Error messages as soon as PC starts; no programs will open

[lemonlime]

I'm in safe mode with networking now, the only way I can access internet.  I do not have the start button, only icons, so I can't do step 1.  Should I start with Step 2?

When windows opens, I get a series of error messages like Anyprogram.exe referenced memory at 14opfk- memory could not be "read". 

Is it safe to stay in safe mode indefinitely?  It automatically turned off MacAfee security and did not give me an option to restore it.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please try to run MBAM in Safe Mode. If successful, try running it in Normal Mode.

Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*********************************************************

• Please download Unhide by Grinler from here and save it to your desktop.
  
• Double click unhide.exe to run the tool.
  
• It will take some time to go through all your files, so please be patient.
• If this tool doesn´t fix the problem, please let me know.

[lemonlime]

Hi Dave, thanx for the quick reply! I found the Start button and I did Step 1.  A lot of games were on there, but no obvious malware.  Should I do step 2, or go ahead with MBAM?

[SuperDave]

Please run MBAM again and post the log as well as these logs.

SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
***************************************************
Download Combofix from any of the links below, and save it to your DESKTOP. 

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

[lemonlime]

Still can only access internet in safe mode; would not allow me to run MBAM or disable Norton and McAfee; looks like it may have done it automatically.
Here are the logs:

ComboFix 12-08-15.01 - Administrator 08/15/2012  19:32:39.1.1 - x86 NETWORK
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.958.715 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: Norton Internet Security 2006 *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton Internet Security 2006 *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\fiosejgfse.dll
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Favorites\_favdata.dat
c:\documents and settings\Compaq_Administrator\GoToAssistDownloadHelper.exe
c:\documents and settings\Compaq_Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\program files\Internet Explorer\SET12E.tmp
c:\program files\Internet Explorer\SET133.tmp
c:\program files\Internet Explorer\SET163.tmp
c:\program files\Internet Explorer\SET168.tmp
c:\program files\Internet Explorer\SET182.tmp
c:\program files\Internet Explorer\SET187.tmp
c:\program files\Internet Explorer\SET1D5.tmp
c:\program files\Internet Explorer\SET1D6.tmp
c:\program files\Internet Explorer\SET218.tmp
c:\program files\Internet Explorer\SET21D.tmp
c:\program files\Internet Explorer\SET29D.tmp
c:\program files\Internet Explorer\SET2A2.tmp
c:\program files\Internet Explorer\SETA83.tmp
c:\program files\Internet Explorer\SETA88.tmp
c:\program files\Internet Explorer\SETAF5.tmp
c:\program files\Internet Explorer\SETAF6.tmp
c:\program files\Internet Explorer\SETBC.tmp
c:\program files\Internet Explorer\SETC1.tmp
c:\program files\Internet Explorer\SETD7.tmp
c:\program files\Internet Explorer\SETDC.tmp
c:\program files\Mozilla Firefox\components\AskHPRFF.js
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
D:\Autorun.inf
.
.
(((((((((((((((((((((((((   Files Created from 2012-07-15 to 2012-08-15  )))))))))))))))))))))))))))))))
.
.
2012-08-15 03:35 . 2012-08-15 03:35   --------   d-----w-   c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2012-08-15 03:35 . 2012-08-15 03:35   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-08-15 03:35 . 2012-08-15 03:35   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-08-10 13:01 . 2012-08-15 01:00   --------   d-----w-   c:\documents and settings\NetworkService\Local Settings\Application Data\DoNotTrackPlus
2012-08-06 01:12 . 2012-08-06 01:49   --------   d-----w-   c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2012-07-23 00:00 . 2012-07-23 00:00   --------   d-sh--w-   c:\documents and settings\NetworkService\PrivacIE
2012-07-23 00:00 . 2012-08-13 04:12   --------   d-----w-   c:\documents and settings\NetworkService\Local Settings\Application Data\AskToolbar
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-13 13:19 . 2004-08-10 04:00   1866112   ----a-w-   c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2011-04-27 17:51   1372672   ----a-w-   c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-10 04:00   1172480   ----a-w-   c:\windows\system32\msxml3.dll
2012-06-04 21:35 . 2010-05-29 15:23   222448   ----a-w-   c:\windows\system32\muweb.dll
2012-06-04 04:32 . 2004-08-10 04:00   152576   ----a-w-   c:\windows\system32\schannel.dll
2012-06-02 19:19 . 2009-08-07 02:24   22040   ----a-w-   c:\windows\system32\wucltui.dll.mui
2012-06-02 19:19 . 2009-08-07 02:24   15384   ----a-w-   c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19 . 2004-08-10 04:00   329240   ----a-w-   c:\windows\system32\wucltui.dll
2012-06-02 19:19 . 2004-08-10 04:00   219160   ----a-w-   c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19 . 2004-08-10 04:00   210968   ----a-w-   c:\windows\system32\wuweb.dll
2012-06-02 19:19 . 2009-08-07 02:24   45080   ----a-w-   c:\windows\system32\wups2.dll
2012-06-02 19:19 . 2009-08-07 02:24   15384   ----a-w-   c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19 . 2004-08-10 04:00   97304   ----a-w-   c:\windows\system32\cdm.dll
2012-06-02 19:19 . 2004-08-10 04:00   53784   ----a-w-   c:\windows\system32\wuauclt.exe
2012-06-02 19:19 . 2004-08-10 04:00   35864   ----a-w-   c:\windows\system32\wups.dll
2012-06-02 19:19 . 2009-08-07 02:24   17944   ----a-w-   c:\windows\system32\wuaueng.dll.mui
2012-06-02 19:19 . 2004-08-10 04:00   577048   ----a-w-   c:\windows\system32\wuapi.dll
2012-06-02 19:19 . 2004-08-10 04:00   1933848   ----a-w-   c:\windows\system32\wuaueng.dll
2012-06-02 19:18 . 2010-05-29 15:23   275696   ----a-w-   c:\windows\system32\mucltui.dll
2012-06-02 19:18 . 2010-05-29 15:23   17136   ----a-w-   c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2004-08-10 04:00   599040   ----a-w-   c:\windows\system32\crypt32.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]
2012-02-10 15:28   1307928   ----a-w-   c:\program files\Microsoft\BingBar\7.1.361.0\BingExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-25 7311360]
"nwiz"="nwiz.exe" [2006-01-25 1519616]
"DISCover"="c:\program files\DISC\DISCover.exe" [2006-03-16 1077248]
"DiscUpdateManager"="c:\program files\DISC\DiscUpdMgr.exe" [2006-03-16 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 53096]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10t_ActiveX.exe" [2011-07-01 240288]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-5-5 27136]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-5-5 36903]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54   551296   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [10/11/2010 9:06 AM 84072]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 7:38 PM 116608]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [10/11/2010 9:05 AM 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [10/11/2010 9:06 AM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [10/11/2010 9:06 AM 141792]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [10/11/2010 9:06 AM 313288]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]
S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.EXE [2/10/2012 11:28 AM 193816]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/25/2011 4:02 AM 136176]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [8/6/2010 8:06 AM 203280]
S2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [10/11/2010 9:05 AM 271480]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [8/8/2010 9:48 PM 793048]
S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.EXE [2/10/2012 11:28 AM 240408]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [10/11/2010 9:06 AM 55840]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/25/2011 4:02 AM 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [10/11/2010 9:06 AM 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [10/11/2010 9:06 AM 84264]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - COMHOST
*NewlyCreated* - PXHELP20
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper   REG_MULTI_SZ      getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 21:57]
.
2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-25 08:00]
.
2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-25 08:00]
.
2012-08-11 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Compaq_Administrator.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2005-12-31 16:13]
.
2012-08-10 c:\windows\Tasks\Norton Security Scan for Compaq_Administrator.job
- c:\progra~1\NORTON~3\Engine\301~1.8\Nss.exe [2011-01-18 06:45]
.
2012-08-15 c:\windows\Tasks\PCConfidential.job
- c:\program files\Winferno\PC Confidential\PCConfidential.exe [2009-07-29 18:10]
.
2012-08-15 c:\windows\Tasks\RegPowerClean.job
- c:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe [2009-07-29 18:48]
.
2012-08-11 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2012-01-21 03:24]
.
2012-08-13 c:\windows\Tasks\RMSmartUpdate.job
- c:\program files\Registry Mechanic\Update.exe [2012-01-21 03:24]
.
2010-04-19 c:\windows\Tasks\RPCReminder.job
- c:\program files\Winferno\RegistryPowerCleaner\RPCReminder.exe [2009-07-29 18:34]
.
2012-08-15 c:\windows\Tasks\User_Feed_Synchronization-{8CD641F2-643E-439F-A5D7-45F4A6558B5B}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-Locked - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
HKLM-Run-PCDrProfiler - (no file)
HKLM-Run-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
HKLM-Run-Intel - c:\documents and settings\Compaq_Administrator\Application Data\Intel\Intel.exe
HKLM-Explorer_Run-5516 - c:\docume~1\ALLUSE~1\LOCALS~1\Temp\mswauao.scr
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-15 19:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ...
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5 977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,12,88,42,bd,e4,ca,7e,4c,ad,19,58,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839 E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,12,88,42,bd,e4,ca,7e,4c,ad,19,58,\
.
[HKEY_USERS\S-1-5-21-3642355760-1211948261-21286445-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5 977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a9,0f,e8,01,fd,43,af,4d,ab,4a,9b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839 E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a9,0f,e8,01,fd,43,af,4d,ab,4a,9b,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(640)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-08-15  19:43:51
ComboFix-quarantined-files.txt  2012-08-15 23:43
.
Pre-Run: 166,210,342,912 bytes free
Post-Run: 169,809,567,744 bytes free
.
- - End Of File - - 8A5745B0991D237C62BF7F44EDB0BD24

