Hi!
Here are the results:
Panda Activescan:
Incident Status Location
Adware:adware/dyfuca Not disinfected Windows Registry
Adware:adware/whenusearch Not disinfected Windows Registry
Spyware:Cookie/Atwola Not disinfected F:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4ttkro1z.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Doubleclick Not disinfected F:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4ttkro1z.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Tribalfusion Not disinfected F:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4ttkro1z.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/888 Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@888[2].txt
Spyware:Cookie/888 Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@888[3].txt
Spyware:Cookie/YieldManager Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt
Spyware:Cookie/Hbmediapro Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@adopt.hbmediapro[1].txt
Spyware:Cookie/PointRoll Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[1].txt
Spyware:Cookie/Advertising Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@advertising[1].txt
Spyware:Cookie/NewMedia Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@anm.co[2].txt
Spyware:Cookie/Falkag Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@as-us.falkag[1].txt
Spyware:Cookie/Atlas DMT Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@atwola[1].txt
Spyware:Cookie/Azjmp Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@azjmp[1].txt
Spyware:Cookie/Banner Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@banner[2].txt
Spyware:Cookie/Belnk Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@belnk[1].txt
Spyware:Cookie/Bfast Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@bfast[1].txt
Spyware:Cookie/Bluestreak Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@bluestreak[1].txt
Spyware:Cookie/BurstNet Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@burstnet[2].txt
Spyware:Cookie/GoClick Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@c.goclick[2].txt
Spyware:Cookie/Casalemedia Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@casalemedia[1].txt
Spyware:Cookie/Cassava Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@cassava[1].txt
Spyware:Cookie/Cgi-bin Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@cgi-bin[1].txt
Spyware:Cookie/Clickbank Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@clickbank[1].txt
Spyware:Cookie/Com.com Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt
Spyware:Cookie/Hitslink Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@counter.hitslink[1].txt
Spyware:Cookie/360i Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@ct.360i[1].txt
Spyware:Cookie/did-it Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@did-it[1].txt
Spyware:Cookie/Belnk Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@dist.belnk[2].txt
Spyware:Cookie/Hitbox Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@ehg-dig.hitbox[2].txt
Spyware:Cookie/FastClick Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@fastclick[2].txt
Spyware:Cookie/Freestats Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@freestats[1].txt
Spyware:Cookie/Com.com Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@google.com[2].txt
Spyware:Cookie/GoStats Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@gostats[1].txt
Spyware:Cookie/Go Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@go[1].txt
Spyware:Cookie/Hitbox Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@hitbox[1].txt
Spyware:Cookie/Maxserving Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@maxserving[1].txt
Spyware:Cookie/2o7 Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@microsofteup.112.2o7[1].txt
Spyware:Cookie/Hitbox Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@phg.hitbox[1].txt
Spyware:Cookie/Qsrch Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@qsrch[2].txt
Spyware:Cookie/QuestionMarket Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt
Spyware:Cookie/Rn11 Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@rn11[2].txt
Spyware:Cookie/Searchportal Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@searchportal.information[2].txt
Spyware:Cookie/Seeq Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@seeq[1].txt
Spyware:Cookie/Advertising Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@servedby.advertising[1].txt
Spyware:Cookie/Serving-sys Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt
Spyware:Cookie/SpyLog Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@spylog[1].txt
Spyware:Cookie/Statcounter Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@statcounter[1].txt
Spyware:Cookie/Reliablestats Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@stats1.reliablestats[1].txt
