DBA-45D2-8154-E8253A7B87BB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73D25394-992F-43D1-BF92-48494CC0D1AE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D2A83A4-0687-4704-937E-A29045826F77}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7FE54B2-B167-4017-BCCC-CF73B2F678E3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C183B073-2D7F-45BC-8967-80147CECEE45}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F6FDBF9A-19A7-4F0A-9F46-6F015A067B44}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F90A7969-20A0-4257-B39D-9C73D64CE3B0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA38F299-57F8-4FEB-9096-715460AE943C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DE6AE29A-EB7D-4656-9418-26D5FCC9ADF5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirGear 3.8.exe 3.8]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirGear 3.8]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVirGear 3.8]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiVirGear 3.8"=-
  • %SYSTEM%\vzfhprk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95dde900-8bf3-428c-b9be-8345c9d194f7}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{95dde900-8bf3-428c-b9be-8345c9d194f7}"="homeridae"
  • O2 - BHO: MSVPS System - {0D5227BF-0C5B-4EA8-833C-FE09F1496F39} - C:\Windows\div32.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D5227BF-0C5B-4EA8-833C-FE09F1496F39}]



Muutokset v2.231 - v2.233

  • Added: WS2Fix.exe
  • %SYSTEM%\laf1.dll
  • %SYSTEM%\laf1.ini
  • %SYSTEM%\laf2.dll
  • %SYSTEM%\laf2.ini
  • %SYSTEM%\laf3.dll
  • %SYSTEM%\laf3.ini
  • %SYSTEM%\laf4.dll
  • %SYSTEM%\laf4.ini
  • %SYSTEM%\laf5.dll
  • %SYSTEM%\laf5.ini
  • %PROGRAMFILES%\Online Video Add-on\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Video Add-on] (C:\Program Files\Online Video Add-on\uninst.exe)
  • O3 - Toolbar: IE Custom Tools - {41F6170D-6AF8-4188-8D92-9DDAB3C71A78} - C:\Program Files\Online Video Add-on\ictmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{41F6170D-6AF8-4188-8D92-9DDAB3C71A78}"=-
  • [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  • {41F6170D-6AF8-4188-8D92-9DDAB3C71A78}=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Custom Tools]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Safety Features]
  • %SYSTEM%\ieffse32.dll
  • %SYSTEM%\regmod.exe
  • O2 - BHO: ieffse32.msdn_hlp - {C1C6426B-FB16-4123-ACBE-74D94FB0E663} - C:\WINDOWS\System32\ieffse32.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1C6426B-FB16-4123-ACBE-74D94FB0E663}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ieffse32.msdn_hlp]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1C6426B-FB16-4123-ACBE-74D94FB0E663}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\yggyfnhb]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
  • "some"=-
  • "start"=-
  • %SYSTEM%\swqzdtj.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{adf64b1b-c68c-4ce8-bb55-258b7b8b0f81}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{adf64b1b-c68c-4ce8-bb55-258b7b8b0f81}"="aldoa"
  • %SYSTEM%\vusxqm.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5feba593-3e6d-4606-ae6e-0680501cd29e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{5feba593-3e6d-4606-ae6e-0680501cd29e}"="cacomixls"



Muutokset v2.230 - v2.231

  • O2 - BHO: (no name) - {D579A683-0CC7-4023-BAE7-0544D0D1DA3A} - C:\Program Files\Online Video Add-on\isfmdl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D579A683-0CC7-4023-BAE7-0544D0D1DA3A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D579A683-0CC7-4023-BAE7-0544D0D1DA3A}]
  • %WINDOWS%\mscore.dll
  • %WINDOWS%\drvsvp.dll
  • %WINDOWS%\msmduo.dll
  • %WINDOWS%\msmduo2.dll
  • %WINDOWS%\div32.dll
  • %WINDOWS%\mssql.dll
  • %WINDOWS%\syscore.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{428FA4A4-C8EC-427C-85DE-11C80F67893A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{428FA4A4-C8EC-427C-85DE-11C80F67893A}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "drvsvp"=-
  • "msmduo"=-
  • "msmduo2"=-
  • "mssql"=-
  • "syscore"=-



Muutokset v2.229 - v2.230

  • %PROGRAMFILES%\Online Image Add-on\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\imageactivexobject.Chl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Online Image Add-on] (C:\Program Files\Online Image Add-on\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Online Add-on]
  • %SYSTEM%\jrpkmgh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60dea04c-9817-4309-bfa2-f8a1766c3cd1}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{60dea04c-9817-4309-bfa2-f8a1766c3cd1}"="haruspicy"



Muutokset v2.227 - v2.229

  • Minor Bug correction in path retriever on French SP2 OS.
  • O2 - BHO: MSVPS System - {31CBB13B-244D-4C44-AED5-DCAD70F66281} - C:\WINDOWS\nsduo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CBB13B-244D-4C44-AED5-DCAD70F66281}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31CBB13B-244D-4C44-AED5-DCAD70F66281}]
  • [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  • "DisableRegedit"=-
  • O20 - AppInit_DLLs: C:\WINDOWS\System32\stdole32.dat
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\stdole32.dat"
  • %SYSTEM%\pluwue.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"
  • %SYSTEM%\zdhgsp.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc25189b-1b13-4abe-900e-65e08bd961af}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{cc25189b-1b13-4abe-900e-65e08bd961af}"="escalators"
  • %SYSTEM%\fwjgtk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6747456b-cea8-463d-ad2a-50d67ae73d30}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{6747456b-cea8-463d-ad2a-50d67ae73d30}"="cakewalks"



Muutokset v2.226 - v2.227

  • %SYSTEM%\lgaac.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{655560a9-3ca8-4509-9632-6abbef21426b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{655560a9-3ca8-4509-9632-6abbef21426b}"="andropogon"
  • %SYSTEM%\iheuv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27882a9f-8937-4ae4-87ab-ed669c8b6d7a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{27882a9f-8937-4ae4-87ab-ed669c8b6d7a}"="bund"
  • O2 - BHO: MSVPS System - {60D3EC53-56A8-46A8-9D01-1AB64410665C} - C:\WINDOWS\nsduo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60D3EC53-56A8-46A8-9D01-1AB64410665C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60D3EC53-56A8-46A8-9D01-1AB64410665C}]



Muutokset v2.225 - v2.226

  • %SYSTEM%\vmlwp.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4c4bc43-0974-4dec-a669-9f7bfcb3503d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d4c4bc43-0974-4dec-a669-9f7bfcb3503d}"="coexpire"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirGear 3.7.lnk
  • %STARTMENU%\AntiVirGear 3.7.lnk
  • %STARTMENU%\Programs\AntiVirGear 3.7\
  • %DESKTOP%\AntiVirGear 3.7.lnk
  • %PROGRAMFILES%\AntiVirGear 3.7\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BC3AC5B-3BBB-9DBE-8166-EC650E3B9B48}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{418985AE-4FE4-448D-83EE-238C887D8FC2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F251303-F8C4-44C3-A7C2-9E8A93C59322}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61840430-C7CF-43A0-9D49-3B3ED563FED1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64A8E3CA-AE17-4EB0-8C67-47D1103A5B6F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{765A8F7D-F57B-4601-A038-3F463A4D3193}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77E616D5-5DB4-4B6A-8BDA-2BE4103A9921}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8742F319-C916-4930-B781-1C148134C05C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{897F5CB6-C1C1-494E-8F17-972784193442}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2224C72-745E-4046-882F-1A48C9311D77}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA500EFC-3C92-44C9-B1D6-7A7033343A50}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB5E9971-7086-4E6E-ADFA-BE9C685BE68B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD7CA0BC-693A-4AF9-B31A-60472248F761}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2882CC2-0077-426B-916D-E0B9EA23A1B5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE241504-6F15-49E4-847F-B4D7DA9EA8F9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1666E4E-45C8-462A-97FF-BFD5A103BFFA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD9A05E8-4A1E-45E6-B3B6-37CE20140278}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AF0C5CBA-52E1-4B29-A2DC-58D91D599612}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVirGear 3.7.exe 3.7]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirGear 3.7] (C:\Program Files\AntiVirGear 3.7\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVirGear 3.7]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiVirGear 3.7"=-



Muutokset v2.224 - v2.225

  • O2 - BHO: MSVPS System - {ACD85107-9CF9-4C9E-B0B7-39940A0017C0} - C:\WINDOWS\nsduo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ACD85107-9CF9-4C9E-B0B7-39940A0017C0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ACD85107-9CF9-4C9E-B0B7-39940A0017C0}]
  • %SYSTEM%\ddllup.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8ea5f37-7327-4923-9808-8fd3b6f0d529}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b8ea5f37-7327-4923-9808-8fd3b6f0d529}"="beers"
  • %PROGRAMFILES%\DirectAccess\
  • %STARTMENU%\Programs\DirectAccess\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DirectAccess]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectAccess] (C:\Program Files\DirectAccess\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\DirectAccess]



Muutokset v2.223 - v2.224

  • %SYSTEM%\vvihh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b36d60c8-e1ce-464e-b74c-8128a627ef56}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b36d60c8-e1ce-464e-b74c-8128a627ef56}"="hyracina"
  • O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C3C4699-B285-475F-BE47-0B26088CE876}]
  • O2 - BHO: MSVPS System - {3CB70CC2-303F-4A6C-824D-013AE8CFDB6B} - C:\WINDOWS\nsduo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CB70CC2-303F-4A6C-824D-013AE8CFDB6B}



Muutokset v2.222 - v2.223

  • O2 - BHO: MSVPS System - {695A94FD-15D0-4ED7-8F40-D2B3BDC42C15} - C:\WINDOWS\nsduo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{695A94FD-15D0-4ED7-8F40-D2B3BDC42C15}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{695A94FD-15D0-4ED7-8F40-D2B3BDC42C15}
  • %SYSTEM%\iklqcx.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{de5ede53-9db0-422d-b32d-5c41c96d6f52}"="heterotroph"
  • %SYSTEM%\kzpkwj.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f39d0dee-b2f0-4591-9187-1cc39c1df98a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{f39d0dee-b2f0-4591-9187-1cc39c1df98a}"="biisk"
  • %SYSTEM%\ddomv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9f5cb985-d4a4-49af-9185-133f956b5756}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9f5cb985-d4a4-49af-9185-133f956b5756}"="anthracosaurus"
  • %SYSTEM%\gkymhk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{903902a8-0691-460e-8351-24df3d425e9c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{903902a8-0691-460e-8351-24df3d425e9c}"="apdu"
  • %SYSTEM%\ayjhc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}"="cordiformis"
  • %SYSTEM%\osdjhjc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}"="disenfranchising"



Muutokset v2.221 - v2.222

  • %SYSTEM%\systems.txt
  • O20 - AppInit_DLLs: C:\WINDOWS\System32\systems.txt
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\systems.txt"



Muutokset v2.219 - v2.221

  • Added: VCCLSID.exe tool.
  • Removes ShellServiceObjectDelayLoad LeftOvers random CLSID (newmediacodec/videoaccesscodec infections):
  • O21 - SSODL: msmdev - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\msmdev.dll
  • O21 - SSODL: msmhost - {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} - C:\WINDOWS\msmhost.dll
  • %WINDOWS%\nsduo.dll
  • %WINDOWS%\msmdev.dll
  • %WINDOWS%\msmhost.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "msmdev"=-
  • "msmhost"=-
  • %SYSTEM%\muvdjo.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{46f5a8b0-0b73-48c5-9e40-3c443a43c161}"="aht"
  • %SYSTEM%\tqcwm.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bb2b2d6-8b86-412e-acca-d656a8979b3e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{2bb2b2d6-8b86-412e-acca-d656a8979b3e}"="fraternalism"



Muutokset v2.218 - v2.219

  • %STARTMENU%\Programs\StartUp\autorun.exe
  • %ALLUSERSTARTMENU%\Programs\Startup\findfast.exe
  • %WINDIR%\shell.exe
  • F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
  • [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • "Shell"="Explorer.exe C:\WINDOWS\shell.exe"
  • O4 - HKLM\..\Run: [Printer] C:\WINDOWS\System32\printer.exe
  • [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Printer"=-
  • %SYSTEM%\spoolvs.exe
  • O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\System32\spoolvs.exe
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
  • "Spoolsv"=-
  • %SYSTEM%\fyhwfc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}"="biltongs"



Muutokset v2.217 - v2.218

  • %SYSTEM%\guxmhcd.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fedff4ae-1302-4b8a-bda9-43b9f67b9749}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fedff4ae-1302-4b8a-bda9-43b9f67b9749}"="astronomically"
  • %SYSTEM%\kvfvw.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}"="glauke"
  • %SYSTEM%\hrum.txt
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\hrum.txt"
  • %FAVORITE%\Error Cleaner.url
  • %FAVORITE%\Privacy Protector.url
  • %FAVORITE%\Spyware&Malware Protection.url
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4CF814F-970F-405D-A42C-0CE06EB97373}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4CF814F-970F-405D-A42C-0CE06EB97373}]
  • O3 - Toolbar: Protection Bar - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - C:\Program Files\Video ActiveX Access\iesbpl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{F06E2ABE-3A50-4079-BE25-FC100D9EAA25}"=-



Muutokset v2.216 - v2.217

  • %SYSTEM%\mivmv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6625fc6c-731c-443a-b3f0-2c8c520a1766}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{6625fc6c-731c-443a-b3f0-2c8c520a1766}"="anhydrase"
  • %SYSTEM%\zdwii.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fdde73c-273e-4e55-84dc-455de06e4866}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{2fdde73c-273e-4e55-84dc-455de06e4866}"="amaretti"
  • %SYSTEM%\tiqmcx.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}"="athermancies"



Muutokset v2.215 - v2.216

  • %SYSTEM%\fwrkqfl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e886df7-914d-48f0-86b3-a5cf24385361}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{6e886df7-914d-48f0-86b3-a5cf24385361}"="falsism"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\hadjajr.ini"
  • %SYSTEM%\hadjajr.ini
  • %SYSTEM%\gopa.exe