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/15/2012 at 01:38 AM

Application Version : 5.5.1012

Core Rules Database Version : 9059
Trace Rules Database Version: 6871

Scan type       : Complete Scan
Total Scan Time : 01:55:03

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned      : 342
Memory threats detected   : 0
Registry items scanned    : 33540
Registry threats detected : 839
File items scanned        : 262358
File threats detected     : 580

PUP.MyWebSearch
   HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
   HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32
   HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
   HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
   HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32
   HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
   HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\Programmable
   HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
   HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32
   HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
   HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
   HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32
   HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
   HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable
   [My Web Search Bar Search Scope Monitor] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\M3SRCHMN.EXE
   C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\M3SRCHMN.EXE
   [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
   C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
   HKLM\System\ControlSet001\Services\MYWEBSEARCHSERVICE
   C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSSVC.EXE
   HKLM\System\ControlSet001\Enum\Root\LEGACY_MYWEBSEARCHSERVICE
   C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\Local Settings\Temporary Internet Files\Content.IE5\I5GVUF2B\submitdiagnosticfile[8].php [ cache:mywebsearch.com ]
   C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\Local Settings\Temporary Internet Files\Content.IE5\UZEFYD4F\submitdiagnosticfile[1].php [ cache:mywebsearch.com ]
   C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\Local Settings\Temporary Internet Files\Content.IE5\OJYH0X8D\submitdiagnosticfile[7].php [ cache:mywebsearch.com ]
   HKLM\System\ControlSet002\Services\MYWEBSEARCHSERVICE
   HKLM\System\ControlSet002\Enum\Root\LEGACY_MYWEBSEARCHSERVICE
   HKLM\Software\Classes\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}
   HKCR\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}
   HKCR\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}
   HKCR\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}\InprocServer32
   HKCR\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}\InprocServer32#ThreadingModel
   HKCR\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}\Programmable
   HKCR\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}\TypeLib
   HKCR\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}
   HKCR\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\1.0
   HKCR\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\1.0\0
   HKCR\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\1.0\0\win32
   HKCR\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\1.0\FLAGS
   HKCR\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\1.0\HELPDIR
   HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
   HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
   HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
   HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
   HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
   HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
   HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
   HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
   HKCR\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
   HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
   HKCR\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
   HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
   HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
   HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
   HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
   HKLM\Software\Microsoft\Internet Explorer\Toolbar#{07B18EA9-A523-4961-B6BB-170DE4475CCA}
   HKU\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
   HKU\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
   C:\WINDOWS\Prefetch\M3SRCHMN.EXE-214A5037.pf
   C:\WINDOWS\Prefetch\MWSOEMON.EXE-22AAA5A1.pf
   HKCR\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}
   HKCR\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}\ProxyStubClsid
   HKCR\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}\ProxyStubClsid32
   HKCR\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}\TypeLib
   HKCR\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}\TypeLib#Version