Spyware:Cookie/Toplist Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@toplist[2].txt
Spyware:Cookie/Traffic Marketplace Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[1].txt
Spyware:Cookie/Tribalfusion Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[1].txt
Spyware:Cookie/Tucows Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@tucows[1].txt
Spyware:Cookie/myaffiliateprogram Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@www.myaffiliateprogram[2].txt
Spyware:Cookie/seeqA Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@www.seeq[1].txt
Spyware:Cookie/Seeq Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@www48.seeq[1].txt
Spyware:Cookie/Xiti Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt
Spyware:Cookie/Xmts Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@xmts[1].txt
Spyware:Cookie/Yadro Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@yadro[2].txt
Spyware:Cookie/Zedo Not disinfected F:\Documents and Settings\Administrator\Cookies\administrator@zedo[1].txt
Spyware:Spyware/LZIO-Media Not disinfected F:\Documents and Settings\Administrator\Local Settings\Temp\nsb1CB.tmp\touchanswer.exe
Spyware:Spyware/LZIO-Media Not disinfected F:\Documents and Settings\Administrator\Local Settings\Temp\nss1D6.tmp\touchanswer.exe
Silent Runners:
"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
----
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "F:\WINDOWS\system32\ctfmon.exe" [MS]
"CG4IE" = "F:\Program Files\Internet\cg4ie\cg4ie.exe" [empty string]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SysTray" = ""f:\Windows\System32\Systray.exe"" [MS]
"MessengerPlus3" = ""F:\Program Files\MSN Messenger\Plus\MsgPlus.exe"" ["Patchou"]
"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
"ATICCC" = ""F:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "F:\Program Files\Acrobat Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{69A87B7D-DE56-4136-9655-716BA50C19C7}\(Default) = "Google Web Accelerator Helper"
-> {HKLM...CLSID} = "&Google Web Accelerator Helper"
\InProcServer32\(Default) = "F:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll" [null data]
{A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "IeCatch2 Class"
\InProcServer32\(Default) = "F:\PROGRA~1\Internet\FlashGet\jccatch.dll" ["Amaze Soft"]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "f:\program files\google\googletoolbar2.dll" ["Google Inc."]
{CCCCCCD3-666F-4F81-8B69-745DE9F6D897}\(Default) = "&Google Notebook"
-> {HKLM...CLSID} = "&Google Notebook"
\InProcServer32\(Default) = "F:\Program Files\Google\Google Notebook\gnotes1.0.2.6-45683967.dll" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {HKLM...CLSID} = "Display Panning CPL Extension"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "F:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}" = "PhotoToys"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "F:\WINDOWS\system32\phototoys.dll" [MS]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "F:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{40950107-FEA6-4d53-A65F-B2DCBA57DD58}" = "Nokia Phone Browser"
-> {HKLM...CLSID} = "Nokia Phone Browser"
\InProcServer32\(Default) = "F:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll" ["Nokia"]
"{FBFE7864-D495-41f0-B7DC-4BB601CC295E}" = "Contact View"
-> {HKLM...CLSID} = "Contact View"
\InProcServer32\(Default) = "F:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll" ["Nokia"]
"{43886CD5-6529-41c4-A707-7B3C92C05E68}" = "IE Navigation Bar"
-> {HKLM...CLSID} = "IE Navigation Bar"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE AutoComplete"
-> {HKLM...CLSID} = "IE AutoComplete"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{4B78D326-D922-44f9-AF2A-07805C2A3560}" = "IE Menu Band"
-> {HKLM...CLSID} = "IE Menu Band"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{6CF48EF8-44CD-45d2-8832-A16EA016311B}" = "IE IShellFolderBand"
-> {HKLM...CLSID} = "IE IShellFolderBand"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{F2CF5485-4E02-4f68-819C-B92DE9277049}" = "&Links"
-> {HKLM...CLSID} = "&Links"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{1C1EDB47-CE22-4bbb-B608-77B48F83C823}" = "IE Fade Task"
-> {HKLM...CLSID} = "IE Fade Task"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE}" = "IE Tracking Shell Menu"
-> {HKLM...CLSID} = "IE Tracking Shell Menu"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{44C76ECD-F7FA-411c-9929-1B77BA77F524}" = "IE Menu Site"
-> {HKLM...CLSID} = "IE Menu Site"
\InProcServer32\(Default) = "F:\WINDOWS\system32\ieframe.dll" [file not found]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "F:\WINDOWS\system32\browseui.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "F:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{68f32140-2ca3-11d0-acc1-444553540000}" = "PicaView32"