Muutokset v2.213b - v2.215

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.7.lnk
  • %STARTMENU%\VirusProtectPro 3.7.lnk
  • %STARTMENU%\Programs\VirusProtectPro 3.7\
  • %DESKTOP%\VirusProtectPro 3.7.lnk
  • %PROGRAMFILES%\VirusProtectPro 3.7\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03F65A7B-6E49-4ACE-848B-4459DDBD3981}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15125718-D196-47C9-8FBF-9889C0C85D67}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21C40A12-3079-4A70-A715-8A44CE0DE829}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A3E745F-1EAE-441F-A5D5-E53C909CEEC1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F6A3DCF-D68F-4663-8C25-312BCDBE4D47}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48129B70-2F29-4DBA-A499-BEB1A1554E10}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{484E9A1B-C631-47F3-9BC0-F752CDAAFB9A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1886D5E-3508-4109-A8A0-F045AA86F3A3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2817460-5C53-4B41-8D01-D3EF255DD41E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AEEA2138-2168-449E-B995-B56612EEF65E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AEFD40BB-03E3-4C66-ABFB-B5720ACB833E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B9C7A624-88E3-4DFA-8D56-438B10BC0149}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D21FBDCE-EF01-417C-A1A1-C1EEDB8D5DB6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EBA2671E-29BF-42D8-B17E-AB5315CC73C5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F105F0C9-50E2-44FA-B3EC-92CA7BFE0C0D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F664EA90-9B91-4825-9B51-5635AC38CCA6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6D7F9517-F134-45E3-BF2E-73414FF15CA1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.7.exe 3.7]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.7] (C:\Program Files\VirusProtectPro 3.7\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.7]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusProtectPro 3.7"=-
  • %SYSTEM%\tmxxxh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70d17a5f-ef27-4295-90f5-20ad6f24834f}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{70d17a5f-ef27-4295-90f5-20ad6f24834f}"="dizening"
  • %SYSTEM%\ccyszwl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}"="arachnodacty"
  • %SYSTEM%\igzxwrl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18a8f76b-804b-4981-b87c-460699971a4b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{18a8f76b-804b-4981-b87c-460699971a4b}"="dataria"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\hrum323.txt"
  • Update: %SYSTEM%\vtr167.dll -> %SYSTEM%\vtr???.dll
  • O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr???.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABCDECF0-4B15-11D1-ABED-709549C10000}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ABCDECF0-4B15-11D1-ABED-709549C10000}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  • "AppInit_DLLs"="C:\WINDOWS\System32\hanonvt.ini"
  • %SYSTEM%\hanonvt.ini
  • %SYSTEM%\vtr167.dll



Muutokset v2.213 - v2.213b

  • Correction of a minor bug (missing caracter } ) in
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"=-



Muutokset v2.212 - v2.213

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{283A0EE3-2CC1-45AB-8207-B1D7B69C7F83}]
  • %SYSTEM%\ryxrho.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}"="archiblast"
  • %SYSTEM%\zkpssqa.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}"="bosken"



Muutokset v2.211 - v2.212

  • O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5DDE5591-A8AB-4897-93EF-1E4E943F85A7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5DDE5591-A8AB-4897-93EF-1E4E943F85A7}]
  • O3 - Toolbar: Protection Bar - {CC18AE76-7E65-4258-A193-9EA0C52DA6B8} - C:\Program Files\Image ActiveX Access\iesbpl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{CC18AE76-7E65-4258-A193-9EA0C52DA6B8}"=-
  • %SYSTEM%\vpccw.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e758745e-b8aa-47ac-a652-6307ff5f3ebf}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e758745e-b8aa-47ac-a652-6307ff5f3ebf}"="counterclaim"



Muutokset v2.210 - v2.211

  • %PROGRAMFILES%\Video iCodec\
  • %STARTMENU%\Programs\Video iCodec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Video iCodec]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video iCodec]
  • [-HKEY_CURRENT_USER\Software\Video iCodec]
  • %SYSTEM%\eigbbb.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4da240e-7525-404a-b366-f50a422376d8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{c4da240e-7525-404a-b366-f50a422376d8}"="arouse"
  • %SYSTEM%\nexpegp.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"="electroosmoses"
  • %SYSTEM%\xtsyynm.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4029063-4fe3-422c-ac72-12905c09642a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{a4029063-4fe3-422c-ac72-12905c09642a}"="clinker"
  • %SYSTEM%\fqdqs.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}"="heterostyly"
  • %PROGRAMFILES%\VideoAccessCodec\
  • %WINDOWS%\duocore.dll
  • %WINDOWS%\wmpenv.dll
  • %WINDOWS%\wmpconf.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoAccessCodec] (C:\Program Files\VideoAccessCodec\Uninstall.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VAC.Video]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo] (C:\WINDOWS\main_uninstaller.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoPlugin]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7AF59C20-A1D8-4C1C-927A-99DD9F2A9E0B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AF59C20-A1D8-4C1C-927A-99DD9F2A9E0B}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "wmpenv"=-
  • "wmpconf"=-



Muutokset v2.209 - v2.210

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.6.lnk
  • %STARTMENU%\VirusProtectPro 3.6.lnk
  • %STARTMENU%\Programs\VirusProtectPro 3.6\
  • %DESKTOP%\VirusProtectPro 3.6.lnk
  • %PROGRAMFILES%\VirusProtectPro 3.6\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A2C9DEF-83EB-4575-AD6C-2377FEFC5122}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{56943D7C-2283-4D73-B2B1-46173B4844B4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71C9109D-EB8D-49B9-9211-1CBE8A25A9AA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75F32B07-D45F-4D5B-9266-3863C65D5B29}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84037416-6A70-46E5-9216-CDCC7E2513E7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94E14C33-2473-4185-9FA0-3D881BDB5C0B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{95D963D7-86E3-434E-BFF6-FCDDEA5F9F24}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9DC10DE5-5104-4554-ACA0-D9F2D146CD4C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A140FE51-3136-4E0D-AFDA-1313B30ADFEF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B41DF4F9-0191-46E6-8107-16634FBC7F3C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE1C526E-CCCC-449C-A9CB-691B8C5E2769}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BE465556-F79D-476F-9457-74E49F8F400A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8DFA789-47D3-4197-B187-23AE2D7DCF6A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E0277D0D-43C7-4ECA-B8C4-545A2E71485B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA166DBF-EAC4-4D33-B48D-A40B8C8FDEC1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0ED2F90-DE03-46AD-97C1-709E5A49422C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{40331B9F-75E5-4E1E-B511-5AA6638B9ADE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.6.exe 3.6]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.6] (C:\Program Files\VirusProtectPro 3.6\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.6]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusProtectPro 3.6"=-
  • %SYSTEM%\vophqmn.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}\InProcServer32] (Already Removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e71aba09-d81a-4876-baa3-df133c1dfc48}"="helicoid" (Already Removed)
  • %SYSTEM%\fshqaln.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}] (Already Removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4a9e875b-d032-45e4-8294-789fe3be5b19}"="atrichia" (Already Removed)
  • %SYSTEM%\ktrxe.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}"="hemprich"



Muutokset v2.208 - v2.209

  • %SYSTEM%\gusur.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f5f16ef-af9d-4fe6-8410-f0670b58979d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4f5f16ef-af9d-4fe6-8410-f0670b58979d}"="exultet"
  • %SYSTEM%\khtbpdl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c82e1789-207a-4b8a-806f-76b62dfac2a2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{c82e1789-207a-4b8a-806f-76b62dfac2a2}"="hutlet"
  • %SYSTEM\afqgda.exe
  • %SYSTEM\printer.exe
  • %SYSTEM\WinAvX.exe
  • %SYSTEM%\WinAvXX.exe
  • %SYSTEM\atzrdada.dll
  • %STARTMENU%\Programs\StartUp\system.exe
  • %ALLUSERSTARTMENU%\Programs\Startup\autorun.exe
  • [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
  • "DisableRegistryTools"=0x00000001
  • "DisableTaskMgr"=0x00000001
  • [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "WinAVX"="C:\WINDOWS\System32\WinAvX.exe"
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  • "NoControlPanel"=0x00000001
  • "NoWindowsUpdate"=0x00000001
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
  • "WinAVX"="C:\WINDOWS\System32\WinAvX.exe"
  • [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  • "Shell"="Explorer.exe C:\WINDOWS\System32\printer.exe"



Muutokset v2.207 - v2.208

  • %SYSTEM%\zpuwriz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{547aaa89-7e6b-42b4-b112-a64955f86a2a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{547aaa89-7e6b-42b4-b112-a64955f86a2a}"="adirondack"
  • %SYSTEM%\tkrsw.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}"="clamourers"
  • %SYSTEM%\lrnjnzf.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4c46558-da01-4637-a85e-f1ccb1c7436a}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e4c46558-da01-4637-a85e-f1ccb1c7436a}"="hyams"
  • %SYSTEM%\afzdbl.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8068bf35-3711-4dce-a2f3-f008cecfe894}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8068bf35-3711-4dce-a2f3-f008cecfe894}"="araca"
  • %SYSTEM%\ugofuq.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c704547b-26c0-4222-a034-81653c07b494}] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{c704547b-26c0-4222-a034-81653c07b494}"="eperdument" (Already removed)
  • %SYSTEM%\gtawclv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e71aba09-d81a-4876-baa3-df133c1dfc48}"="enjoyment"
  • %SYSTEM%\vjxwnn.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd2948f8-c949-464f-824a-6272608c739e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{bd2948f8-c949-464f-824a-6272608c739e}"="criticalness"
  • %SYSTEM%\fdpzgi.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1c6fd4e6-49ce-4178-875b-df70eac260c5}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{1c6fd4e6-49ce-4178-875b-df70eac260c5}"="aguilarite"
  • O2 - BHO: (no name) - {34E6F97C-34E0-4CE5-B92B-F83634BEDC01} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01}]
  • %STARTMENU%\Programs\XXXAccess\
  • %PROGRAMFILES%\XXXAccess\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\XXXAccess]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XXXAccess] (C:\Program Files\XXXAccess\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\XXXAccess]



Muutokset v2.206 - v2.207

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Messenger Service]
  • O2 - BHO: (no name) - {D61D7E1A-6613-49CA-B6F9-51DB248E209D} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D61D7E1A-6613-49CA-B6F9-51DB248E209D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Security Plug-in]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Secure Bar]
  • %SYSTEM%\wzhtjqo.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}"="enlodgement"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.5.lnk
  • %STARTMENU%\VirusProtectPro 3.5.lnk
  • %STARTMENU%\Programs\VirusProtectPro 3.5\
  • %DESKTOP%\VirusProtectPro 3.5.lnk
  • %PROGRAMFILES%\VirusProtectPro 3.5\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00628C22-6886-439B-AA2E-3639367F02A0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14B512A9-25CF-4C90-AE5F-418689DF0A8D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{39D23F6A-E2DE-4F5D-9118-ECDFAAE47E9C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B334543-06C2-4B5F-B7CB-8028A4570B39}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E79A538-7998-4BB7-B8A7-0E12243D7A99}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{42348314-FC64-4B2E-B314-3F872C321B87}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58BD1E88-EFEE-404E-BE17-DF639B57CB56}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{64D947B2-5505-4347-80A5-E28EEBE38F2A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D3C0252-8850-440E-A386-4A0159C8A4DD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9B8BE22F-B2BB-472B-8959-C0828C0ADDC7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CD68722-9A43-42E4-BD01-2DE85D9CB565}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A8502478-83BC-48DB-9937-6EEB77CED41E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF1B7AB6-9715-472D-B469-74DE8D030EB6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEB46F7E-CF37-4E8F-BA48-D96F1A434224}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2315CDD-4F9A-4DDA-8671-252465FF0B5D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF442B5E-B5C0-4469-85C8-4B0B2A579EE9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CD3A8ECE-6016-469E-9964-C479F9157BCC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.5.exe 3.5]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.5] (C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.5]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]



Muutokset v2.205 - v2.206

  • %WINDOWS%\sconf32.dll
  • %WINDOWS%\wmplayer.dll
  • %WINDOWS%\wmsound.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C014816-5BD4-4166-85EA-62FE05E517C3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C014816-5BD4-4166-85EA-62FE05E517C3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "wmplayer"=-
  • "wmsound"=-
  • %SYSTEM%\psndz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa55d551-9698-48ac-b639-9b00cf1a6ea0}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fa55d551-9698-48ac-b639-9b00cf1a6ea0}"="grazable"
  • %SYSTEM%\cqsfk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cea2e5cd-e849-427b-80f0-59298caef1c4}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{cea2e5cd-e849-427b-80f0-59298caef1c4}"="convalescently"



Muutokset v2.204 - v2.205

  • %WINDOWS%\soundplugin.dll
  • %WINDOWS%\sounddrv.dll
  • %WINDOWS%\xvideo.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85E659D3-E110-4CE7-9D99-416FD61A1720}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85E659D3-E110-4CE7-9D99-416FD61A1720}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "sounddrv"=-
  • "xvideo"=-
  • %SYSTEM%\cefrjsh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1c16871-b797-4ec7-bbee-83852379c390}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{a1c16871-b797-4ec7-bbee-83852379c390}"="formicivora"
  • %SYSTEM%\onljweo.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}] (Already Removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{33b8d257-07f6-4c06-8605-94bc21728635}"="discommodiousness" (Already Removed)
  • %SYSTEM%\yhjbbzf.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f29a27-2451-4314-a480-8d2481ce6c81}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{49f29a27-2451-4314-a480-8d2481ce6c81}"="cyk"
  • %SYSTEM%\vgibz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4a9e875b-d032-45e4-8294-789fe3be5b19}"="dustuck"
  • %SYSTEM%\wpchz.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5889f7b0-3277-4266-b4bd-1bf2d394aee6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{5889f7b0-3277-4266-b4bd-1bf2d394aee6}"="hydronephrosises"