PUP.MyWebSearch/FunWebProducts
   HKLM\SOFTWARE\Fun Web Products
   HKLM\SOFTWARE\Fun Web Products#JpegConversionLib
   HKLM\SOFTWARE\Fun Web Products#CacheDir
   HKLM\SOFTWARE\Fun Web Products\MSNMessenger
   HKLM\SOFTWARE\Fun Web Products\MSNMessenger#DLLFile
   HKLM\SOFTWARE\Fun Web Products\MSNMessenger#DLLDir
   HKLM\SOFTWARE\Fun Web Products\ScreenSaver
   HKLM\SOFTWARE\Fun Web Products\ScreenSaver#ImagesDir
   HKLM\SOFTWARE\Fun Web Products\ScreenSaver#PM
   HKLM\SOFTWARE\Fun Web Products\Settings
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#BuddyTextNone.numActive
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#BuddyTextNone.0
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#BuddyFreqNone
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#BuddyTextUninstalled.numActive
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#BuddyTextUninstalled.0
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#BuddyFreqUninstalled
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.numActive
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.numActive2
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.1
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.2
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.3
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.4
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.5
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.6
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.7
   HKLM\SOFTWARE\Fun Web Products\Settings\Promos#MSN.8
   HKLM\SOFTWARE\Fun Web Products\Settings\SmileyCentralBtn
   HKLM\SOFTWARE\Fun Web Products\Settings\SmileyCentralBtn#HTMLMenuPosDeleted
   HKLM\SOFTWARE\Fun Web Products\Settings\SmileyCentralBtn#LastHTMLMenuURL
   HKLM\SOFTWARE\Fun Web Products\Settings\SmileyCentralBtn#HTMLMenuRevision
   HKLM\SOFTWARE\Fun Web Products\Settings\SmileyCentralBtn#ETag
   HKU\.DEFAULT\SOFTWARE\MyWebSearch
   HKU\S-1-5-18\SOFTWARE\MyWebSearch
   HKLM\SOFTWARE\MyWebSearch
   HKLM\SOFTWARE\MyWebSearch\bar
   HKLM\SOFTWARE\MyWebSearch\bar#Maximized
   HKLM\SOFTWARE\MyWebSearch\bar#Visible
   HKLM\SOFTWARE\MyWebSearch\bar#UseFWB
   HKLM\SOFTWARE\MyWebSearch\bar#pid
   HKLM\SOFTWARE\MyWebSearch\bar#fwp
   HKLM\SOFTWARE\MyWebSearch\bar#psid
   HKLM\SOFTWARE\MyWebSearch\bar#un
   HKLM\SOFTWARE\MyWebSearch\bar#tiec
   HKLM\SOFTWARE\MyWebSearch\bar#Dir
   HKLM\SOFTWARE\MyWebSearch\bar#UninstallString
   HKLM\SOFTWARE\MyWebSearch\bar#PluginPath
   HKLM\SOFTWARE\MyWebSearch\bar#RegHookPath
   HKLM\SOFTWARE\MyWebSearch\bar#Id
   HKLM\SOFTWARE\MyWebSearch\bar#CurInstall
   HKLM\SOFTWARE\MyWebSearch\bar#SettingsDir
   HKLM\SOFTWARE\MyWebSearch\bar#sr
   HKLM\SOFTWARE\MyWebSearch\bar#pl
   HKLM\SOFTWARE\MyWebSearch\bar#CacheDir
   HKLM\SOFTWARE\MyWebSearch\bar#NextConfigRequest
   HKLM\SOFTWARE\MyWebSearch\bar#LastConfigRequest
   HKLM\SOFTWARE\MyWebSearch\bar#ConfigRevision
   HKLM\SOFTWARE\MyWebSearch\bar#ConfigRevisionURL
   HKLM\SOFTWARE\MyWebSearch\bar#ConfigDateStamp
   HKLM\SOFTWARE\MyWebSearch\bar#HTMLMenuRevision
   HKLM\SOFTWARE\MyWebSearch\bar#AlertCount
   HKLM\SOFTWARE\MyWebSearch\bar#AlertPeriod
   HKLM\SOFTWARE\MyWebSearch\bar#AlertPausePeriod
   HKLM\SOFTWARE\MyWebSearch\bar#NoThrottleAlert
   HKLM\SOFTWARE\MyWebSearch\bar#sscSet
   HKLM\SOFTWARE\MyWebSearch\bar#sscLabel
   HKLM\SOFTWARE\MyWebSearch\bar#sscURL
   HKLM\SOFTWARE\MyWebSearch\bar#Flags
   HKLM\SOFTWARE\MyWebSearch\bar#HistoryDir
   HKLM\SOFTWARE\MyWebSearch\bar#AutocompleteURL
   HKLM\SOFTWARE\MyWebSearch\bar#PostEvents
   HKLM\SOFTWARE\MyWebSearch\bar#NextEventsPost
   HKLM\SOFTWARE\MyWebSearch\bar#LastEventsPost
   HKLM\SOFTWARE\MyWebSearch\MWSOEMON
   HKLM\SOFTWARE\MyWebSearch\MWSOEMON#Version
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG#Version
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG#Path
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG#StandardSmileyDir.AIM
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.numActive2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.0
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.1
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.3
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.4
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.5
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.6
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.7
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.8
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#ICQT.9
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.numActive
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.numActive2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.0.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.1.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.2.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.3.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.4.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.5.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.6.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.7.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.8.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.9.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.10.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.11.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.12.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#Yahoo.13.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.numActive
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.numActive2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.0.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.1.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.2.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.3.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.4.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.5.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.6.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.7.old
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.8
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.9
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIM.10
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.numActive2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.0
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.1
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.3
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.4
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.5
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.6
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.7
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.8
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.9
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.10
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#AIMT.11
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.numActive2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.0
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.1
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.2
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.3
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.4
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.5
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.6
   HKLM\SOFTWARE\MyWebSearch\MWSOEPLG\Promo#GoogleTalkHTML.7
   HKLM\SOFTWARE\MyWebSearch\OEHosts
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows12
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows2
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows3
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows4
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows5
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows6
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows7
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows8
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows9
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows10
   HKLM\SOFTWARE\MyWebSearch\OEHosts#Windows11
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#pid
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#fwp
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#psid
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#esh
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#lsp
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#LastRequest
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#NextRequest
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#ABS
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#DES
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#ie8h
   HKLM\SOFTWARE\MyWebSearch\SearchAssistant#fs
   HKLM\SOFTWARE\MyWebSearch\SkinTools
   HKLM\SOFTWARE\MyWebSearch\SkinTools#PlayerPath
   HKCR\FunWebProducts.DataControl
   HKCR\FunWebProducts.DataControl\CLSID
   HKCR\FunWebProducts.DataControl\CurVer
   HKCR\FunWebProducts.DataControl.1
   HKCR\FunWebProducts.DataControl.1\CLSID
   HKCR\FunWebProducts.HistoryKillerScheduler
   HKCR\FunWebProducts.HistoryKillerScheduler\CLSID
   HKCR\FunWebProducts.HistoryKillerScheduler\CurVer
   HKCR\FunWebProducts.HistoryKillerScheduler.1
   HKCR\FunWebProducts.HistoryKillerScheduler.1\CLSID
   HKCR\FunWebProducts.HistorySwatterControlBar
   HKCR\FunWebProducts.HistorySwatterControlBar\CLSID
   HKCR\FunWebProducts.HistorySwatterControlBar\CurVer
   HKCR\FunWebProducts.HistorySwatterControlBar.1
   HKCR\FunWebProducts.HistorySwatterControlBar.1\CLSID
   HKCR\FunWebProducts.HTMLMenu
   HKCR\FunWebProducts.HTMLMenu\CLSID
   HKCR\FunWebProducts.HTMLMenu\CurVer
   HKCR\FunWebProducts.HTMLMenu.1
   HKCR\FunWebProducts.HTMLMenu.1\CLSID
   HKCR\FunWebProducts.HTMLMenu.2
   HKCR\FunWebProducts.HTMLMenu.2\CLSID
   HKCR\FunWebProducts.IECookiesManager
   HKCR\FunWebProducts.IECookiesManager\CLSID
   HKCR\FunWebProducts.IECookiesManager\CurVer
   HKCR\FunWebProducts.IECookiesManager.1
   HKCR\FunWebProducts.IECookiesManager.1\CLSID
   HKCR\FunWebProducts.KillerObjManager
   HKCR\FunWebProducts.KillerObjManager\CLSID
   HKCR\FunWebProducts.KillerObjManager\CurVer
   HKCR\FunWebProducts.KillerObjManager.1
   HKCR\FunWebProducts.KillerObjManager.1\CLSID
   HKCR\FunWebProducts.PopSwatterBarButton
   HKCR\FunWebProducts.PopSwatterBarButton\CLSID
   HKCR\FunWebProducts.PopSwatterBarButton\CurVer
   HKCR\FunWebProducts.PopSwatterBarButton.1
   HKCR\FunWebProducts.PopSwatterBarButton.1\CLSID
   HKCR\FunWebProducts.PopSwatterSettingsControl
   HKCR\FunWebProducts.PopSwatterSettingsControl\CLSID
   HKCR\FunWebProducts.PopSwatterSettingsControl\CurVer
   HKCR\FunWebProducts.PopSwatterSettingsControl.1
   HKCR\FunWebProducts.PopSwatterSettingsControl.1\CLSID
   HKCR\MyWebSearch.ChatSessionPlugin
   HKCR\MyWebSearch.ChatSessionPlugin\CLSID
   HKCR\MyWebSearch.ChatSessionPlugin\CurVer
   HKCR\MyWebSearch.ChatSessionPlugin.1
   HKCR\MyWebSearch.ChatSessionPlugin.1\CLSID
   HKCR\MyWebSearch.HTMLPanel
   HKCR\MyWebSearch.HTMLPanel\CLSID
   HKCR\MyWebSearch.HTMLPanel\CurVer
   HKCR\MyWebSearch.HTMLPanel.1
   HKCR\MyWebSearch.HTMLPanel.1\CLSID
   HKCR\MyWebSearch.OutlookAddin
   HKCR\MyWebSearch.OutlookAddin\CLSID
   HKCR\MyWebSearch.OutlookAddin\CurVer
   HKCR\MyWebSearch.OutlookAddin.1
   HKCR\MyWebSearch.OutlookAddin.1\CLSID
   HKCR\MyWebSearch.PseudoTransparentPlugin
   HKCR\MyWebSearch.PseudoTransparentPlugin\CLSID
   HKCR\MyWebSearch.PseudoTransparentPlugin\CurVer
   HKCR\MyWebSearch.PseudoTransparentPlugin.1
   HKCR\MyWebSearch.PseudoTransparentPlugin.1\CLSID
   HKCR\MyWebSearchToolBar.SettingsPlugin
   HKCR\MyWebSearchToolBar.SettingsPlugin\CLSID
   HKCR\MyWebSearchToolBar.SettingsPlugin\CurVer
   HKCR\MyWebSearchToolBar.SettingsPlugin.1
   HKCR\MyWebSearchToolBar.SettingsPlugin.1\CLSID
   HKCR\MyWebSearchToolBar.ToolbarPlugin
   HKCR\MyWebSearchToolBar.ToolbarPlugin\CLSID
   HKCR\MyWebSearchToolBar.ToolbarPlugin\CurVer
   HKCR\MyWebSearchToolBar.ToolbarPlugin.1
   HKCR\MyWebSearchToolBar.ToolbarPlugin.1\CLSID
   HKCR\ScreenSaverControl.ScreenSaverInstaller
   HKCR\ScreenSaverControl.ScreenSaverInstaller\CLSID
   HKCR\ScreenSaverControl.ScreenSaverInstaller\CurVer
   HKCR\ScreenSaverControl.ScreenSaverInstaller.1
   HKCR\ScreenSaverControl.ScreenSaverInstaller.1\CLSID