-> {HKLM...CLSID} = "PicaView32 Shell Extension"
\InProcServer32\(Default) = "F:\PROGRA~1\PICAVI~1\PicaView.dll" ["ACD Systems, Ltd."]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
-> {HKLM...CLSID} = "ShellLink for Application References"
\InProcServer32\(Default) = "F:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
-> {HKLM...CLSID} = "Shell Icon Handler for Application References"
\InProcServer32\(Default) = "F:\WINDOWS\system32\dfshim.dll" [MS]
"{CCCCCCD3-666F-4F81-8B69-745DE9F6D897}" = "&Google Notebook"
-> {HKLM...CLSID} = "&Google Notebook"
\InProcServer32\(Default) = "F:\Program Files\Google\Google Notebook\gnotes1.0.2.6-45683967.dll" [null data]
"{CCCCCCDB-4DDB-4703-95D4-DD2C526397BF}" = "&Google Notebook"
-> {HKLM...CLSID} = "&Google Notebook"
\InProcServer32\(Default) = "F:\Program Files\Google\Google Notebook\gnotes1.0.2.6-45683967.dll" [null data]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "F:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "F:\WINDOWS\system32\Audiodev.dll" [MS]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
-> {HKLM...CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "F:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}" = "Microsoft AntiMalware ShellExecuteHook"
-> {HKLM...CLSID} = "Microsoft AntiMalware ShellExecuteHook"
\InProcServer32\(Default) = "F:\PROGRA~1\WINDOW~4\MpShHook.dll" [MS]
HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk *" [file not found], [MS], [file not found]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
INFECTION WARNING! NavLogon\DLLName = "F:\WINDOWS\system32\NavLogon.dll" ["Symantec Corporation"]
INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]
HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "F:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]
HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "F:\Program Files\Acrobat Reader\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
CopyPath\(Default) = "{303FEFF0-6ABA-11D3-90E4-0090272D53E3}"
-> {HKLM...CLSID} = "CopyPathExt Class"
\InProcServer32\(Default) = "F:\KingSub\kingsub.dll" [empty string]
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {HKLM...CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "F:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
PicaView32\(Default) = "{68f32140-2ca3-11d0-acc1-444553540000}"
-> {HKLM...CLSID} = "PicaView32 Shell Extension"
\InProcServer32\(Default) = "F:\PROGRA~1\PICAVI~1\PicaView.dll" ["ACD Systems, Ltd."]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
CopyPath\(Default) = "{303FEFF0-6ABA-11D3-90E4-0090272D53E3}"
-> {HKLM...CLSID} = "CopyPathExt Class"
\InProcServer32\(Default) = "F:\KingSub\kingsub.dll" [empty string]
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {HKLM...CLSID} = "VpshellEx Class"
\InProcServer32\(Default) = "F:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "F:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
Active Desktop and Wallpaper:
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "F:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"
Startup items in "Administrator" & "All Users" startup folders:
-----
F:\Documents and Settings\Administrator\Start Menu\Programs\Startup
"MultiRes" -> shortcut to: "F:\Program Files\Powertoys\MultiRes.exe" ["EnTech Taiwan"]
Enabled Scheduled Tasks:
------------------------
"MP Scheduled Scan" -> launches: "F:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges" [MS]
Winsock2 Service Provider DLLs:
--
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
F:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork1.dll [null data], 01 - 02, 08
%SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 09 - 25
%SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07
Toolbars, Explorer Bars, Extensions:
-------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "f:\program files\google\googletoolbar2.dll" ["Google Inc."]
"{AEB0B6B0-0CBD-4176-B0F0-FCEADF802E2E}"
-> {HKLM...CLSID} = "NetHelper Toolbar"
\InProcServer32\(Default) = "F:\Program Files\NetHelper\tbNetH.dll" ["Platforma Online Ltd."]
"{24F0A2C9-FEB5-4015-BA4D-555543575B22}"
-> {HKLM...CLSID} = "MyCommunities toolbar"
\InProcServer32\(Default) = "F:\Program Files\MyCommunities\tbMyC0.dll" ["Platforma Online Ltd."]
"{CCCCCCDB-4DDB-4703-95D4-DD2C526397BF}"
-> {HKLM...CLSID} = "&Google Notebook"
\InProcServer32\(Default) = "F:\Program Files\Google\Google Notebook\gnotes1.0.2.6-45683967.dll" [null data]
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "f:\program files\google\googletoolbar2.dll" ["Google Inc."]