Muutokset v2.203 - v2.204

  • %SYSTEM%\surzzh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cfda6372-043c-48d2-ba3c-7bfe1cf71854}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{cfda6372-043c-48d2-ba3c-7bfe1cf71854}"="inscenation"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.4.lnk
  • %STARTMENU%\VirusProtectPro 3.4.lnk
  • %STARTMENU%\Programs\VirusProtectPro\ (Already Removed)
  • %DESKTOP%\VirusProtectPro 3.4.lnk
  • %PROGRAMFILES%\VirusProtectPro 3.4\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A8C61AE-9639-4E4D-AF61-25B0CE935EAB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0DF3EB27-E122-4E77-9481-D9332351B606}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BA582C8-6240-4DC4-BB8E-1B764134A47B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1F6BD5E9-CEBD-4EB8-94B5-9C4E9C219306}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DE68A1C-09C2-4724-BB80-CB5AAFB96D99}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{720B32BB-73D5-4551-B743-986224487121}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A238C6-F6A8-41D3-90FD-95F31F02FB33}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76C8C569-C4B8-4E0C-AE87-E1166D7FE005}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79E77B74-D820-4E39-802F-084F9DDCE038}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F7AFA67-ADC0-4227-B799-34F7800EBC96}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C254C9C5-DE04-49F1-9FC1-72EF4F7F1F6C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA91A4F1-3DC6-4D10-8AE3-8545E86D9DB8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0E42329-DCA9-4825-B87D-04B789BBB169}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D92E0D32-8D1B-4B8B-AF26-0676C5158ADA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E082EF71-40AF-4A4E-B036-BB773F450B53}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAB5EB70-E2F1-4ADA-B033-151A71B9AA3F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{795175C7-3F75-4F45-AB6C-4FFE32A85BCB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.4.exe 3.4]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.4] (C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.4]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusProtectPro 3.4"=-



Muutokset v2.202 - v2.203

  • O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E26CEADA-67B0-4543-BE8B-307F00265118}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E26CEADA-67B0-4543-BE8B-307F00265118}]
  • %SYSTEM%\wfcof.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}"="firstlings"
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F4DB301-0698-4AF4-A8A2-473996DF425A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F4DB301-0698-4AF4-A8A2-473996DF425A}]



Muutokset v2.201 - v2.202

  • %windir%\msddx.dll
  • %windir%\msqnx.dll
  • %windir%\qnxplugin.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4118A625-1B64-4ED1-A2E9-76DEC529D2D2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4118A625-1B64-4ED1-A2E9-76DEC529D2D2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "msddx"=-
  • "msqnx"=-
  • %SYSTEM%\drivers\svchost.exe
  • %USERPROFILE%\svchost.exe
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "autoload"=-
  • "autorun"=-
  • %SYSTEM%\myqlejy.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98ca7898-6029-41ab-8f67-ea4f5e1afc22}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{98ca7898-6029-41ab-8f67-ea4f5e1afc22}"="biocomputing"



Muutokset v2.200 - v2.201

  • %SYSTEM%\winntify.exe
  • [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winnotify]
  • [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winnotify]
  • O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{184746EC-9E9D-4C7D-B9E7-9039EBD801A9}]
  • %SYSTEM%\xnvaogd.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}"="coronally"
  • %SYSTEM%\lapmvzf.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fde1bd72-ca80-443f-9526-595337b73878}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fde1bd72-ca80-443f-9526-595337b73878}"="hieroglyphist"



Muutokset v2.199 - v2.200

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.3.lnk
  • %STARTMENU%\SpyLocked 4.3.lnk
  • %STARTMENU%\Programs\SpyLocked 4.3\
  • %DESKTOP%\SpyLocked 4.3.lnk
  • %PROGRAMFILES%\SpyLocked 4.3\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2BD02A28-2CE5-41E6-83DB-6763E671CB86}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D5D65CB-D4DE-46D9-985F-F80D9F34C979}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4249D82A-882F-467B-9AA3-DCC40078EA69}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FBE506D-6726-42B5-ADB0-0B56AF0AEFB7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54DA8FE1-16CC-4304-921D-88DD591884EA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6036EFF9-4750-435D-BA00-2E4971A17954}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67BFFC72-F133-4C2A-8C2C-EC9B46FFB80C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6B619BBA-1BB8-47F4-85B2-AEEE204AFE3A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8E02BA95-D9BC-4E9F-AE33-38DD988CC868}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{90B449E1-A378-4DBB-BAE6-4F5492B954C4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99D26682-D444-4106-B346-A31B25B315E4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A76871A-CBEB-479C-9984-253AEF6CB3E2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9B11649A-0DA6-4581-9A17-9DA31AD7FD42}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A7152573-FA25-4BEA-8026-1EC8A5205D11}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA7301E0-686C-4C7C-95B7-1B96D2ED1A61}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E831429A-73A3-44D4-8935-DEEC11216093}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A321A998-2771-4235-B458-6B09AF6463B5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.3.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.3] (C:\Program Files\SpyLocked 4.3\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.3]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked 4.3"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{100B21CD-3B97-44FB-B1C0-EA6249E482E8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100B21CD-3B97-44FB-B1C0-EA6249E482E8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XVideo]
  • %WINDOWS%\avp.exe
  • %WINDOWS%\mgrs.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "avp"=-
  • "smgr"=-



Muutokset v2.198 - v2.199

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusProtectPro 3.3.lnk
  • %STARTMENU%\VirusProtectPro 3.3.lnk
  • %STARTMENU%\Programs\VirusProtectPro\ (Already Removed)
  • %DESKTOP%\VirusProtectPro 3.3.lnk
  • %PROGRAMFILES%\VirusProtectPro 3.3\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D52BB09-465C-4AA4-9FBD-71D1690CAED3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{24998748-6E8A-40D1-AA97-E9952EE9ED18}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{287FFE0C-15D0-4BFD-BAA9-0582C6361BBB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{45973D31-5CE3-4503-BC81-25E525119C48}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46D4D563-1C43-4CEE-AF98-471385F2BC42}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5596A310-2E54-4B75-ADA3-7EE0AD10E228}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C17F7D3-8460-4488-84EB-986A38BEDD2D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{71DF187C-DC99-4A35-BDB2-C099821A435D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{74DF3F5E-99D7-4F4D-81C3-95201D4CDA88}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91478017-FF82-4C5D-9FFF-7801F8D99CCC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9F9C8CF3-EB4A-4851-A4F6-2370F5BC79EE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B1B9C911-CA24-4E1E-9F56-838486218327}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C78E49C0-AB82-4C79-A189-F1E34980643B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2A0598F-FBC4-4721-BC85-F75C0712C100}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7B2831E-A25A-430B-B3E3-3D414F9C4288}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EDC652FF-2EA2-4E46-8849-D9041B77B88E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{049FECE3-18C7-4023-A1BE-CFAA2C4EE387}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VirusProtectPro 3.3.exe 3.3]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusProtectPro 3.3] (C:\Program Files\VirusProtectPro 3.3\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\VirusProtectPro 3.3]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "VirusProtectPro 3.3"=-



Muutokset v2.196 - v2.197

  • %WINDOWS%\vpsnetwork.dll
  • %WINDOWS%\expro.dll
  • %WINDOWS%\vpssup.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1770FD6-A7CB-44DA-AD2C-692D2A2B521B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1770FD6-A7CB-44DA-AD2C-692D2A2B521B}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "expro"=-
  • "vpssup"=-



Muutokset v2.195 - v2.196

  • O2 - BHO: (no name) - {CDE8EAB9-CEF3-4885-B12F-26960A25C800} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDE8EAB9-CEF3-4885-B12F-26960A25C800}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDE8EAB9-CEF3-4885-B12F-26960A25C800}]
  • O2 - BHO: (no name) - {36ADA89D-2440-4DC4-820A-3A05E8630935} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{36ADA89D-2440-4DC4-820A-3A05E8630935}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{36ADA89D-2440-4DC4-820A-3A05E8630935}]
  • O3 - Toolbar: Protection Bar - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - C:\Program Files\Image ActiveX Access\iesbpl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00}"=-
  • %SYSTEM%\iauoi.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ff419a8-1748-4ca7-99df-d269465b0e8b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9ff419a8-1748-4ca7-99df-d269465b0e8b}"="cornerer"
  • %SYSTEM%\igpfced.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bbe40fd-0416-4c3f-80ea-0c7ad5fb1aab}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8bbe40fd-0416-4c3f-80ea-0c7ad5fb1aab}"="crawley"
  • %SYSTEM%\cdwvhbf.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3afa7405-68e8-4bdb-920e-0d506f552826}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{3afa7405-68e8-4bdb-920e-0d506f552826}"="concise"
  • %SYSTEM%\gbjkog.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41eaa909-24be-4d24-877f-076a0576a6fd}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{41eaa909-24be-4d24-877f-076a0576a6fd}"="castigating"
  • %SYSTEM%\tczij.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8aa7a4d2-73c7-4fca-bef7-7923e38a3b1c}"="farrandly"
  • %SYSTEM%\iwwvh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9c0c879c-9091-45d1-807f-2adc37d7d6d6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9c0c879c-9091-45d1-807f-2adc37d7d6d6}"="breadthes"
  • %SYSTEM%\xedasn.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{33b8d257-07f6-4c06-8605-94bc21728635}"="drays"
  • %SYSTEM%\dooep.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44e670f2-d57b-4815-a576-955d17dbbf2d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{44e670f2-d57b-4815-a576-955d17dbbf2d}"="cankered"
  • %SYSTEM%\afkvvy.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4688f900-0d0c-4788-b297-59cc10e70ccc}"="bipinnatifid"
  • %WINDOWS%\ddesupport.dll
  • %WINDOWS%\msole.dll
  • %WINDOWS%\msdde.dll
  • %WINDIR%\main_uninstaller.exe (Already removed)
  • %DESKTOP%\Error Cleaner.lnk (Already removed)
  • %DESKTOP%\Privacy Protector.lnk (Already removed)
  • %DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49CF52D7-8D58-4E22-A874-AAD721F5B523}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49CF52D7-8D58-4E22-A874-AAD721F5B523}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSDNS] (C:\WINDOWS\main_uninstaller.exe 1) (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WINSP] (C:\WINDOWS\main_uninstaller.exe 2) (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "msole"=-
  • "msdde"=-



Muutokset v2.194 - v2.195

  • Update: Generic Renos Fix 1.14
  • %SYSTEM%\yesgnhr.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6f396a67-f473-48c9-9950-636ce17e584e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{6f396a67-f473-48c9-9950-636ce17e584e}"="hellenophile"
  • %SYSTEM%\xpuupdate.exe
  • O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Video ActiveX Access\iesbpl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF4E7A0C-E233-4906-B4C1-A404356541FF}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{DF4E7A0C-E233-4906-B4C1-A404356541FF}"=-
  • %WINDOWS%\wincom27.dll
  • %SYSTEM%\ext32inc.dll



Muutokset v2.192 - v2.193

  • %SYSTEM%\ckimzeb.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5bf53d50-b1ec-47b6-a00a-0bd32baeb7ef}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{5bf53d50-b1ec-47b6-a00a-0bd32baeb7ef}"="damkjernite"
  • %USERPROFILE%\Application Data\AdProtect NoSpam\
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\ContraVirus 2.0.lnk
  • %STARTMENU%\ContraVirus 2.0.lnk
  • %STARTMENU%\Programs\ContraVirus\
  • %DESKTOP%\ContraVirus 2.0.lnk
  • %PROGRAMFILES%\ContraVirus\
  • %SYSTEM%\xpuupdate.exe
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad-protect.EXE] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\IEControl.DLL] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\spamdet.DLL]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ToolBarNotifier.EXE]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{6B677F1F-F86C-4757-BF24-7D865EF20639}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7C11C36C-2AE0-4489-9B09-A6129139D52D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C628512D-A058-4BD4-B47B-B036F45FA02B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE8C6A5-A75F-4e33-89C3-18CC58A0B952}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61877300-54DB-4746-BA42-03E03A2B269C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBBD3E11-D201-46C9-8471-091D33159287}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFCBB188-18E3-1DEB-59D5-BACE1CE655A4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7ABE914-B8CF-4602-9145-6BDAAEDA21AA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBE5BEE8-F032-11DB-826A-C4BB56D89593}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA038DDD-0FE0-41f5-BA60-FC3660529E71}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61877300-54DB-4746-BA42-03E03A2B269C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63321A5C-D8FE-432C-8D2F-61C0FC264320}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6B4AB50-F423-4EE6-9839-B35DCFCDFA49}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F51BC478-D997-4C56-988D-79D9EEAAD1EC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F82FD7D4-2EC8-40B3-A141-DE051C98DCE9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD4DCB8B-C33A-4E70-A351-6FAB7E1071A4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{283ED043-D403-4808-BF28-FCDE29DCF1FB}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2C02E5FC-7FE3-4122-911F-829314FE9BBC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{32BD20FD-41FD-47FB-9BC9-28DCBD7D55D7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B677F1F-F86C-4757-BF24-7D865EF20639}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DFCDA823-80C5-4F55-B328-7EFD4AFBD9A0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEControl.IEExtension.1] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCToolBand.SCToolBandObj]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SCToolBand.SCToolBandObj.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ToolBarNotifier.Notifier]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ToolBarNotifier.Notifier.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ContraVirus.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBE5BEE8-F032-11DB-826A-C4BB56D89593}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContraVirus] (C:\Program Files\ContraVirus\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\ContraVirus]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\AdLoader]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Trace7]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell\1das]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell\dnl7]
  • [-HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins\Ad-Protect.Addin.1]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{EA038DDD-0FE0-41f5-BA60-FC3660529E71}"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "ContraVirus"=-
  • "Windows Updater Servc"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyCrush 3.1.lnk
  • %STARTMENU%\SpyCrush 3.1.lnk
  • %STARTMENU%\Programs\SpyCrush\ (Already Removed)
  • %DESKTOP%\SpyCrush 3.1.lnk
  • %PROGRAMFILES%\SpyCrush 3.1\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}] (Already Removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14D6736F-9918-46D2-A96B-75713158DC9C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{33220D50-BB09-4F83-ABC2-E94011D088B5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35A2B3DD-3B38-4E9E-A547-6E459A6E91AA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{472B58B5-B00C-4DC5-83ED-FE8185FFBCBE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB98812-6071-4D01-BC87-7E2CECB9C248}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DBE72DB-B023-47C2-AB01-D2323AADFA5A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60F366A1-5D3B-4D3E-ACE3-CB8C25474FF6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{754E70B2-E0DF-45CE-9429-CCFE0DD7AEA5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7583195C-5F83-4AD6-82D1-3C2F553F93E2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77CAC444-50CC-4E1C-955C-55E325360864}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7DF4D9FC-1B6F-4093-8BC7-6A0F750B59D8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91EF3AD8-9373-4B3F-AAF5-2984E3E34385}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAD385C7-7B45-43FC-BF4E-EABB990337FF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC2A49C8-5970-4DA5-B784-32CD8617B6B8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F3FAE2B3-0961-40A7-94C7-67A28967BE58}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB65F713-07A1-404D-889A-5789E383AB02}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3C4CCBFA-2ADA-43F3-9A40-F729DD31EC5A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyCrush 3.1.exe 3.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush 3.1] (C:\Program Files\SpyCrush 3.1\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush 3.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyCrush 3.1"=-