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\Control
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\InprocServer32
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\MiscStatus
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\MiscStatus\1
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\ProgID
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\Programmable
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\TypeLib
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\Version
   HKCR\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\VersionIndependentProgID
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\InprocServer32
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\InprocServer32#ThreadingModel
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\ProgID
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\Programmable
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\TypeLib
   HKCR\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\VersionIndependentProgID
   HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
   HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\TreatAs
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Implemented Categories
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\InprocServer32
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\InprocServer32#ThreadingModel
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Instance
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Instance#CLSID
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Instance\InitPropertyBag
   HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\Instance\InitPropertyBag#url
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\Control
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\InprocServer32
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\InprocServer32#ThreadingModel
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\MiscStatus
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\MiscStatus\1
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\ProgID
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\Programmable
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\TypeLib
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\Version
   HKCR\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\VersionIndependentProgID
   HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
   HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\InprocServer32
   HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\InprocServer32#ThreadingModel
   HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\ProgID
   HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\VersionIndependentProgID
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\Control
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\InprocServer32
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\InprocServer32#ThreadingModel
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\MiscStatus
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\MiscStatus\1
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\ProgID
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\Programmable
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\TypeLib
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\Version
   HKCR\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\VersionIndependentProgID
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\InprocServer32
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\InprocServer32#ThreadingModel
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\ProgID
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\Programmable
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\TypeLib
   HKCR\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\VersionIndependentProgID
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\InprocServer32
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\InprocServer32#ThreadingModel
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\ProgID
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\Programmable
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\TypeLib
   HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\VersionIndependentProgID
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\Control
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32#ThreadingModel
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\MiscStatus
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\MiscStatus\1
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\Programmable
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\Version
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\Control
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32#ThreadingModel
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\MiscStatus
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\MiscStatus\1
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\ProgID
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\Programmable
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\Version
   HKCR\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\VersionIndependentProgID
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\Control
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\InprocServer32#ThreadingModel
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\MiscStatus
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\MiscStatus\1
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\Programmable
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\Version
   HKCR\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
   HKCR\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}\InprocServer32
   HKCR\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}\InprocServer32#ThreadingModel
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\InprocServer32
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\InprocServer32#ThreadingModel
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\ProgID
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\Programmable
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\TypeLib
   HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\VersionIndependentProgID
   HKCR\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
   HKCR\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}\InprocServer32
   HKCR\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}\InprocServer32#ThreadingModel
   HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
   HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\InprocServer32
   HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\InprocServer32#ThreadingModel
   HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\ProgID
   HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\VersionIndependentProgID
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\InprocServer32
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\InprocServer32#ThreadingModel
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\MiscStatus
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\MiscStatus\1
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\ProgID
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\Programmable
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\TypeLib
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\Version
   HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\VersionIndependentProgID
   HKCR\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3}
   HKCR\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3}\TreatAs
   HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
   HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\InprocServer32
   HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\InprocServer32#ThreadingModel
   HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\Programmable
   HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\TypeLib
   HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
   HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\InprocServer32
   HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\InprocServer32#ThreadingModel
   HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\ProgID
   HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\Programmable
   HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\VersionIndependentProgID
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\InprocServer32
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\InprocServer32#ThreadingModel
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\MiscStatus
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\MiscStatus\1
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\ProgID
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\Programmable
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\TypeLib
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\Version
   HKCR\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\VersionIndependentProgID
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\InprocServer32
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\InprocServer32#ThreadingModel
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\MiscStatus
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\MiscStatus\1
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\ProgID
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\Programmable
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\TypeLib
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\Version
   HKCR\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\VersionIndependentProgID
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\InprocServer32
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\InprocServer32#ThreadingModel
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\ProgID
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\Programmable
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\TypeLib
   HKCR\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\VersionIndependentProgID
   HKCR\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
   HKCR\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\InprocServer32
   HKCR\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\InprocServer32#ThreadingModel
   HKCR\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\Programmable
   HKCR\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\TypeLib
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\Control
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\InprocServer32
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\InprocServer32#ThreadingModel
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\MiscStatus
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\MiscStatus\1
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\ProgID
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\Programmable
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\TypeLib
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\Version
   HKCR\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\VersionIndependentProgID
   HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}
   HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0
   HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\0
   HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\0\win32
   HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\FLAGS
   HKCR\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0\HELPDIR
   HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}
   HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0
   HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\0
   HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\0\win32
   HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\FLAGS
   HKCR\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\1.0\HELPDIR
   HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}
   HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0
   HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\0
   HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\0\win32
   HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\FLAGS
   HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\1.0\HELPDIR
   HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}
   HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0
   HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\0
   HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\0\win32
   HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\FLAGS
   HKCR\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\1.0\HELPDIR
   HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}
   HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0
   HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\0
   HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\0\win32
   HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\FLAGS
   HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\1.0\HELPDIR
   HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}
   HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0
   HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\0
   HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\0\win32
   HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\FLAGS
   HKCR\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\1.0\HELPDIR
   HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}
   HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0
   HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\0
   HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\0\win32
   HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\FLAGS
   HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\1.0\HELPDIR
   HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}
   HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0
   HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\0
   HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\0\win32
   HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\FLAGS
   HKCR\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\1.0\HELPDIR
   HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
   HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0
   HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0
   HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0\win32
   HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\FLAGS
   HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\HELPDIR
   HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}
   HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0
   HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\0
   HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\0\win32
   HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\FLAGS
   HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\1.0\HELPDIR
   HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}
   HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0
   HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\0
   HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\0\win32
   HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\FLAGS
   HKCR\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\1.0\HELPDIR
   HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}
   HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0
   HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\0
   HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\0\win32
   HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\FLAGS
   HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\1.0\HELPDIR
   HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
   HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}\ProxyStubClsid
   HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}\ProxyStubClsid32
   HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}\TypeLib
   HKCR\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}\TypeLib#Version
   HKCR\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
   HKCR\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}\ProxyStubClsid
   HKCR\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}\ProxyStubClsid32
   HKCR\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}\TypeLib
   HKCR\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}\TypeLib#Version
   HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}
   HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}\ProxyStubClsid
   HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}\ProxyStubClsid32
   HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}\TypeLib
   HKCR\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}\TypeLib#Version
   HKCR\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
   HKCR\Interface\{120927BF-1700-43BC-810F-FAB92549B390}\ProxyStubClsid
   HKCR\Interface\{120927BF-1700-43BC-810F-FAB92549B390}\ProxyStubClsid32
   HKCR\Interface\{120927BF-1700-43BC-810F-FAB92549B390}\TypeLib
   HKCR\Interface\{120927BF-1700-43BC-810F-FAB92549B390}\TypeLib#Version
   HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
   HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\ProxyStubClsid
   HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\ProxyStubClsid32
   HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\TypeLib
   HKCR\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\TypeLib#Version
   HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
   HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\ProxyStubClsid
   HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\ProxyStubClsid32
   HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\TypeLib
   HKCR\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\TypeLib#Version
   HKCR\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
   HKCR\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}\ProxyStubClsid
   HKCR\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}\ProxyStubClsid32
   HKCR\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}\TypeLib
   HKCR\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}\TypeLib#Version
   HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}
   HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
   HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
   HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
   HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version
   HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
   HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
   HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
   HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
   HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version
   HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}
   HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}\ProxyStubClsid
   HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}\ProxyStubClsid32
   HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}\TypeLib
   HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}\TypeLib#Version
   HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
   HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}\ProxyStubClsid
   HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}\ProxyStubClsid32
   HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}\TypeLib
   HKCR\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}\TypeLib#Version
   HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
   HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906}\ProxyStubClsid
   HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906}\ProxyStubClsid32
   HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906}\TypeLib
   HKCR\Interface\{3E720451-B472-4954-B7AA-33069EB53906}\TypeLib#Version
   HKCR\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
   HKCR\Interface\{3E720453-B472-4954-B7AA-33069EB53906}\ProxyStubClsid
   HKCR\Interface\{3E720453-B472-4954-B7AA-33069EB53906}\ProxyStubClsid32
   HKCR\Interface\{3E720453-B472-4954-B7AA-33069EB53906}\TypeLib
   HKCR\Interface\{3E720453-B472-4954-B7AA-33069EB53906}\TypeLib#Version
   HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
   HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}\ProxyStubClsid
   HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}\ProxyStubClsid32
   HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}\TypeLib
   HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}\TypeLib#Version
   HKCR\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
   HKCR\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}\ProxyStubClsid
   HKCR\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}\ProxyStubClsid32
   HKCR\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}\TypeLib
   HKCR\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}\TypeLib#Version
   HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
   HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\ProxyStubClsid
   HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\ProxyStubClsid32
   HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\TypeLib
   HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\TypeLib#Version
   HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
   HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}\ProxyStubClsid
   HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}\ProxyStubClsid32
   HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}\TypeLib
   HKCR\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}\TypeLib#Version
   HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
   HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid
   HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32
   HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib
   HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib#Version
   HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
   HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid
   HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid32
   HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib#Version
   HKCR\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
   HKCR\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid
   HKCR\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid32
   HKCR\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib#Version
   HKCR\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
   HKCR\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid
   HKCR\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid32
   HKCR\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib#Version
   HKCR\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
   HKCR\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid
   HKCR\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}\ProxyStubClsid32
   HKCR\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib
   HKCR\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}\TypeLib#Version
   HKCR\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
   HKCR\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}\ProxyStubClsid
   HKCR\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}\ProxyStubClsid32
   HKCR\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}\TypeLib
   HKCR\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}\TypeLib#Version
   HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
   HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244F69}\ProxyStubClsid
   HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244F69}\ProxyStubClsid32
   HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244F69}\TypeLib
   HKCR\Interface\{991AAC62-B100-47CE-8B75-253965244F69}\TypeLib#Version
   HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
   HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\ProxyStubClsid
   HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\ProxyStubClsid32
   HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\TypeLib
   HKCR\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\TypeLib#Version
   HKCR\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
   HKCR\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}\ProxyStubClsid
   HKCR\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}\ProxyStubClsid32
   HKCR\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}\TypeLib
   HKCR\Interface\{BBABDC90-F3D5-4801-863A