"{DB87BFA2-A2E3-451E-8E5A-C89982D87CBF}"
-> {HKLM...CLSID} = "Google Web Accelerator"
\InProcServer32\(Default) = "F:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll" [null data]
"{AEB0B6B0-0CBD-4176-B0F0-FCEADF802E2E}"
-> {HKLM...CLSID} = "NetHelper Toolbar"
\InProcServer32\(Default) = "F:\Program Files\NetHelper\tbNetH.dll" ["Platforma Online Ltd."]
"{24F0A2C9-FEB5-4015-BA4D-555543575B22}"
-> {HKLM...CLSID} = "MyCommunities toolbar"
\InProcServer32\(Default) = "F:\Program Files\MyCommunities\tbMyC0.dll" ["Platforma Online Ltd."]
"{22D003CE-6952-46C5-80B9-D19B479620AB}"
-> {HKLM...CLSID} = "Stumble&Upon"
\InProcServer32\(Default) = "F:\WINDOWS\system32\s1940.dll" [empty string]
"{CCCCCCDB-4DDB-4703-95D4-DD2C526397BF}"
-> {HKLM...CLSID} = "&Google Notebook"
\InProcServer32\(Default) = "F:\Program Files\Google\Google Notebook\gnotes1.0.2.6-45683967.dll" [null data]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{DB87BFA2-A2E3-451E-8E5A-C89982D87CBF}" = (no title provided)
-> {HKLM...CLSID} = "Google Web Accelerator"
\InProcServer32\(Default) = "F:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll" [null data]
"{AEB0B6B0-0CBD-4176-B0F0-FCEADF802E2E}" = "NetHelper Toolbar"
-> {HKLM...CLSID} = "NetHelper Toolbar"
\InProcServer32\(Default) = "F:\Program Files\NetHelper\tbNetH.dll" ["Platforma Online Ltd."]
"{24F0A2C9-FEB5-4015-BA4D-555543575B22}" = "MyCommunities Toolbar"
-> {HKLM...CLSID} = "MyCommunities toolbar"
\InProcServer32\(Default) = "F:\Program Files\MyCommunities\tbMyC0.dll" ["Platforma Online Ltd."]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "f:\program files\google\googletoolbar2.dll" ["Google Inc."]
"{CCCCCCDB-4DDB-4703-95D4-DD2C526397BF}" = "&Google Notebook"
-> {HKLM...CLSID} = "&Google Notebook"
\InProcServer32\(Default) = "F:\Program Files\Google\Google Notebook\gnotes1.0.2.6-45683967.dll" [null data]
Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{21569614-B795-46B1-85F4-E737A8DC09AD}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "F:\WINDOWS\system32\browseui.dll" [MS]
Dormant Explorer Bars in "View, Explorer Bar" menu
HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "F:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]
{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "&FlashGet"
"Exec" = "F:\PROGRA~1\Internet\FlashGet\JetCar.exe" ["Amaze Soft"]
Running Services (Display Name, Service Name, Path {Service DLL}):
--------
Ati HotKey Poller, Ati HotKey Poller, "F:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Bluetooth Support Service, BthServ, "F:\WINDOWS\system32\svchost.exe -k bthsvcs" {"F:\WINDOWS\System32\bthserv.dll" [MS]}
Norton Ghost, Norton Ghost, "F:\Program Files\Security\Norton Ghost\Agent\PQV2iSvc.exe" ["Symantec Corporation"]
Symantec AntiVirus, Symantec AntiVirus, ""F:\Program Files\Symantec AntiVirus\Rtvscan.exe"" ["Symantec Corporation"]
Symantec AntiVirus Definition Watcher, DefWatch, ""F:\Program Files\Symantec AntiVirus\DefWatch.exe"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
Windows Defender Service, WinDefend, ""F:\Program Files\Windows Defender\MsMpEng.exe"" [MS]
Windows User Mode Driver Framework, UMWdf, "F:\WINDOWS\system32\wdfmgr.exe" [MS]
Print Monitors:
---------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 209 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 49 seconds.
---------- (total run time: 350 seconds)
Thanks!