Muutokset v2.191 - v2.192

  • Added: Rustock, xpdx driver detection
  • %SYSTEM%\pkjcoxq.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1d3b05d-4dd9-468d-982e-c342f05436e5}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e1d3b05d-4dd9-468d-982e-c342f05436e5}"="crowsteps"



Muutokset v2.190 - v2.191

  • %SYSTEM%\ipmon.exe
  • O4 - HKLM\..\Run: [ipmon] ipmon.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "ipmon"=-
  • %SYSTEM%\eeuydc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44e670f2-d57b-4815-a576-955d17dbbf2d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{44e670f2-d57b-4815-a576-955d17dbbf2d}"="auditioned"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.1.lnk
  • %STARTMENU%\SpyLocked 4.1.lnk
  • %STARTMENU%\Programs\SpyLocked 4.1\
  • %DESKTOP%\SpyLocked 4.1.lnk
  • %PROGRAMFILES%\SpyLocked 4.1\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D3F4979-14F0-4344-95F9-D019C75ED669}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1DEAC6D1-27B1-4804-8309-86F80E64D91F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21EE18CF-E24C-4AD8-A279-C34EEB5F18A9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22489F95-AA2E-4DFE-A00C-4F5D0DFDAFD6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{273582F0-3C1E-4BFC-B2A4-8348AE47F717}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27491041-2CCB-4A37-9297-FB84134ECAD4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{464B2A01-EB39-4CF6-B6BB-6262776B79DA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60DDD776-BD47-421A-9B75-C5965C1AAEB3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C2AD1F2-670F-4096-9CF5-6FBEA48D2E38}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A45C94F8-E114-48EB-84C9-DE1B871E1A3A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B48F25A0-49A8-46AE-B506-A789F8E91A51}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D3F81C5A-3A2D-464C-B617-289495AE52DD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6BC961E-2230-4A37-B7DC-F311773C7DBE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F8681E4A-3B1B-46C5-9A0E-E4BDCD240A92}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA08D9EC-0C7B-4C37-8D7A-E7837B997E90}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC51DED7-D056-45E5-A4FF-A308E2DECFA5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9F99FD1A-5C53-4B82-981A-92A0F587D59B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.1.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.1] (C:\Program Files\SpyLocked 4.1\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.1]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked 4.1"=-



Muutokset v2.189 - v2.190

  • %PROGRAMFILES%\PornoPlayer\
  • %STARTMENU%\Programs\PornoPlayer\
  • [-HKEY_CURRENT_USER\SOFTWARE\PornoPlayer]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PornoPlayer]



Muutokset v2.188 - v2.189

  • %PROGRAMFILES%\VideoPlugin\
  • %STARTMENU%\Programs\VideoPlugin\
  • %WINDIR%\ossmart.dll
  • %WINDIR%\pssms.dll
  • %WINDIR%\vpnconfig.dll
  • %WINDIR%\privacy_danger\ (Already removed)
  • %WINDIR%\main_uninstaller.exe (Already removed)
  • %DESKTOP%\Error Cleaner.lnk (Already removed)
  • %DESKTOP%\Privacy Protector.lnk (Already removed)
  • %DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{16789285-C094-4aa6-88B9-2BB9DC13A485}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{16789285-C094-4aa6-88B9-2BB9DC13A485}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "ossmart"=-
  • "vpnconfig"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSDNS] (C:\WINDOWS\main_uninstaller.exe 1)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WINSP] (C:\WINDOWS\main_uninstaller.exe 2)



Muutokset v2.186 - v2.188

  • ded: xpdt driver detection
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{E99D4D0C-EB54-46AF-B62A-3AA1F31D53E5}"=-
  • %SYSTEM%\viuaoq.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7058baa-49a4-40b7-95c2-eec95cdf51f3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d7058baa-49a4-40b7-95c2-eec95cdf51f3}"="infumate"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 4.0.lnk
  • %STARTMENU%\SpyLocked 4.0.lnk
  • %STARTMENU%\Programs\SpyLocked 4.0\
  • %DESKTOP%\SpyLocked 4.0.lnk
  • %PROGRAMFILES%\SpyLocked 4.0\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 4.0.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 4.0] (C:\Program Files\SpyLocked 4.0\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 4.0]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked 4.0"=-



Muutokset v2.185 - v2.186

  • %PROGRAMFILES%\Security Tools\
  • %SYSTEM%\indwvm.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25b7d2fd-4f71-46d1-801a-7de323e4ec82}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{25b7d2fd-4f71-46d1-801a-7de323e4ec82}"="equiparant"



Muutokset v2.184 - v2.185



Muutokset v2.183 - v2.184

  • Update: Generic Renos Fix 1.14



Muutokset v2.182 - v2.183

  • %PROGRAMFILES%\Image ActiveX Access\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image ActiveX Access]
  • O2 - BHO: (no name) - {B8C5186E-EC37-4889-9C2E-F73649FFB7BB} - C:\Program Files\Image ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8C5186E-EC37-4889-9C2E-F73649FFB7BB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8C5186E-EC37-4889-9C2E-F73649FFB7BB}]
  • %SYSTEM%\dtjby.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0c5a0fff-9164-493b-93e0-17446374e0a0}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{0c5a0fff-9164-493b-93e0-17446374e0a0}"="inflexive"



Muutokset v2.181 - v2.182

  • %SYSTEM%\uimcu.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6ad686b9-ab56-4ebc-a804-9f70b55b4577}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{6ad686b9-ab56-4ebc-a804-9f70b55b4577}"="floripondio"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.9.lnk
  • %STARTMENU%\SpyLocked 3.9.lnk
  • %STARTMENU%\Programs\SpyLocked 3.9\
  • %DESKTOP%\SpyLocked 3.9.lnk
  • %PROGRAMFILES%\SpyLocked 3.9\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.9.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.9] (C:\Program Files\SpyLocked 3.9\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.9]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked 3.9"=-



Muutokset v2.180 - v2.181

  • %WINDIR%\msdn.dll
  • %WINDIR%\bandserv.dll
  • %WINDIR%\loader.exe (Already removed)
  • %WINDIR%\tlhelp.dll
  • %WINDIR%\iereport.dll
  • %WINDIR%\main_uninstaller.exe (Already removed)
  • %DESKTOP%\Error Cleaner.lnk (Already removed)
  • %DESKTOP%\Privacy Protector.lnk (Already removed)
  • %DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D76F06D4-1659-482d-BCB2-3F731BFE0941}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bandserv.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bandserv.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D76F06D4-1659-482d-BCB2-3F731BFE0941}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "tlhelp"=-
  • "iereport"=-



Muutokset v2.179 - v2.180

  • %SYSTEM%\antzozc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa4fbf53-c766-4622-8011-a87a805eebf0}\InProcServer32]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fa4fbf53-c766-4622-8011-a87a805eebf0}"="deboner"
  • %PROGRAMFILES%\Protection Tools\
  • %PROGRAMFILES%\Video ActiveX Access\
  • O2 - BHO: (no name) - {7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8} - C:\Program Files\Video ActiveX Access\iesplg.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8}]
  • O3 - Toolbar: Protection Bar - {31615D5C-5126-448A-818A-A7CDFEE85A9B} - C:\Program Files\Video ActiveX Access\iesbpl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31615D5C-5126-448A-818A-A7CDFEE85A9B}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{31615D5C-5126-448A-818A-A7CDFEE85A9B}"=-



Muutokset v2.178 - v2.179

  • %SYSTEM%\kgkdbsk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{735e980d-45d2-4777-af82-9923d3c8d3ae}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{735e980d-45d2-4777-af82-9923d3c8d3ae}"="heterandrous"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.7.lnk
  • %STARTMENU%\SpyLocked 3.7.lnk
  • %STARTMENU%\Programs\SpyLocked 3.7\
  • %DESKTOP%\SpyLocked 3.7.lnk
  • %PROGRAMFILES%\SpyLocked 3.7\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.7.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6] (Already removed - C:\Program Files\SpyLocked 3.7\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.7]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked 3.7"=-



Muutokset v2.176 - v2.177

  • %SYSTEM%\egzcqg.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ede8bed5-92cf-4482-8f51-a01cd9b3ea37}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ede8bed5-92cf-4482-8f51-a01cd9b3ea37}"="antiforeigner"
  • O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - C:\Program Files\Video AX Object\bpvol.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FC80E00-41B0-4F74-BC16-2C83ED49CAC9}]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiped 6.1.lnk
  • %STARTMENU%\MalwareWiped 6.1.lnk
  • %STARTMENU%\Programs\MalwareWiped 6.1\
  • %DESKTOP%\MalwareWiped 6.1.lnk
  • %PROGRAMFILES%\MW\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{035C1836-0D78-DABC-F4A7-D5D0517EE1F9}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A3C742D-8A14-4DD6-806C-CAEC606F6F83}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16398BFE-0D35-45A1-AD20-3E5B605D79C5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{347D361F-EC65-450D-9121-AF8E20A3F1C1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E2F7E84-20BA-45FA-A72E-9C09B3891E30}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3F84EE83-FD4B-4223-B76E-F23F645DCCB3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50CE778D-7505-4374-ABDB-99C6A5139374}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58ADBAFD-D14D-49A2-94EC-4FE8165FD336}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6BEAC051-C197-4951-AF23-4B0522F0303D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{768C89B1-97D9-4153-ACB4-A03FBBFDE184}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{98198A41-C7DB-4F67-AF6C-80F90FEFE047}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A13D839A-E2F0-4E33-B615-592F5CCA5B26}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0E59B82-9A6A-4DFC-94EE-1753A82269A8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C70A5BCF-0F65-4F9E-B869-119D60184E1F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DB9996C3-E22F-4096-8349-C3821C08B1E2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5C6D1A4-502C-4EC2-A472-D14BE3311335}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE0BB4EE-ECC6-4696-BED1-A802ACFECA80}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A538B417-2054-4F1D-9843-0BC8F94B9889}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiped 6.1.exe 6.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiped 6.1] (C:\Program Files\MW\MalwareWiped 6.1\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWiped 6.1]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "MalwareWiped 6.1"=-



Muutokset v2.175 - v2.176

  • %SYSTEM%\xuoce.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{da3b49f6-8c54-4429-a275-21a86dcca413}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{da3b49f6-8c54-4429-a275-21a86dcca413}"="admissibility"



Muutokset v2.174 - v2.175

  • %WINDIR%\iedns.dll
  • %WINDIR%\loader.exe (Already removed)
  • %WINDIR%\main_uninstaller.exe (Already removed)
  • %WINDIR%\msdn32.dll
  • %WINDIR%\msdns.dll
  • %WINDIR%\tlhelper.dll
  • %DESKTOP%\Error Cleaner.lnk (Already removed)
  • %DESKTOP%\Privacy Protector.lnk (Already removed)
  • %DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msdn32.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\msdn32.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDNS.MSDNSApp] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27A7FB75-FB40-4f94-BCF6-4945BCC8BAAF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}"=- (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "msdns"=-
  • "iedns"=-



Muutokset v2.173 - v2.174

  • %WINDIR%\browsers.dll
  • %WINDIR%\ieproxy.dll
  • %WINDIR%\loader.exe (Already removed)
  • %WINDIR%\main_uninstaller.exe (Already removed)
  • %WINDIR%\msie.dll
  • %WINDIR%\service.dll
  • %DESKTOP%\Error Cleaner.lnk (Already removed)
  • %DESKTOP%\Privacy Protector.lnk (Already removed)
  • %DESKTOP%\Spyware&Malware Protection.lnk (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5574E139-F59C-4bee-9A61-150B0D3A16C7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\browsers.StockBar]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\browsers.ToolBar.1]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSDNS.MSDNSApp]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5574E139-F59C-4bee-9A61-150B0D3A16C7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB}"=- (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "msie"=-
  • "ieproxy"=-



Muutokset v2.172 - v2.173

  • Update: Generic Renos Fix 1.13
  • %SYSTEM%\lcsrsrv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}"="huet"



Muutokset v2.171 - v2.172

  • %SYSTEM%\ilmpjy.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4233ac08-a2c4-4742-a0b4-83719613d62c}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4233ac08-a2c4-4742-a0b4-83719613d62c}"="grassily"
  • %SYSTEM%\rcohty.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b23dc537-3e13-44c7-bf67-d8405eb377f7}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b23dc537-3e13-44c7-bf67-d8405eb377f7}"="bedstead"
  • %SYSTEM%\dxovx.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{716002db-288c-4bf0-80cd-a467e78d8b55}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{716002db-288c-4bf0-80cd-a467e78d8b55}"="depreciable"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.6.lnk
  • %STARTMENU%\SpyLocked 3.6.lnk
  • %STARTMENU%\Programs\SpyLocked 3.6\
  • %DESKTOP%\SpyLocked 3.6.lnk
  • %PROGRAMFILES%\SpyLocked 3.6\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{062BC936-7CE4-421C-944E-BD388EC91C86}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22F1A770-B823-48D4-8693-B953902A06EF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A7A14FD-7FEC-48CF-A06F-210344DE6E75}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41E4ADCD-CCC2-4DA0-97C3-83051A4C35F1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54D2D4FC-914C-432C-B638-599F48D77A08}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F342C0C-EF49-49E2-B3F1-FE28F193B974}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F61B413-1DFE-4C4C-8CD4-B97BE0B17504}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764CE36A-C778-42A8-B3B2-4B09A4B10469}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87EA76C9-411E-44D0-8270-EA2DF3941133}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94792C8E-6FE0-462C-9D20-AD560608DDA1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99EAEF8C-652D-407C-8319-781A2BB30FF7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A392D107-AFBF-4E1B-8092-DB508BC890A5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD2AA1CD-22FF-4562-A616-1C64A42985BB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2D197C9-8570-4AC8-A121-92F9A8CCD857}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CBCCB1D8-AB10-4B4C-9982-A8DEA99F3111}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F198A883-6BCF-4B94-A890-D8ED007FBCF7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DA226F0-FE43-4F80-A94A-1848039DE0DD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked 3.6.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6] (C:\Program Files\SpyLocked 3.6\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.6]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked 3.6"=-