[SuperDave]

It would appear from that log that you're running two AV's on your computer; McAfee Anti-Virus and Anti-Spyware and Norton Internet Security 2006 which is a no-no. One will have to be disabled/removed. It looks like Norton is out-of-date. Try to uninstall it. If you have trouble doing that, please let me know and I'll give you a tool to remove it.

Registry cleaners are extremely powerful applications and their potential for harming your OS far outweighs any small potential for improving your computer's performance.
Winferno and Registry Mechanic
There are a number of them available and some are more safe than others. Keep in mind that no two registry cleaners work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad" entry. One cleaner may find entries on your system that will not cause a problem when removed, another may not find the same entries, and still another may want to remove entries required for a program to work. Without research into what the registry entry selected for deletion is, a registry cleaner can end up being an automated method to cause problems with the registry.

For routine use by those not familiar with the registry, the benefits to your computer are negligible while the potential risks are great.

Further reading: XP Fixes Myth #1: Registry Cleaners
**************************************************
•Please download Dial-A-Fix from one of the following mirrors:

Primary mirror
Secondary mirror

•Extract the zip file to your desktop.

•Double click Dial-a-Fix.exe to start the program. Dial-A-Fix might give you a lot errors, just ignore them and Click
to continue.

•Press the green double checkmark box (Looks like this:


UNcheck Empty Temp Folders, as well as Adjust Time/Date in the prep section. The prep section should then look like this:





•Click on Go

•Wait for Dial-A-Fix to finish (All the checks marks will be all gone)

•Close Dial-A-Fix
Please let me know if you can now access the internet.

[lemonlime]

Internet connection is working now, although it was awfully slow and I still get about a dozen error messages when Windows opens.  Dial a Fix did not let me check the group of blocks under MSI.

I never installed any registry cleaners so maybe they are part of a Windows update.  A few months ago "PC Tools" started showing up every time windows opens and it wants to run a clean registry program.  It started an automatic scan just now; had to cancel it.
I'm fine with uninstalling any of these, just show me how.

Windows also wants to update and restart.  Should I let it?

Should I try to run MBAM or CCleaner now?

[SuperDave]

although it was awfully slow and I still get about a dozen error messages when Windows opens. 

Such as?

I never installed any registry cleaners so maybe they are part of a Windows update. A few months ago "PC Tools" started showing up every time windows opens and it wants to run a clean registry program.  It started an automatic scan just now; had to cancel it.
I'm fine with uninstalling any of these, just show me how.

MS doesn't recommend Registry Cleaners. It probably came from PC Tools. I'll get you to run a program to see what's installed and then I will recommend how to remove it.

Please download: HiJackThis to your Desktop.

• Double Click the HijackThis icon, located on your Desktop.
  
• By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
• Accept the license agreement.
• Click the Open the Misc Tools section button.
  •Click on the Open Uninstall Manager button.
  •Click on the Save list... button and specify where you would like to save this file. When you press Save button a Notepad will open with the contents of that file. Save the file to your desktop.
  Copy and paste this file in your next reply.
  

*************************************************

Windows also wants to update and restart.  Should I let it?

Yes, by all means.

Should I try to run MBAM or CCleaner now?

Yes, please try to run them.

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

[lemonlime]

Windows updated, then Norton said a low risk program was trying to access and recommended access.  It was called A.exe and I OKd it.

Hijack This would not open. Explorer said it could not connect.

MBAM still getting error message Run time "0"

Sys Prot said my security settings would not allow it to run.

[SuperDave]

Please download MiniToolBox to Desktop and run it.



Checkmark the following boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• List content of Hosts
• List IP Configuration
• Lst Last 10 Event Viewer Errors
• List Users, Partitions and Memory Size
[/b]

Click Go and copy/paste the log (Result.txt) into your next post.

[lemonlime]

"Your security settings do not allow this file to be downloaded."  I uninstalled Norton (kept McAfee, which is giving me PC at risk warnings.)
Still get the same message.

[lemonlime]

I went back to safe mode and was able to run Hijack and Mini

Adobe Flash Player 10 ActiveX
Adobe Reader 7.0.5
Adobe Shockwave Player 11.6
Agere Systems PCI-SV92PP Soft Modem
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Bing Bar
Bonjour
Compaq Connections (remove only)
Customer Experience Enhancement
DISCover
Do Not Track Plus Add-on 2.2.0.705
Easy Internet Sign-up
Enhanced Multimedia Keyboard Solution
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Boot Optimizer
HP DVD Play 2.1
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Rhapsody
HP Software Update
HP Support Overview
HP Web Helper
iTunes
J2SE Runtime Environment 5.0 Update 5
Java(TM) 6 Update 20
LiveUpdate 3.0 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
McAfee Internet Security
McAfee Security Scan Plus
Microsoft .NET Framework 1.0 Hotfix (KB2572066)
Microsoft .NET Framework 1.0 Hotfix (KB2604042)
Microsoft .NET Framework 1.0 Hotfix (KB2656378)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Money 2006
Microsoft Office 2003 Edition 60 Days Trial Welcome Tour
Microsoft Office File Validation Add-In
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft UI Engine
Microsoft Works
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Netscape Browser (remove only)
Norton Security Scan
NVIDIA Drivers
OpenOffice.org 3.2
Otto
PC Tools Registry Mechanic 11.0
PC-Doctor 5 for Windows
Quicken 2006
QuickTime
RealPlayer
Realtek High Definition Audio Driver
Security Update for Microsoft Windows (KB2564958)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
Sonic Express Labeler
Sonic MyDVD Plus
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
SUPERAntiSpyware
swMSM
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB951978)
Update for Windows XP (KB953356)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Vz In Home Agent
Windows Live ID Sign-in Assistant
Windows Media Format Runtime
Windows XP Media Center Edition 2005 KB2502898
Windows XP Media Center Edition 2005 KB2619340
Windows XP Media Center Edition 2005 KB2628259
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB912067
Windows XP Media Center Edition 2005 KB973768
Windows XP Service Pack 3

MiniToolBox by Farbar  Version: 23-07-2012
Ran by Administrator (administrator) on 17-08-2012 at 23:29:46
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Network
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Successfully flushed the DNS Resolver Cache.