Muutokset v2.170 - v2.171

  • %SYSTEM%\yuspej.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3baa1ad8-ee49-4772-bf0b-f55083e0f7aa}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{3baa1ad8-ee49-4772-bf0b-f55083e0f7aa}"="ephemeran"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.5.lnk
  • %STARTMENU%\SpywareLocked 3.5.lnk
  • %STARTMENU%\Programs\SpywareLocked 3.5\
  • %DESKTOP%\SpywareLocked 3.5.lnk
  • %PROGRAMFILES%\SpywareLocked 3.5\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{02743820-2E7C-42C6-B60C-726D67379EDB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D8286F5-9606-46C5-89D8-9B6379877732}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{521C4C7E-D2CF-4EB1-A078-6E126269E0AD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67E054FA-0F1E-4AF8-899B-0B52660D7043}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{697C34C8-BBAC-418C-999A-A5525F4FF8C3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{711C2540-AA7D-4C40-A8C0-9B1BC920378D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80A2BFBD-7906-48EF-9F76-49B9F822393B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87A8C087-37C2-40C4-9CDF-97437A9F54BA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8ED3825E-77A7-41D4-BDCB-FD8CC2B0D183}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2E56D03-930A-4BBF-8C8E-4D63D15F88EE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ABAE0DAF-A6BA-481F-B3BA-0666D0D1B2EB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B5B6AA2C-F0C7-44B9-A861-261958ECD0B8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BD8C66A5-617B-4ABF-B56D-F547597FE0FA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D675FD26-7200-466F-A380-182FE49AF8AA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8073D3D-D957-45BE-82CA-BB44FD0E9C4B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EF906CF9-6EEB-4626-9A17-2E48C11D2995}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5A74E275-351B-4072-8F0B-CBE2B7231B37}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLocked 3.5.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.5] (C:\Program Files\SpywareLocked 3.5\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.5]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpywareLocked 3.5"=-
  • %PROGRAMFILES%\Video AX Object\
  • O2 - BHO: (no name) - {D34F5D71-99E4-4D96-91CA-F4104F69B8AE} - C:\Program Files\Video AX Object\bpvol.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D34F5D71-99E4-4D96-91CA-F4104F69B8AE}]
  • O3 - Toolbar: Protection Bar - {F0993251-2512-4710-AF6E-0A13EA199D02} - C:\Program Files\Video AX Object\splug.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0993251-2512-4710-AF6E-0A13EA199D02}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{F0993251-2512-4710-AF6E-0A13EA199D02}"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video AX Object]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert]
  • [-HKEY_CURRENT_USER\Software\Protection Tools]



Muutokset v2.169 - v2.170

  • NTFS Bug Correction
  • %SYSTEM%\czxtyx.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e4e5110-a772-4c4a-a7dc-137fe10abd6e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{0e4e5110-a772-4c4a-a7dc-137fe10abd6e}"="calocarpum"



Muutokset v2.168 - v2.169

  • %WINDOWS%\dxdiag.dll
  • %WINDOWS%\iebrowser.dll
  • %WINDOWS%\iecontext.dll
  • %WINDOWS%\loader.exe
  • %WINDOWS%\main_uninstaller.exe (Already removed)
  • %DESKTOP%\Privacy Protector.url
  • %DESKTOP%\Spyware&Malware Protection.url
  • %DESKTOP%\Error Cleaner.url
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06CB2908-DD90-4293-8C98-9ABA1025F163}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3828496C-9E4F-4278-8C85-0DF3A3CB41EB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{477D1353-BA0E-43CC-8F40-DEA6BF81ADEE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BD7DB09-1199-41E2-BE9D-AB1D29DD0C3E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C42E5047-FCAD-4B62-A4B0-1052C76A9E1B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F301710A-1204-44C8-A611-E89E58FEFFDA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoExtension]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "iebrowser"=-
  • "iecontext"=-



Muutokset v2.167 - v2.168

  • Update: Generic Renos Fix 1.12
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.4.lnk
  • %STARTMENU%\SpywareLocked 3.4.lnk
  • %STARTMENU%\Programs\SpywareLocked 3.4\
  • %DESKTOP%\SpywareLocked 3.4.lnk
  • %PROGRAMFILES%\SpywareLocked 3.4\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{212DF34E-EAD7-4831-89D8-70CB70581D82}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{69F0456D-B449-4FAC-AF03-B0FBB4B39C53}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7A3BABC0-3D33-4B9D-B11E-EF36E1BFFFBF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8F71D7E5-202B-4B8D-94EB-2B30E4212C18}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8FF07C20-5965-476E-84E8-82374C559BE7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ADA0950-D83C-4C52-83AE-D8258A4B527E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A829592E-08BA-4D4D-87C8-6524687D90E6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AC66E7A3-928B-4F20-B7AC-B3A86298005C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B14649A3-BD2E-4483-B8D6-BF80F82F5D24}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B87C48D1-28E3-48FC-9B27-EEDBB7619A17}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CA091197-32FE-48D8-8696-AF64D8A1CA44}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF4DDC95-8A4B-47C1-A89E-0CBF849DE042}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D74998BF-0AB6-4C8D-801D-EB50CB73FFDF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E849D321-F077-4946-94EF-696F864F0BE5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA5973F9-1064-4393-838F-1B44CB09A1DE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F0091942-BEF6-447E-8F73-B844A4F62851}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{04B12611-E1E1-45E3-9376-91984B957880}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLock.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.4] (C:\Program Files\SpywareLocked 3.4\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.4]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpywareLocked 3.4"=-



Muutokset v2.166 - v2.167

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brave-Sentry]
  • [-HKEY_CURRENT_USER\Software\Brave-Sentry]
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Brave-Sentry"=-
  • %SYSTEM%\ygjun.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"



Muutokset v2.165 - v2.166

  • %PROGRAMFILES%\MovieBox\
  • %STARTMENU%\Programs\MovieBox\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MovieBox]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MovieBox] (C:\Program Files\MovieBox\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\MovieBox]



Muutokset v2.164 - v2.165

  • %SYSTEM%\pkgvyg.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0ded443-5e68-4001-a81b-0a0001621ab8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b0ded443-5e68-4001-a81b-0a0001621ab8}"="excreted"



Muutokset v2.162 - v2.164

  • %WINDOWS%\iesettings.dll
  • %WINDOWS%\iesupport.dll
  • %WINDOWS%\iedebug.dll
  • %WINDOWS%\main_uninstaller.exe
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5F90B57B-3F17-4D9B-8909-1A32AFD6EC0C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF0D1E98-4FAF-44BD-8ECA-E745820E63DD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FA1AA9E-7ECF-4f3b-AC23-7F09E01298E4}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "iesupport"=-
  • "iedebug"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{234FF2FC-BB16-4A7C-AC09-A833CB3D56FC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27CF2E73-9839-404B-85A8-8FB7EE27474C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F86727C-57A3-410E-AB91-176730DAEB45}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B5D099E3-B033-4DB3-A7A6-465859B7A477}]
  • %SYSTEM%\qzviz.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{bd0fc212-0a36-4232-83cc-2063fb9282e0}"="curdler"
  • Spy-Locked.exe
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.3.lnk
  • %STARTMENU%\SpywareLocked 3.3.lnk
  • %STARTMENU%\Programs\SpywareLocked 3.3\
  • %DESKTOP%\SpywareLocked 3.3.lnk
  • %PROGRAMFILES%\SpywareLocked 3.3\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0118155F-254E-4899-B4B0-C12A7D27BD43}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0F4C207D-8105-4A69-9597-CA35DD7D40E0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1767B8C0-D7CA-4714-B50E-E10883B49423}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{222B2001-A14D-40AB-A97A-866C31E64B6C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38CD31E1-73C2-48C0-B0DF-80BD6BA93F40}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5799265E-3E51-4B72-8420-75A71EE94E26}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{866B2BD1-5F33-4472-80E5-3216A92373E8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9894863A-C28A-4D01-B3C5-E6222A789AFE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B2266AD8-EAA6-4934-98E3-34CF67E08374}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC25B50A-E1AE-4345-BB9B-0778DF760BE1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C108A1D9-28AD-40E5-B257-ED9062A14244}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CED85FB9-B4C0-4CFC-A7BE-2C73BAE15D51}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7473324-9D79-45B6-AD7F-333EF7D1A64B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D753CDA9-396B-415B-8379-AAF5902814DA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F33B0E47-DB00-4DF3-B930-A3C558D58B33}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FBC8307B-4BD0-46F1-8350-122585D75DB2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AE68E48B-1A55-49D7-BF9F-A8DFDA47A91F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Spy-Locked.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.3] (C:\Program Files\SpywareLocked 3.3\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked 3.3]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpywareLocked 3.3"=-



Muutokset v2.161 - v2.162

  • Added: DNS IP to detect: (69.50.x.x, 195.95.x.x)



Muutokset v2.159 - v2.161

  • Added: Check for DNS Hijack and configure to DHCP
  • %SYSTEM%\yronl.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1cb82d6d-f9a3-40c4-8ad5-6d7ea00ed6ad}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{1cb82d6d-f9a3-40c4-8ad5-6d7ea00ed6ad}"="haefner"



Muutokset v2.158 - v2.159

  • Added: HostsChk.exe (filter for WhiteList hosts)
  • %SYSTEM%\oyopu.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4}\InProcServer32]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4}"="homina"



Muutokset v2.157 - v2.158

  • Update: Generic Renos Fix 1.11
  • %SYSTEM%\qvjpt.dll
  • [-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{07a582e8-bae3-457d-9d29-2048de45a369}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{07a582e8-bae3-457d-9d29-2048de45a369}"="grithbreach"



Muutokset v2.156 - v2.157

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareLocked 3.2.lnk
  • %STARTMENU%\SpywareLocked 3.2.lnk
  • %STARTMENU%\Programs\SpywareLocked\
  • %DESKTOP%\SpywareLocked.lnk
  • %PROGRAMFILES%\SpywareLocked\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B847A1A-A872-95FC-8E22-F8B4AE044657}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15A6894B-53B5-46C0-8C38-050E21DDD201}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17468406-36B6-4BD1-9B6C-3CC320CF28F6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2F3FF99D-E078-4968-B9C1-87A74C7736CB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{34A0B812-915E-46F2-9F29-DF0F0CF97611}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46018FD4-1675-4020-85DC-A3A0EEB7BDA0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54F04ACA-CC8C-4C70-A8BC-D5C53D381EE7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{655C070F-6724-45BC-BD5E-23609B6D4A3F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78C9E0DA-3BB5-4156-A03C-8326322F10DD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F21289A-BB27-49E9-92C3-2BF7910B6072}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{88C13519-616E-4A0D-B9EF-441D04891B6F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94E13FCA-4BAC-4C2A-A5DF-746460090F9E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CEBEA6DB-DAE7-4146-BABA-1FBCD1D50426}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D152938D-32E1-43A6-81C7-898502AABF9A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD348AC9-1D04-439A-B451-9A83BD66423B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB2FC31-CCC1-4D85-869F-D288E2386DBD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F9A34E6B-4C2A-4F58-B302-79CACCD62C5A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0181CF2-4A15-4CB5-88D7-15EAA2D08A46}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpywareLocked.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked] (C:\Program Files\SpywareLocked\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpywareLocked]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpywareLocked"=-



Muutokset v2.155 - v2.156

  • Added: Process List
  • Added to Process Killed: isamntr.exe, pmmnt.exe, pmsnrr.exe
  • %SYSTEM%\AntiSpy.exe
  • %SYSTEM%\Spykiller.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "value"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
  • "value"=-
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "value"=-
  • %SYSTEM%\tahxqcj.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d6fac42-a7be-4702-87ef-75d8dc14249e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9d6fac42-a7be-4702-87ef-75d8dc14249e}"="hemine"



Muutokset v2.154 - v2.155

  • %SYSTEM%\bhoSearchSpy.dll
  • O2 - BHO: IE SecPlugin - {F5BDC469-1EC5-4193-824B-2E209993D183} - C:\WINDOWS\system32\bhoSearchSpy.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5BDC469-1EC5-4193-824B-2E209993D183}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bhoSearchSpy.IESecPlugin]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5BDC469-1EC5-4193-824B-2E209993D183}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE SecPlugin_is1]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwaresWipeds 5.3.lnk
  • %STARTMENU%\MalwaresWipeds 5.3.lnk
  • %STARTMENU%\Programs\MalwaresWipeds\
  • %DESKTOP%\MalwaresWipeds.lnk
  • %PROGRAMFILES%\MalwaresWipeds\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3DDBC9CF-30B8-8733-7445-754FC2F405F2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07F8DED2-2140-400E-86F3-6C6E5AD2B002}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23BFD4B1-C4EA-453A-89BD-EC9D536891B3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D5B03F2-3D12-4BC2-8A89-8D40AFE15190}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E699B22-FC07-4A9B-B98C-E9B965BFFE7C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{32C42863-E65F-453C-A8FF-60A8F035F57D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{350C54AD-E069-454C-A613-CA8154149E7A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{404A6E3F-1747-4D1B-8285-2C4B8A4B21D4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{776E27AE-419C-4529-9B18-4E71A5EA64A2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BC72975-C801-4534-B103-476EF5D0D17D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BF1461E-228F-4509-8C58-4EB1FBFC19F3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ECD20CF-AF6D-40E1-A1B8-7B6BEABB793E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC158F0C-319D-42A9-8532-134D746D136D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF1A0A91-ABFB-4717-B7B9-D88647EA2529}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C492F812-B194-4C72-81EF-B17D9D973777}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D57FD11F-52DA-42F6-B12E-2447593B402B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1B13777-B021-41E1-BFE6-896E5C1CF163}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A366DE26-3628-46F9-9ABA-0BD450247999}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwaresWipeds.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwaresWipeds] (C:\Program Files\MalwaresWipeds\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\MalwaresWipeds]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "MalwaresWipeds"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyHeals 2.3.lnk
  • %STARTMENU%\SpyHeals 2.3.lnk
  • %STARTMENU%\Programs\SpyHeals\
  • %DESKTOP%\SpyHeals.lnk
  • %PROGRAMFILES%\SpyHeals\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{161D399B-0789-4402-864E-F4347690BD48}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyHeals.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHeals] (C:\Program Files\SpyHeals\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyHeals]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyHeals"=-



Muutokset v2.151 - v2.152

  • %STARTMENU%\Programs\MovieCommander\
  • %PROGRAMFILES%\MovieCommander\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MovieCommander]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MovieCommander] (C:\Program Files\MovieCommander\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\MovieCommander]
  • %STARTMENU%\Programs\SiteEntry\
  • %PROGRAMFILES%\SiteEntry\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SiteEntry]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SiteEntry] (C:\Program Files\SiteEntry\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\SiteEntry]
  • %SYSTEM%\mshlpp.exe
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ms-wordapp]
  • %STARTMENU%\Programs\PrivateVideo\
  • %PROGRAMFILES%\PrivateVideo\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PrivateVideo]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PrivateVideo] (C:\Program Files\PrivateVideo\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\PrivateVideo]



Muutokset v2.150 - v2.151

  • %WINDOWS%\iexplorer.exe
  • %WINDOWS%\ielocales.dll
  • %WINDOWS%\policies.dll
  • %WINDOWS%\policyverifier.exe
  • %SYSTEM%\policies\
  • %SYSTEM%\policies\ppdriver.sys (ppdriver service)
  • [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
  • "PolicyVerifier"=-
  • O2 - BHO: SmartPics Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\Policies.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}]
  • O2 - BHO: TMSN Class - {B72549CE-5644-4116-B8A4-A2B042321EC4} - C:\WINDOWS\Policies.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B72549CE-5644-4116-B8A4-A2B042321EC4}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B72549CE-5644-4116-B8A4-A2B042321EC4}]
  • O2 - BHO: TKTS System - {A717DBE3-D78D-4aa7-BDCF-2CC06B36371B} - C:\WINDOWS\Policies.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A717DBE3-D78D-4aa7-BDCF-2CC06B36371B}]
  • O2 - BHO: VPNS System - {366B2151-E1C7-44a3-86A3-E5686C2A3D2F} - C:\WINDOWS\iedrives.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{366B2151-E1C7-44a3-86A3-E5686C2A3D2F}]
  • O2 - BHO: MSNM System - {A646CE7E-951E-44d1-B93C-F7136DA41E58} - C:\WINDOWS\ielocales.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A646CE7E-951E-44d1-B93C-F7136DA41E58}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A646CE7E-951E-44d1-B93C-F7136DA41E58}]
  • %SYSTEM%\onwtj.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ceca6f2b-247b-4ece-9b7a-d0135c8036fc}"="chitosan"
  • %SYSTEM%\fyxkaah.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b292ec9f-a074-4115-8342-1f459702d8d2}"="characterizing"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.1.lnk
  • %STARTMENU%\SpyLocked 3.1.lnk
  • %STARTMENU%\Programs\SpyLocked\
  • %DESKTOP%\SpyLocked.lnk
  • %PROGRAMFILES%\SpyLocked\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C5B5226-045D-4A46-B4FC-228B0891FEEC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{314120E4-5A05-492C-9BF2-22558CF0F202}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{392D4A36-6ADF-4A99-A820-3014A53E62E3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3BF6C840-4D12-4FB5-88A2-E2BC03461DC2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{42F16135-D0A4-43A2-990C-27FCABD9C19F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43DF1CEE-70B3-4E2D-A740-4AC468786207}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D31CCA1-C42B-4796-851F-CA8ED4CD2A7E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5CA1A9F6-10F8-4008-B884-755B25B6848A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{630CBF61-54CC-4AC3-97B0-D4071345807C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AFB5B8E-ACFD-4489-91B3-DAA1388A31EC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{815B01A0-BF97-41E9-ACF2-32B76F98A960}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5BF4465-5322-462F-B41F-459F649F3996}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E4703CF2-7F82-4AD7-B317-8EC1CBC9B619}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9817993-83FF-4343-B14E-6CDFB378B21D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EDE2A2B4-B1CB-4BF8-93D1-154E49284A71}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F5D23930-23C6-440E-AB55-D019E1171539}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{50450F27-B90B-422B-A4C9-5EC5A5B78001}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyLocked.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked] (C:\Program Files\SpyLocked\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyLocked"=-
  • %SYSTEM%\wincrt.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Windows Critical Alert"=-



Muutokset v2.149 - v2.150

  • %SYSTEM%\msdrives\
  • %SYSTEM%\msdrives\driverpp.sys (driverpp service)
  • %WINDOWS%\iedrives.dll
  • %WINDOWS%\msdrv.exe
  • %WINDOWS%\msdrvctrl.exe
  • %PROGRAMFILES%\NewMediaCodec
  • %SYSTEM%\drives\
  • %SYSTEM%\drives\pnpdrv.sys (pnpdrv service)
  • %WINDOWS%\iedrv.exe
  • %WINDOWS%\iedrvctrl.exe
  • %WINDOWS%\iexploree.dll
  • %WINDOWS%\mslog.exe
  • %DESKTOP%\PrivacyProtector.url
  • %DESKTOP%\SystemDoctor.url
  • %DESKTOP%\WinAntiSpyware 2007.url
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A5845A98-EBDA-4670-9DE6-5201C506E741}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VPNS.VPNSApp]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5845A98-EBDA-4670-9DE6-5201C506E741}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
  • "iedrvctrl"=-
  • "ielogger"=-
  • "IExplorer"=-
  • "msdrvctrl"=-



Muutokset v2.147 - v2.148

  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoAXObject.Chl]
  • O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6ACAE64-F798-4930-AD86-BD3FB32038DB}]



Muutokset v2.145 - v2.147

  • %SYSTEM%\geplxss.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aed6f6a3-183c-488d-9f90-23db99f56e7f}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{aed6f6a3-183c-488d-9f90-23db99f56e7f}"="apathies"
  • %SYSTEM%\tvomnc.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{634be415-da12-496b-b89e-329b73c4807f}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{634be415-da12-496b-b89e-329b73c4807f}"="cam"



Muutokset v2.144 - v2.145

  • %SYSTEM%\tcpipmon.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "tcpipmon"=-



Muutokset v2.143 - v2.144

  • %PROGRAMFILES%\Internet Security
  • [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
  • "user32.dll"=-
  • "rare"=-



Muutokset v2.142 - v2.143

  • %PROGRAMFILES%\Video Access ActiveX Object
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\videoaccessactivex.Chl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Access ActiveX Object] (C:\Program Files\Video Access ActiveX Object\uninst.exe)
  • %SYSTEM%\higehsg.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{2016a466-91a2-43c6-97d8-2fd380f065ef}"="eitheror"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "eitheror"="{2016a466-91a2-43c6-97d8-2fd380f065ef}"
  • %SYSTEM%\xkrdk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8329660f-e248-4872-98cc-fb9c4fec7ba8}"="didynamia"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "didynamia"="{8329660f-e248-4872-98cc-fb9c4fec7ba8}"



Muutokset v2.141 - v2.142

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyDawn 3.1.lnk
  • %STARTMENU%\SpyDawn 3.1.lnk
  • %STARTMENU%\Programs\SpyDawn\
  • %DESKTOP%\SpyDawn.lnk
  • %PROGRAMFILES%\SpyDawn\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1DF2728-8510-0773-96D8-5D0C1F27821B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyDawn.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyDawn] (C:\Program Files\SpyDawn\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyDawn]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyDawn"=-



Muutokset v2.140 - v2.141

  • %SYSTEM%\svshost.dll (Backdoor.Win32.Small.ls)
  • %SYSTEM%\wininet.exe (Backdoor.Win32.Small.ls)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "SysRun"=-
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyCrush 5.1.lnk
  • %STARTMENU%\SpyCrush 5.1.lnk
  • %STARTMENU%\Programs\SpyCrush\
  • %DESKTOP%\SpyCrush.lnk
  • %PROGRAMFILES%\SpyCrush\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3820350F-5092-2ADD-8A4C-8DE2C609FAE5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{189518DF-7EBA-4D31-A7E1-73B5BB60E8D5}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23D627FE-3F02-44CF-9EE1-7B9E44BD9E13}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43CFEFBE-8AE4-400E-BBE4-A2B61BB140FB}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5790B963-23C5-43C1-BCF5-01C9B5A3E44E}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D42DDF4-81EB-4668-9951-819A1D5BEFC8}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76D06077-D5D3-40CA-B32D-6A67A7FF3F06}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86C7E6C3-EC47-44E5-AA08-EE0D0A25895F}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9283DAC1-43F5-4580-BF86-841F22AF2335}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AE90CAFC-09D4-47F0-9E11-CE621C424F08}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BA397E39-F67F-423F-BC6E-65939450093A}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BEC8A83D-01D4-4F15-B8A9-4B4AB24253A7}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C4EEDC19-992D-409A-B323-ED57D511AFA5}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD90F677-D205-4F70-9014-659614AABCB2}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DF91F3-F24F-441E-9001-D61F36024322}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F459EADB-5903-48D5-864C-2B7B46AB1424}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4EDF66-0547-4F1A-AE96-7CFCAD711C90}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}] (Already removed with SpywareQuake)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SpyCrush.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush] (C:\Program Files\SpyCrush\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "SpyCrush"=-



Muutokset v2.139 - v2.140

  • Update: remove from hosts file computing.net, spywareinfo.com,
  • lavasoftsupport.com, majorgeeks.com, microsoft.com, pandasoftware.com,
  • wilderssecurity.com
  • Add: Update mirror
  • %WINDOWS%\dr.exe
  • %WINDOWS%\user32.exe
  • %WINDOWS%\Tasks\At1.job
  • %WINDOWS%\Tasks\At2.job
  • %PROGRAMFILES%\dr.exe
  • %PROGRAMFILES%\dr.exe~
  • %PROGRAMFILES%\patcher.exe
  • %PROGRAMFILES%\serial.dat
  • %PROGRAMFILES%\serial.zip
  • %PROGRAMFILES%\user32.exe
  • %PROGRAMFILES%\widupdate.exe
  • %PROGRAMFILES%\widupdate.exe~



Muutokset v2.138 - v2.139

  • Update: remove following servers from hosts file:
  • arovax.com, bleepingcomputer.com, boskak.za.net, bullguard.com, castlecops.com,
  • compu-docs.com, dell.com, depannetonpc.net, digitaltrends.com, ewido.net,
  • geekstogo.com, greyknight17.com, idg.pl, infos-du-net.com, innovative-sol.com,
  • lockergnome.com, mytechsupport.ca, prevx.com, siri.urz.free.fr, spybot.info,
  • stevengould.org, sunbelt-software.com, spywareinfo.dk, superantispyware.com, techguy.org,
  • techsupportforum.com, tomcoyote.org
  • %SYSTEM%\cwgppb.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2acf3add-34a1-4f2f-99cf-cc69785d1e90}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{2acf3add-34a1-4f2f-99cf-cc69785d1e90}"="exemplars"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "exemplars"="{2acf3add-34a1-4f2f-99cf-cc69785d1e90}"



Muutokset v2.137 - v2.138

  • Update: Generic Renos Fix
  • %SYSTEM%\vblhanf.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}"="didymiums"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "didymiums"="{e6adaaf0-79b2-4cf1-a660-50a0b33991a1}"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVermeans 2.1.lnk
  • %STARTMENU%\AntiVermeans 2.1.lnk
  • %STARTMENU%\Programs\AntiVermeans\
  • %DESKTOP%\AntiVermeans.lnk
  • %PROGRAMFILES%\AntiVermeans\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82C9202F-07E7-C95D-0A61-7FCBB3DC4E2A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E109276-830E-4543-980D-660F305D052C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{21E5890D-B0C0-43FC-9FFA-971E53757CEC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A7C0BB3-BAB7-4203-BF09-AE0F7187A76B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{349FB887-0A21-47FF-95AD-F311B68E1B0C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{73F1B1C8-D0FF-466A-91C0-2995ECE1D7E7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{796854B1-D0B2-471A-9047-9FAABA829DDD}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7B519915-0E5C-429B-AF50-2B1FD12A80C7}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82B8F5FA-8541-4E3E-BB71-9237B638E51C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91251C12-212A-4847-AB34-6C0DE694F83D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{92F553B0-3499-4E89-A25D-AB0865DD8A69}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A0305F7E-4BEF-49AB-9FC1-3CD0964FEE9E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A426E333-4E91-4995-9662-E709BBDAA549}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A6CA4EAC-3168-4F1B-B8CF-84765E1781C8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C24E6ABD-2409-478E-91C2-9AFF9817C10A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E20C255D-E938-49DB-89BA-1A1B27ABDCF3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3A2FFC7-5B66-4150-AA51-5D4CED1E73EB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9A4EC679-4D9A-4165-8562-9584E13A9CEA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVermeans.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVermeans] (C:\Program Files\AntiVermeans\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVermeans]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiVermeans"=-



Muutokset v2.136 - v2.137

  • Bug correction in huy32 service detection
  • %STARTMENU%\Programs\SpyMarshal\
  • %DESKTOP%\SpyMarshal.lnk
  • %PROGRAMFILES%\SpyMarshal\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyMarshal] (C:\Program Files\SpyMarshal\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\Install] (Already removed)
  • [-HKEY_CURRENT_USER\Software\SpyMarshal]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "SpyMarshal"=-



Muutokset v2.135 - v2.136

  • Added: huy32 driver detection.
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWipePro 4.3.lnk
  • %STARTMENU%\MalwareWipePro 4.3.lnk
  • %STARTMENU%\Programs\MalwareWipePro\
  • %DESKTOP%\MalwareWipePro.lnk
  • %PROGRAMFILES%\MalwareWipePro\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DFD0A51-6176-5770-217C-A5BCD7E6F3E2}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{01AEC716-82E6-4D7D-AAE9-E7A3C77669FC}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{158CB0F8-4E71-483B-8A1F-E5F6A2925186}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43B4B286-7D63-49BF-925C-76DB02FB913C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E308A8E-090D-41D4-9566-0CF5DBCE77BA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B457C20-B311-47D6-8462-2A58D14444F3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6570C315-8FE3-4C92-8772-B2EE963CE446}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D4714BE-DA43-41F5-BCF3-5AEF3C95EC42}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86861886-7780-4650-BFED-60E07AE63ED3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94C6F9C7-CDE7-4E81-A5B0-8245E3001B23}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E0A6A56-E495-41B1-A72C-DDBFF7B1147D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A62C8043-EDE3-45B8-8477-FD77CB8746C6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD9BDAB2-76A9-400C-8F4D-F12733D33526}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C8296F61-C691-498E-A509-C1C0C1A879A9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CCBF4AEA-E9E3-4D8A-9F51-7D20C4415C2C}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D65BDB94-8AE3-4509-B0CA-2AC8A3B758EE}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC780A3C-EE81-47B9-97F0-4886EE215105}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E6CD430B-4CDF-4D5E-9071-16085471B882}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWipePro.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWipePro] (C:\Program Files\MalwareWipePro\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWipePro]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "MalwareWipePro"=-
  • %STARTMENU%\Programs\VideoBox\
  • %PROGRAMFILES%\VideoBox\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoBox]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoBox] (C:\Program Files\VideoBox\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\VideoBox]
  • %PROGRAMFILES%\WinAntiSpyPro\
  • mstss.exe
  • plugin.exe
  • updchk.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "mstss"="C:\Program Files\WinAntiSpyPro\mstss.exe"
  • [-HKEY_CURRENT_USER\Software\WinRAR SFX]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpySoldier.lnk
  • %USERPROFILE%\Local Settings\Application Data\SpySoldier\
  • %ALLUSERSTARTMENU%\Programs\SpySoldier\
  • %DESKTOP%\SpySoldier.lnk
  • %PROGRAMFILES%\SpySoldier\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpySoldier_is1] (C:\Program Files\SpySoldier\unins000.exe)
  • [-HKEY_CURRENT_USER\Software\SpySoldier]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\SpywareKnight.lnk
  • %USERPROFILE%\Local Settings\Application Data\SpywareKnight\
  • %ALLUSERSTARTMENU%\Programs\SpywareKnight\
  • %DESKTOP%\SpywareKnight.lnk
  • %PROGRAMFILES%\SpywareKnight\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareKnight_is1] (C:\Program Files\SpywareKnight\unins000.exe)
  • [-HKEY_CURRENT_USER\Software\SpywareKnight]
  • %STARTMENU%\Programs\PestCapture\
  • %DESKTOP%\PestCapture.lnk
  • %PROGRAMFILES%\PestCapture\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.key] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PestCapture] (C:\Program Files\PestCapture\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\Install]
  • [-HKEY_CURRENT_USER\Software\PestCapture]
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  • "PestCapture"=-
  • O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Video ActiveX Object\iesplugin.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84938242-5C5B-4A55-B6B9-A1507543B418}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{84938242-5C5B-4A55-B6B9-A1507543B418}"=-



Muutokset v2.134 - v2.135

  • Update: Detection of new version of the CTDrive key and drv???.dll
  • [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "ctpmon"=-



Muutokset v2.133 - v2.134

  • %SYSTEM%\ctpmon.exe
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Svshostt.arty]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "ctpmon"=-
  • %SYSTEM%\RegistryCleanerSetup.exe
  • %DESKTOP%\Registry Cleaner.lnk
  • %STARTMENU%\Programs\Registry Cleaner\
  • %PROGRAMFILES%\RegistryCleaner\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegistryCleaner] (C:\Program Files\RegistryCleaner\uninstall.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\RegistryCleaner]



Muutokset v2.132 - v2.133

  • %SYSTEM%\gwquvw.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8d8c2387-7f80-4022-9be6-43630a969558}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "carbinyl"="{8d8c2387-7f80-4022-9be6-43630a969558}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8d8c2387-7f80-4022-9be6-43630a969558}"="carbinyl"
  • %SYSTEM%\axlet.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8670ee50-01f9-47da-ac1e-cf8549e9e521}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "eupeptic"="{8670ee50-01f9-47da-ac1e-cf8549e9e521}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{8670ee50-01f9-47da-ac1e-cf8549e9e521}"="eupeptic"
  • %SYSTEM%\oksrqqu.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c4f2cbc-f32d-4a03-9812-86f39379811b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "breadthes"="{5c4f2cbc-f32d-4a03-9812-86f39379811b}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{5c4f2cbc-f32d-4a03-9812-86f39379811b}"="breadthes"
  • %SYSTEM%\nbbrhbd.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "hirtellous"="{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fa19bd7e-50bc-4203-80ac-c4edc81ca9a3}"="hirtellous"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVerminser 2.1.lnk
  • %STARTMENU%\AntiVerminser 2.1.lnk
  • %STARTMENU%\Programs\AntiVerminser\
  • %DESKTOP%\AntiVerminser.lnk
  • %PROGRAMFILES%\AntiVerminser\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01775F16-B10C-B483-63E3-AFCED5DCDEF2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{118601E4-0BC8-4B98-AAEC-723EBA43ED33}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15548C74-5C8B-4911-AE88-739DD473E2BA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{468164CC-476E-47D5-9269-278D0DB22A13}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{478B7D17-F00A-4AB3-B802-46972CAB1AE9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4FCD9AB0-0765-4117-A612-DB3B4FAC1EE3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D89BA32-C9F8-48CC-B22A-18C808DF6D83}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{698664FF-F50E-4BDC-B9C0-C00F96A64B84}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89AE8B3E-3EE8-4068-8932-60CA9E6AC40B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{93362B42-9631-4BAE-92EF-7726E5DD747D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{999E9507-216C-4A7A-B103-57D3FF617E49}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A5A2382E-6EA1-40C9-9EEB-FCE758A7A3F1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C20782A3-B65D-41AB-8D04-BBE3122363C2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C54890B0-B9F8-4E58-9715-8C58B52A4D5D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D037BE5C-7E06-4D4D-8729-FD1EE7E59C89}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D108017B-1769-4BFB-8A4C-0E6202FDBD08}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DECC44F4-E972-4E5C-8F5F-238295C5ADD5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{823B335C-00DE-4886-BE7A-FBDC0F69294E}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiVerminser.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiVerminser] (C:\Program Files\AntiVerminser\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\AntiVerminser]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiVerminser"=-



Muutokset v2.131 - v2.132

  • %SYSTEM%\autosys.exe
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AutoSys"=-
  • %FAVORITES%\Online Security Test.url
  • %STARTMENU%\Programs\SiteTicket\
  • %PROGRAMFILES%\SiteTicket\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SiteTicket]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SiteTicket] (C:\Program Files\SiteTicket\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\SiteTicket]
  • %STARTMENU%\Programs\DirectVideo\
  • %PROGRAMFILES%\DirectVideo\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DirectVideo]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectVideo] (C:\Program Files\DirectVideo\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\DirectVideo]
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiped 5.2.lnk
  • %STARTMENU%\MalwareWiped 5.2.lnk
  • %STARTMENU%\Programs\MalwareWiped\
  • %DESKTOP%\MalwareWiped.lnk
  • %PROGRAMFILES%\MalwareWiped\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MalwareWipe.EXE] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5}] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{035C1836-0D78-DABC-F4A7-D5D0517EE1F9}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0B5398C2-D494-426C-A32B-4C27687ABE1B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{12BFCFD5-4661-430F-A6C9-75CBA2396880}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1B845818-D6E1-4B94-B3BE-65B184165B13}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22E02478-B924-4878-B671-6C620BAC5F46}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{314009BF-F3FC-4C90-82E0-2DE859FD1ED8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{363FFCD3-D837-4949-BB15-9FF91D8D3D6F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{434FB119-3862-46DD-A420-D8A1836549E5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{612CA5DF-DDBD-4BA3-BEB6-F879CB521AE0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7D5247D5-609B-4C07-A04B-D8EAE34A2E10}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80361051-7283-4C4F-A774-7392FC2B1703}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8EB34398-737F-46DD-BC79-FFF8CDE2782A}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A1B5425B-9D99-4419-B3E6-24C0944EF382}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B74B7120-D7B8-4BF7-8CC0-8B49196E1642}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0EE9256-C6A0-491D-B28A-48807B5572BF}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2220318-770B-45C7-B2CF-66022CE7E073}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF42E571-31B5-4BF6-B80A-19B83F030DB0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B73CD73D-026D-43A5-97D4-D175A5DEC129}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiped.exe]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiped] (C:\Program Files\MalwareWiped\uninst.exe)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\MalwareWiped]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "MalwareWiped"=-
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VAXObject.Chl]
  • %PROGRAMFILES%\Image ActiveX Object\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IAXObject.Chl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Image ActiveX Object] (C:\Program Files\Image ActiveX Object\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Key Generator\isaddon.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}]
  • O3 - Toolbar: Safety Bar - {fbea0445-4c4a-4136-864a-c72a4a182a84} - C:\Program Files\Safety Bar\SafetyBar.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fbea0445-4c4a-4136-864a-c72a4a182a84}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{fbea0445-4c4a-4136-864a-c72a4a182a84}"=-
  • O3 - Toolbar: Safety Bar - {18668683-731c-48fa-b1b9-ad013748fb00} - C:\Program Files\Safety Bar\SafetyBar.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18668683-731c-48fa-b1b9-ad013748fb00}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{18668683-731c-48fa-b1b9-ad013748fb00}"=-
  • O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\VideoKeyCodec\iesplugin.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}"=-
  • %SYSTEM%\cthkpcv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "buprestidae"="{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"
  • %SYSTEM%\ownyhr.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a4b860b-b18e-4afe-9b26-2a19268eb6be}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "cecropia"="{9a4b860b-b18e-4afe-9b26-2a19268eb6be}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9a4b860b-b18e-4afe-9b26-2a19268eb6be}"="cecropia"
  • %SYSTEM%\vwfps.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{951a98d0-dad6-4a77-8280-a494279a884b}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{951a98d0-dad6-4a77-8280-a494279a884b}"="beeper"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "beeper"="{951a98d0-dad6-4a77-8280-a494279a884b}"



Muutokset v2.130 - v2.131

  • Update: Generic Renos Fix 1.10
  • %SYSTEM%\cvnzie.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe288882-f661-4522-88f3-20cfb7866fa4}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{fe288882-f661-4522-88f3-20cfb7866fa4}"="gutturalness"
  • %SYSTEM%\hjpprpu.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{3c767c6b-602d-4b9b-829d-a3dc5b2d89dd}"="haematobia"
  • %SYSTEM%\kuhmk.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4fbbdfd6-2ca9-4bba-93e4-aadf75321bca}"="discriminable"
  • AntiVermins changes:
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A1949AB-8B12-4A6F-9B5D-12D4115CCCEA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1724E437-1FCE-4D21-95E2-6E2452C25628}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1ECABCEE-5F00-449B-BBE3-9C35E160E832}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D652EC7-AF61-487A-B82A-0C4A6A9FF3C8}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{500B879D-86C3-4C45-943F-3FC3BF793B38}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{50FE5318-DC2A-440A-AC94-B9041819EE48}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{59DAA331-B3F9-408E-81DF-ADE79D129600}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B768BE7-942B-4838-89BF-40AB729A62AB}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C0B132E-86CB-4B3B-9CAF-CB7F57A60C81}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78E2412E-3C9A-4EE8-AD97-3ABD95EC49D3}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85524659-53E5-40AF-835B-2F0B8745DF0B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9A9D1422-D311-4673-8579-61FCDB76BD0D}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B6CDDF17-9F1A-47CA-8E3D-FF6BD1B05D3F}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D6BD48FC-DD6F-4242-90B0-6CBE4AD43362}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D7D22218-EBF0-454C-B948-11BB8FC3118B}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ECA8F1E3-C03F-47E6-842D-7B2BCF0445CA}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6B112EBD-0C90-4AC4-A969-F36797F00006}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "AntiVermins"=-
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Antivirus-Golden"=-



Muutokset v2.129 - v2.130

  • %SYSTEM%\olnohdw.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}"="astral"



Muutokset v2.128 - v2.129

  • %SYSTEM%\qrzsyr.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01b55afa-f451-474b-9e91-c35b24d02641}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{01b55afa-f451-474b-9e91-c35b24d02641}"="boob"
  • %SYSTEM%\rosdzop.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb720bab-2f75-456b-a850-04d77b20f6b8}
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{bb720bab-2f75-456b-a850-04d77b20f6b8}"="impasse"
  • O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - C:\WINDOWS\system32\ixt0.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f4d74aaa-a178-4463-846b-b4bc87a024e0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4d74aaa-a178-4463-846b-b4bc87a024e0}]
  • O3 - Toolbar: Protection Bar - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - C:\Program Files\Video ActiveX Object\iesplugin.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2}"=-



Muutokset v2.127 - v2.128

  • SYSTEM%\vcehaeb.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d635a36-6b3c-4146-8625-f3aaf507bbf8}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "flammei"="{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"
  • %SYSTEM%\xqpauzx.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f2efa195-4785-4db1-9316-b48c64bb71da}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{f2efa195-4785-4db1-9316-b48c64bb71da}"="blippers"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "blippers"="{f2efa195-4785-4db1-9316-b48c64bb71da}"
  • %SYSTEM%\mlraakb.dll"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}"="gloomily"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "gloomily"="{9cc1c589-4b22-4dae-8e12-4c3b5fa12b3f}"



Muutokset v2.126 - v2.127

  • Now detect and remove: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kd???.exe"
  • O2 - BHO: (no name) - {1a1ddc19-5893-43ab-a73f-f41a0f34d115} - C:\Program Files\Video ActiveX Object\isaddon.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1a1ddc19-5893-43ab-a73f-f41a0f34d115}]
  • O2 - BHO: (no name) - {67270207-b9ee-4d26-9270-860fdb060ca1} - C:\WINDOWS\system32\ixt0.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67270207-b9ee-4d26-9270-860fdb060ca1}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67270207-b9ee-4d26-9270-860fdb060ca1}]



Muutokset v2.125 - v2.126

  • Export of: [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="kd???.exe"
  • %PROGRAMFILES%\Video ActiveX Object\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Object] (C:\Program Files\Video ActiveX Object\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\Video ActiveX Object\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video ActiveX Object] (C:\Program Files\Video ActiveX Object\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\Brain Codec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brain Codec] (C:\Program Files\Brain Codec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\Key Generator\
  • %DESKTOP%\Key Generator.lnk
  • %STARTMENU%\Programs\Key Generator\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Key Generator] (C:\Program Files\Key Generator\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\My Pass Generator\
  • %DESKTOP%\My Pass Generator.lnk
  • %STARTMENU%\Programs\My Pass Generator\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Pass Generator] (C:\Program Files\My Pass Generator\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\VideoAccess\
  • %STARTMENU%\Programs\VideoAccess\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoAccess]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoAccess] (C:\Program Files\VideoAccess\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\VideoAccess]
  • O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}-C:\WINDOWS\System32\ixt0.dll
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{755bbd1a-aa59-456c-afeb-b4c42c4dcb6f}]



Muutokset v2.124 - v2.125

  • %SYSTEM%\xxfgmy.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{588599f4-de26-4c28-ba14-f4eb17e33481}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{588599f4-de26-4c28-ba14-f4eb17e33481}"="emptins"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "emptins"="{588599f4-de26-4c28-ba14-f4eb17e33481}"
  • %SYSTEM%\dbqlrij.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{af4fd984-a939-4c32-82b2-8bae7abe9aec}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{af4fd984-a939-4c32-82b2-8bae7abe9aec}"="benumbment"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "benumbment"="{af4fd984-a939-4c32-82b2-8bae7abe9aec}"
  • %SYSTEM%\tpedvf.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a01a98c-4f25-42e1-971a-185cf63569b2}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{1a01a98c-4f25-42e1-971a-185cf63569b2}"="expatriates"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "expatriates"="{1a01a98c-4f25-42e1-971a-185cf63569b2}"
  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Bursters 6.3.lnk
  • %STARTMENU%\Virus-Bursters 6.3.lnk
  • %STARTMENU%\Programs\Virus-Bursters\ (Already removed)
  • %DESKTOP%\Virus-Bursters.lnk (Already removed)
  • %PROGRAMFILES%\Virus-Bursters\ (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{150D28AC-7C2D-4B57-B837-C74DCE7CC728}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{276D86B8-010B-4576-8444-9A670070A3F4}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D9CAF75-4B36-455B-ADEF-0CFD7ADF3154}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38CD62AA-98AC-4B47-9CB8-8E1F108AD32F}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41F834DA-AF4B-4C04-BD2E-9FA131FF39E5}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48CE44BF-E439-46DE-8CD8-88CB5B3D6D6E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F7FA7BF-007C-46E6-A49C-B8E7373C046E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F412259-081E-4B21-815D-93AE1E71AE95}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{78EA0C93-1AAA-4922-84F0-42CBA685F6BC}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{887D7071-FB68-49F6-A77C-E12D0A83BF91}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ECEF347-16E8-45B3-BB6D-AE9DDFC4EC11}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9EE20753-220C-4A2C-87DC-F86FB78F3774}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A4BB2045-C8B4-4A9F-B509-7A626797B961}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BED38B7D-66E0-47B2-A7EF-8682B62828D6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D87A739B-AD9A-4973-B8C5-9D55B3EC0401}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC6921C1-F723-49C9-B760-274DE8238ED6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C97C3B7C-E022-4FA8-B1A7-1C28270FFAFF}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virus-bursters.exe] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Bursters] (C:\Program Files\Virus-Bursters\uninst.exe)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Bursters] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Virus-Bursters"="C:\Program Files\Virus-Bursters\virus-bursters.exe /h"



Muutokset v2.123 - v2.124

  • O2 - BHO: (no name) - {ae18da4e-be15-4925-81bb-890c04af0200} - C:\Program Files\Gold Codec\isaddon.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae18da4e-be15-4925-81bb-890c04af0200}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae18da4e-be15-4925-81bb-890c04af0200}]
  • O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Programfiler\Perfect Codec\iesplugin.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74a49269-9779-48b4-a0e6-3a5af2a3ade6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{74a49269-9779-48b4-a0e6-3a5af2a3ade6}"=-
  • O3 - Toolbar: Protection Bar - {96ebbe6a-2864-4345-b32b-26ee9be524b5} - C:\Program Files\Gold Codec\iesplugin.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{96ebbe6a-2864-4345-b32b-26ee9be524b5}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{96ebbe6a-2864-4345-b32b-26ee9be524b5}"=-
  • %PROGRAMFILES%\Gold Codec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gold Codec] (C:\Program Files\Gold Codec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\Silver Codec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Silver Codec] (C:\Program Files\Silver Codec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Muutokset v2.122 - v2.123

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus-Bursters 6.2.lnk
  • %STARTMENU%\Virus-Bursters 6.2.lnk
  • %STARTMENU%\Programs\Virus-Bursters\
  • %DESKTOP%\Virus-Bursters.lnk
  • %PROGRAMFILES%\Virus-Bursters\
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A66CC28-F0A2-FCBC-D3D5-1EA3001ED26A}] (Already removed)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0249BEB1-A2AA-45A3-9EC5-95D9C4A40A62}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{082DA6AF-F994-4C6C-A2B0-DFC3B3FF540A}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0C9A71B1-8A8A-48A1-AA3F-0C83CE1C0BBD}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0EF25077-DA22-4FF2-B6FF-6FC1C26F5740}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{20DC1F8E-4640-4FFF-9858-05E7B978CC71}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2613CF74-4FC5-4251-9F48-260496364852}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{27D8CD06-82E3-4E1E-8917-86A9B3AE41F6}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CAEFBCD-55A9-4A68-AA02-E69B12B3BE57}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{898272CF-3ACE-4A7B-98FA-9EB8DB8B26DC}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8CBF5BAC-E609-4863-ABC9-68A7BD13B1D0}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9981DDEF-81C4-4CC8-A5F2-62A7912D8037}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9CB68DF7-F336-45A2-BDE2-5DCA3998986F}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B4BB620F-3AE7-4910-8171-F9FC8120D9EF}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D838D7A3-1551-4B32-BF7A-7F4F769BB885}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1751F23-00E6-4F6C-AD78-CA7D8A96FD3E}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED639B1F-1B3F-473F-BD8D-6DE9C2D1972A}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F83E8F99-AE49-45D6-92B4-59854BF0A759}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virus-bursters.exe]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus-Bursters] (C:\Program Files\Virus-Bursters\uninst.exe)
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Virus-Bursters]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  • "Virus-Bursters"="C:\Program Files\Virus-Bursters\virus-bursters.exe /h"
  • %SYSTEM%\dcvwaah.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40dcff6e-af8d-4183-8ebe-a82270ac449e]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{40dcff6e-af8d-4183-8ebe-a82270ac449e}"="gimmicks"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "gimmicks"="{40dcff6e-af8d-4183-8ebe-a82270ac449e}"
  • %SYSTEM%\fmrmhc.dll
  • [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0bad5052-665d-40d4-a9bd-a2891eaafb42}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{0bad5052-665d-40d4-a9bd-a2891eaafb42}"="boucicault"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "boucicault"="{0bad5052-665d-40d4-a9bd-a2891eaafb42}"
  • %SYSTEM%\oebxpba.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4fc003c3-87a0-489c-85cd-878246eb2d18}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{4fc003c3-87a0-489c-85cd-878246eb2d18}"="amaranthaceous"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "amaranthaceous"="{4fc003c3-87a0-489c-85cd-878246eb2d18}"



Muutokset v2.121 - v2.122

  • %USERPROFILE%\Application Data\Microsoft\Internet Explorer\Quick Launch\MalwareWiper 4.3.lnk
  • %STARTMENU%\MalwareWiper 4.3.lnk
  • %STARTMENU%\Programs\MalwareWiper\
  • %DESKTOP%\MalwareWiper.lnk
  • %PROGRAMFILES%\MalwareWiper\
  • HKLM\SOFTWARE\Classes\AppID\MalwareWipe.EXE (Already removed)
  • HKLM\SOFTWARE\Classes\AppID\{70F17C8C-1744-41B6-9D07-575DB448DCC5} (Already removed)
  • HKLM\SOFTWARE\Classes\CLSID\{1FC4ADE1-15D3-057E-81D5-DD934DE6542E}
  • HKLM\SOFTWARE\Classes\Interface\{04DA0CE8-87C6-4379-9CBD-5D6E93C919E8}
  • HKLM\SOFTWARE\Classes\Interface\{0678CAB9-7825-467E-9310-CDD2DCA855D0}
  • HKLM\SOFTWARE\Classes\Interface\{1386F568-F1AB-477D-B69E-31D66B6E4DAA}
  • HKLM\SOFTWARE\Classes\Interface\{210E3B48-776B-4F4B-B80A-2BB59F1A676D}
  • HKLM\SOFTWARE\Classes\Interface\{2E3C5BE8-3EA7-48A7-97FA-7E2AB0A88392}
  • HKLM\SOFTWARE\Classes\Interface\{576BB1E3-B26D-4BCB-A0BD-B49FF2469936}
  • HKLM\SOFTWARE\Classes\Interface\{5F8BD6DC-6D30-4A6F-9D07-3822DFA605D7}
  • HKLM\SOFTWARE\Classes\Interface\{694E0F65-5EF7-40FB-9412-48AFCE704720}
  • HKLM\SOFTWARE\Classes\Interface\{74878382-B258-484B-A614-475D8DCF104B}
  • HKLM\SOFTWARE\Classes\Interface\{7B8A51F7-0700-4CEB-978E-E0A3C88CB4B4}
  • HKLM\SOFTWARE\Classes\Interface\{87FF9647-1710-4EB6-97C9-65484F9C61E9}
  • HKLM\SOFTWARE\Classes\Interface\{A7358DCF-6343-45AE-930D-5C2BB96B9116}
  • HKLM\SOFTWARE\Classes\Interface\{B4BFACA9-37BA-45BC-8EE6-6F9910651B0B}
  • HKLM\SOFTWARE\Classes\Interface\{BE18EBF9-4F98-4333-8DD2-AEBA2911A80B}
  • HKLM\SOFTWARE\Classes\Interface\{DDC17036-3DE8-4FEB-948E-D225CF5BCC95}
  • HKLM\SOFTWARE\Classes\Interface\{E8194604-B6D1-4D63-ABC7-8C2D89E6D497}
  • HKLM\SOFTWARE\Classes\TypeLib\{96467F12-0518-4E85-AC6A-4858017F1400}
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MalwareWiper.exe
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareWiper] (C:\Program Files\MalwareWiper\uninst.exe)
  • HKLM\SOFTWARE\MalwareWiper
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • "MalwareWiper"=-
  • %PROGRAMFILES%\JPEG Encoder\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JPEGEncoder.Chl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JPEG Encoder] (C:\Program Files\JPEG Encoder\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\Perfect Codec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Perfect Codec] (C:\Program Files\Perfect Codec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\Super Codec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Codec] (C:\Program Files\Super Codec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Muutokset v2.120 - v2.121

  • Update: Bug correction in CTDrive Fix routine (causes a jump to the scan part while fixing)
  • O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\QualityCodec\isaddon.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{192c5b4a-3efd-40c7-9f99-c472deb8efc0}]
  • O2 - BHO: (no name) - {2810fba5-55ec-4bee-8263-0e2fa5883768} - C:\Program Files\QualityCodec\isaddon.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2810fba5-55ec-4bee-8263-0e2fa5883768}]
  • O2 - BHO: (no name) - {4734044c-7427-43d8-adbe-df942e52bef2} - C:\Program Files\QualityCodec\isaddon.dll (file missing)
  • [-HKEY_CLASSES_ROOT\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4734044c-7427-43d8-adbe-df942e52bef2}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4734044c-7427-43d8-adbe-df942e52bef2}]
  • O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Program Files\QualityCodec\iesplugin.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf1ced2c-4b3f-4079-a330-864eda5a4cff}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  • "{bf1ced2c-4b3f-4079-a330-864eda5a4cff}"=-
  • %SYSTEM%\jbtazy.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "featherweed"="{ab340860-fd81-4a65-b345-82eb77a66b5e}"
  • %SYSTEM%\cfltygd.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "cussers"="{ff170564-36c8-43f7-9100-559e166405cf}"



Muutokset v2.119 - v2.120

  • %SYSTEM%\yosdjh.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "anatolian"="{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "anatolian"="{b28b396b-b9e8-44f5-aa04-ed4f383d79ad}"
  • O2 - BHO: (no name) - {39f25b12-74ff-4079-a51f-1d70f5b08b84} - C:\WINDOWS\system32\ixt?.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39f25b12-74ff-4079-a51f-1d70f5b08b84}]
  • O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Program Files\iVideoCodec\isaddon.dll
  • O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Program Files\QualityCodec\isaddon.dll
  • [-HKEY_CLASSES_ROOT\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}]
  • %PROGRAMFILES%\QualityCodec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QualityCodec] (C:\Program Files\QualityCodec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %USERPROFILE%\StartMenu\Programs\FreeVideo\
  • %PROGRAMFILES%\FreeVideo\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FreeVideo]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeVideo] (C:\Program Files\FreeVideo\Uninstall.exe)
  • [-HKEY_CURRENT_USER\Software\FreeVideo]
  • %PROGRAMFILES%\EliteCodec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EliteCodec] (C:\Program Files\EliteCodec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)



Muutokset v2.117 - v2.119

  • %PROGRAMFILES%\iVideoCodec\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iVideoCodec] (C:\Program Files\iVideoCodec\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • %PROGRAMFILES%\VidCodecs\
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl] (Already removed)
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl]
  • [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VidCodecs] (C:\Program Files\VidCodecs\uninst.exe)
  • [-HKEY_CURRENT_USER\Software\Internet Security] (Already removed)
  • Update: Generic Renos Fix 1.9
  • %SYSTEM%\sacskza.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01d8d081-0f76-4ab5-b5e4-9b23a709670e}
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "detachments"="{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"="detachments"
  • %SYSTEM%\impgsje.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "archenteric"="{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"="archenteric"
  • %SYSTEM%\okkmtv.dll
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}]
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  • "bonspells"="{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  • "{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"="bonspells"



<<Takaisin ohjelman lataussivulle