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================

127.0.0.1       localhost

========================= IP Configuration: ================================

NVIDIA nForce Networking Controller = Local Area Connection (Connected)


# ----------------------------------
# Interface IP Configuration         
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



        Host Name . . . . . . . . . . . . : your-4dacd0ea75

        Primary Dns Suffix  . . . . . . . :

        Node Type . . . . . . . . . . . . : Hybrid

        IP Routing Enabled. . . . . . . . : No

        WINS Proxy Enabled. . . . . . . . : No

        DNS Suffix Search List. . . . . . : home



Ethernet adapter Local Area Connection:



        Connection-specific DNS Suffix  . : home

        Description . . . . . . . . . . . : NVIDIA nForce Networking Controller

        Physical Address. . . . . . . . . : 00-17-31-9D-DA-12

        Dhcp Enabled. . . . . . . . . . . : Yes

        Autoconfiguration Enabled . . . . : Yes

        IP Address. . . . . . . . . . . . : 192.168.1.2

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . : 192.168.1.1

        DHCP Server . . . . . . . . . . . : 192.168.1.1

        DNS Servers . . . . . . . . . . . : 192.168.1.1

        Lease Obtained. . . . . . . . . . : Friday, August 17, 2012 11:07:37 PM

        Lease Expires . . . . . . . . . . : Saturday, August 18, 2012 11:07:37 PM

Server:  Wireless_Broadband_Router.home
Address:  192.168.1.1

Name:    google.com
Addresses:  74.125.228.69, 74.125.228.65, 74.125.228.66, 74.125.228.67
     74.125.228.70, 74.125.228.73, 74.125.228.68, 74.125.228.64, 74.125.228.71
     74.125.228.72, 74.125.228.78



Pinging google.com [74.125.228.65] with 32 bytes of data:



Reply from 74.125.228.65: bytes=32 time=17ms TTL=252

Reply from 74.125.228.65: bytes=32 time=16ms TTL=252



Ping statistics for 74.125.228.65:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 16ms, Maximum = 17ms, Average = 16ms

Server:  Wireless_Broadband_Router.home
Address:  192.168.1.1

Name:    yahoo.com
Addresses:  98.138.253.109, 98.139.183.24, 72.30.38.140



Pinging yahoo.com [98.139.183.24] with 32 bytes of data:



Reply from 98.139.183.24: bytes=32 time=67ms TTL=50

Reply from 98.139.183.24: bytes=32 time=63ms TTL=49



Ping statistics for 98.139.183.24:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 63ms, Maximum = 67ms, Average = 65ms

Server:  Wireless_Broadband_Router.home
Address:  192.168.1.1

Name:    bleepingcomputer.com
Address:  208.43.87.2



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:



Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 17 31 9d da 12 ...... NVIDIA nForce Networking Controller - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.2     20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1     1
      192.168.1.0    255.255.255.0      192.168.1.2     192.168.1.2     20
      192.168.1.2  255.255.255.255        127.0.0.1       127.0.0.1     20
    192.168.1.255  255.255.255.255      192.168.1.2     192.168.1.2     20
        224.0.0.0        240.0.0.0      192.168.1.2     192.168.1.2     20
  255.255.255.255  255.255.255.255      192.168.1.2     192.168.1.2     1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  None

========================= Event log errors: ===============================

Application errors:
==================
Error: (08/15/2012 08:18:33 PM) (Source: Application Error) (User: )
Description: Faulting application itunes.exe, version 10.6.1.7, faulting module msvcrt.dll, version 7.0.2600.5512, fault address 0x000381cd.
Processing media-specific event for [itunes.exe!ws!]

Error: (08/14/2012 10:46:42 PM) (Source: McLogEvent) (User: NT AUTHORITY)NT AUTHORITY
Description: Exception in McShield.Exe!

Exception details follow :

VSCORE.14.2.0.794
Exception Code       : 0XC0000005
Exception Address    : 0X0052004F
Exception Parameters : 2
 Param 1 = 0X00000001
 Param 2 = 00000000

More information :

Error: (08/14/2012 09:01:17 PM) (Source: Application Error) (User: )
Description: Faulting application DNTPService.exe, version 2.2.0.705, faulting module DNTPButton.dll, version 0.0.0.0, fault address 0x00002ed6.
Processing media-specific event for [DNTPService.exe!ws!]

Error: (08/13/2012 09:07:23 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (08/13/2012 09:07:23 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (08/12/2012 09:01:43 PM) (Source: Application Error) (User: )
Description: Faulting application DNTPService.exe, version 2.2.0.705, faulting module DNTPButton.dll, version 0.0.0.0, fault address 0x00002ed6.
Processing media-specific event for [DNTPService.exe!ws!]

Error: (08/11/2012 09:24:53 AM) (Source: Application Error) (User: )
Description: Faulting application iPodService.exe, version 10.6.1.7, faulting module unknown, version 0.0.0.0, fault address 0xffcd26db.
Error in creating result PEAP-TLV in response to received PEAP-TLV (iPodService.exe!ld!)

Error: (08/10/2012 11:29:53 PM) (Source: Application Error) (User: )
Description: Faulting application LuComServer_3_0.EXE, version 3.0.1.6, faulting module unknown, version 0.0.0.0, fault address 0xffcc26db.
Processing media-specific event for [LuComServer_3_0.EXE!ws!]

Error: (08/10/2012 11:25:06 PM) (Source: Application Error) (User: )
Description: Faulting application LuComServer_3_0.EXE, version 3.0.1.6, faulting module unknown, version 0.0.0.0, fault address 0xffcc26db.
Processing media-specific event for [LuComServer_3_0.EXE!ws!]

Error: (08/10/2012 11:23:13 PM) (Source: Application Error) (User: )
Description: Faulting application LuComServer_3_0.EXE, version 3.0.1.6, faulting module unknown, version 0.0.0.0, fault address 0xffcc26db.
Processing media-specific event for [LuComServer_3_0.EXE!ws!]


System errors:
=============
Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:53 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service McNaiAnn with arguments ""
in order to run the server:
{DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

Error: (08/17/2012 11:09:13 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
AmdK8
eeCtrl
Fips
SASDIFSV
SASKUTIL

Error: (08/17/2012 11:09:06 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}


Microsoft Office Sessions:
=========================
Error: (08/15/2012 08:18:33 PM) (Source: Application Error)(User: )
Description: itunes.exe10.6.1.7msvcrt.dll7.0.2600.55 12000381cd

Error: (08/14/2012 10:46:42 PM) (Source: McLogEvent)(User: NT AUTHORITY)NT AUTHORITY
Description: VSCORE.14.2.0.794
Exception Code       : 0XC0000005
Exception Address    : 0X0052004F
Exception Parameters : 2
 Param 1 = 0X00000001
 Param 2 = 00000000

More information :

Error: (08/14/2012 09:01:17 PM) (Source: Application Error)(User: )
Description: DNTPService.exe2.2.0.705DNTPButton.dll0 .0.0.000002ed6

Error: (08/13/2012 09:07:23 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (08/13/2012 09:07:23 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (08/12/2012 09:01:43 PM) (Source: Application Error)(User: )
Description: DNTPService.exe2.2.0.705DNTPButton.dll0 .0.0.000002ed6

Error: (08/11/2012 09:24:53 AM) (Source: Application Error)(User: )
Description: iPodService.exe10.6.1.7unknown0.0.0.0ff cd26db

Error: (08/10/2012 11:29:53 PM) (Source: Application Error)(User: )
Description: LuComServer_3_0.EXE3.0.1.6unknown0.0.0. 0ffcc26db

Error: (08/10/2012 11:25:06 PM) (Source: Application Error)(User: )
Description: LuComServer_3_0.EXE3.0.1.6unknown0.0.0. 0ffcc26db

Error: (08/10/2012 11:23:13 PM) (Source: Application Error)(User: )
Description: LuComServer_3_0.EXE3.0.1.6unknown0.0.0. 0ffcc26db


========================= Memory info: ===================================

Percentage of memory in use: 33%
Total physical RAM: 958.48 MB
Available physical RAM: 637.82 MB
Total Pagefile: 2313.31 MB
Available Pagefile: 2066.72 MB
Total Virtual: 2047.88 MB
Available Virtual: 1971.33 MB

========================= Partitions: =====================================

1 Drive c: (PRESARIO) (Fixed) (Total:224.68 GB) (Free:158.1 GB) NTFS
2 Drive d: (PRESARIO_RP) (Fixed) (Total:8.18 GB) (Free:0.5 GB) FAT32

========================= Users: ========================================

User accounts for \\YOUR-4DACD0EA75

Administrator            Compaq_Administrator     Guest                   
HelpAssistant            SUPPORT_388945a0         SUPPORT_fddfa904         


**** End of log ****

[lemonlime]

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
No Hidden Kernel Modules found

******************************************************************************************
******************************************************************************************
No SSDT Hooks found

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
No IRP Hooks found

******************************************************************************************
******************************************************************************************
Ports:
Local Address: YOUR-4DACD0EA75.HOME:1258
Remote Address: IAD23S05-IN-F2.1E100.NET:HTTP
Type: TCP
Process: 1868 (PID)
State: ESTABLISHED

Local Address: YOUR-4DACD0EA75.HOME:NETBIOS-SSN
Remote Address: 0.0.0.0:0
Type: TCP
Process: 4 (PID)
State: LISTENING

Local Address: YOUR-4DACD0EA75:MICROSOFT-DS
Remote Address: 0.0.0.0:0
Type: TCP
Process: 4 (PID)
State: LISTENING

Local Address: YOUR-4DACD0EA75:EPMAP
Remote Address: 0.0.0.0:0
Type: TCP
Process: 912 (PID)
State: LISTENING

Local Address: YOUR-4DACD0EA75.HOME:138
Remote Address: NA
Type: UDP
Process: 4 (PID)
State: NA

Local Address: YOUR-4DACD0EA75.HOME:NETBIOS-NS
Remote Address: NA
Type: UDP
Process: 4 (PID)
State: NA

Local Address: YOUR-4DACD0EA75:1083
Remote Address: NA
Type: UDP
Process: 1868 (PID)
State: NA

Local Address: YOUR-4DACD0EA75:1030
Remote Address: NA
Type: UDP
Process: 1188 (PID)
State: NA

Local Address: YOUR-4DACD0EA75:MICROSOFT-DS
Remote Address: NA
Type: UDP
Process: 4 (PID)
State: NA

******************************************************************************************
******************************************************************************************
No hidden files/folders found

[SuperDave]

Please try this Norton Removal Tool.

Norton/Symantec Removal Tool - Norton Removal Tool
*****************************************************

"Your security settings do not allow this file to be downloaded." 

Where and when do you see this warning?

******************************************************
Delete An Uninstall Entry

•Start HijackThis

•Click on the Open the Misc Tools section

•Click on the Open Uninstall Manager button.

•Highlight the entry you want to remove.
•Click Delete these entries
Ask Toolbar
PC Tools Registry Mechanic 11.0
****************************************************
Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
***********************************************************
I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[lemonlime]

The error messages when PC turns on are:
C/Documents - Windows cannot find C/Documents. Make sure you type name corretly and try again.

Destop - Could not load or run C/Desktop specified in the registry. Make sure the file exists on you computer or remove the reference to it in the registry

and - Windows cannot find and...
Setting /Compaq Administrator App - Windows cannot find...
Data Intel.exe - Windows cannot find
McAfee cannot update your software.  Please check your internet connection
Microsoft Visual C++Runtime Library - Runtime Error

Also, in today's history are websites I never accessed such as otraffixeng.com, eutimes.com, tubesplay.com

I had to reset my Internet security options to default in order to install the latest JAVA.  Should I leave it there?

Here is the ESET log:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d7157de55da5a64bb34fd423f26791cc
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-19 03:27:23
# local_time=2012-08-18 11:27:23 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=5121 16777190 100 75 52027989 61572661 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=207345
# found=15
# cleaned=0
# scan_time=7823
C:\Documents and Settings\Compaq_Administrator\Application Data\12F.exe.gonewiththewings   a variant of Win32/Kryptik.AKCT trojan (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\Application Data\35D.exe.gonewiththewings   a variant of Win32/Kryptik.AKCT trojan (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\Application Data\Cxvgvi.scr   a variant of Win32/Kryptik.AKCT trojan (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\Application Data\Iyvgvo.scr   Win32/Dorkbot.B worm (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\44\64de802c-7cb8453e   Java/Exploit.CVE-2012-0507.DM trojan (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\54\17266536-73c5444a   Java/Exploit.Agent.NCI trojan (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\Local Settings\Temp\153F.tmp   a variant of Win32/Agent.TVG trojan (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\My Documents\My Music\iLividSetupV1.exe   Win32/Toolbar.SearchSuite application (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\Compaq_Administrator\My Documents\My Music\iTunes\ac3filter_app_1200.exe   a variant of Win32/InstallIQ application (unable to clean)   00000000000000000000000000000000   I
C:\Program Files\Winferno\PC Confidential\PCCBHO.dll   Win32/Adware.PCConfidential application (unable to clean)   00000000000000000000000000000000   I
C:\Program Files\Winferno\PC Confidential\PCConfidential.exe   Win32/Adware.PCConfidential application (unable to clean)   00000000000000000000000000000000   I
C:\Program Files\Winferno\PC Confidential\PCCST.exe   Win32/Adware.PCConfidential application (unable to clean)   00000000000000000000000000000000   I
C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe   a variant of Win32/XrayMyPC application (unable to clean)   00000000000000000000000000000000   I
D:\I386\APPS\APP18921\src\CompaqPresario_Spring06.exe   a variant of Win32/Toolbar.MyWebSearch application (unable to clean)   00000000000000000000000000000000   I
D:\I386\APPS\APP18921\src\HPPavillion_Spring06.exe   a variant of Win32/Toolbar.MyWebSearch application (unable to clean)   00000000000000000000000000000000   I




Here is the ESET log: