Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Hidden system32 folder and other problems. Please help! [CLOS

Started by mondomon , Sep 03 2006 03:03 PM

  • This topic is locked This topic is locked

#16
Buckeye_Sam
Posted 13 September 2006 - 03:35 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Tell about Mcafee's reaction to this file. Does it find during a scan, or does it pop up suddenly and warn you? What other information does Mcafee offer about this file? Tell me exactly what it says.
  • 0

Advertisements

#17
mondomon
Posted 19 September 2006 - 06:44 AM

mondomon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
McAfee shows a pop-up of the error message constantly even after I click on Block All Access. I've attached a screen-shot of the pop up.
Also, when I try to open a link in a new window, the window comes up but it's minimized. I don't know if it's my browser or not. Win XP IE 6.0.

Thanks

Attached Files


  • 0

#18
Buckeye_Sam
Posted 19 September 2006 - 07:46 AM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Ok, I've dug up a bit more information on that file and I have been able to confirm that is malicious. Keep blocking it's access until we can get rid of it.


Download and scan with the free 15 day trial of Counterspy
Save the report when it's finished:
  • Once Counterspy has done scanning,the 'Scan Results' box will appear.
  • Click on 'View Results'.
  • Under (Recommended Action),using the drop down menus at the side of each entry found,set EVERYTHING to Remove.
  • Then click on Take Action.
  • Once everything has been removed,click on View Details.
  • Copy and Paste those details into your next reply here.

============


Download F-Secure Blacklight (blbeta.exe) to your C:\ drive.
- Open a command window. (Start > Run and type: cmd)
- Copy / paste or type the following in the command window:

C:\blbeta.exe /expert

- Accept the user agreement.
- Click Scan.
After the scan finishes, click on Next, then Exit. Please do not rename anything yet!

BlackLight will create a log in your C:\ drive with the name "fsbl-xxxxxxx.log", where the xxxx's are numbers. Please post that log here for me.
  • 0

#19
mondomon
Posted 20 September 2006 - 05:21 PM

mondomon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
09/20/06 19:01:05 [Info]: BlackLight Engine 1.0.46 initialized
09/20/06 19:01:05 [Info]: OS: 5.1 build 2600 (Service Pack 1)
09/20/06 19:01:05 [Note]: 7019 4
09/20/06 19:01:05 [Note]: 7005 0
09/20/06 19:01:05 [Note]: 7006 0
09/20/06 19:01:05 [Note]: 7011 1728
09/20/06 19:01:05 [Note]: 7026 0
09/20/06 19:01:05 [Note]: 7026 0
09/20/06 19:01:06 [Note]: 7024 3
09/20/06 19:01:06 [Info]: Hidden process: C:\WINDOWS\system32\protector.exe
09/20/06 19:01:06 [Note]: FSRAW library version 1.7.1019
09/20/06 19:05:36 [Info]: Hidden file: C:\WINDOWS\system32\protector.exe
09/20/06 19:05:36 [Note]: 7002 0
09/20/06 19:05:36 [Note]: 7003 1
09/20/06 19:05:36 [Note]: 10002 1
09/20/06 19:05:42 [Info]: Hidden file: c:\WINDOWS\system32\ntio256.sys
09/20/06 19:05:42 [Note]: 7002 0
09/20/06 19:05:42 [Note]: 7003 1
09/20/06 19:05:42 [Note]: 10002 1
09/20/06 19:07:42 [Note]: 7007 0


<!---------------------------- ---------------------------------->

Spyware Scan Details
Start Date: 06-09-20 6:07:03 PM
End Date: 06-09-20 6:40:12 PM
Total Time: 33 mins 9 secs

Detected spyware

SBSoft Browser Hijacker more information...
Status: Deleted

Infected files detected
c:\documents and settings\ray\application data\sbsoft\barlinks.ini
c:\documents and settings\ray\application data\sbsoft\dating.ico
c:\documents and settings\ray\application data\sbsoft\dating1.ico
c:\documents and settings\ray\application data\sbsoft\desk.ini
c:\documents and settings\ray\application data\sbsoft\finance.ico
c:\documents and settings\ray\application data\sbsoft\gambling.ico
c:\documents and settings\ray\application data\sbsoft\home.ico
c:\documents and settings\ray\application data\sbsoft\hot.ico
c:\documents and settings\ray\application data\sbsoft\kliksrch.ico
c:\documents and settings\ray\application data\sbsoft\links.ini
c:\documents and settings\ray\application data\sbsoft\mortgages.ico
c:\documents and settings\ray\application data\sbsoft\pharmaci.ico
c:\documents and settings\ray\application data\sbsoft\pharmacy.ico
c:\documents and settings\ray\application data\sbsoft\poker.ico
c:\documents and settings\ray\application data\sbsoft\privacy1.ico
c:\documents and settings\ray\application data\sbsoft\realest.ico
c:\documents and settings\ray\application data\sbsoft\search.ico
c:\documents and settings\ray\application data\sbsoft\sport.ico
c:\documents and settings\ray\application data\sbsoft\spyware.ico
c:\documents and settings\ray\application data\sbsoft\switch.ico
c:\documents and settings\ray\application data\sbsoft\toolbar.ini
c:\documents and settings\ray\application data\sbsoft\travel1.ico


ClearSearch Browser Hijacker more information...
Details: ClearSearch is an adware component that periodically contacts the search site, www.clrsch.com, for advertisement-tracking purposes.
Status: Deleted


DealHelper Browser Plug-in more information...
Details: DealHelper is an ad supported Internet Explorer browser helper object.
Status: Deleted


Esyndicate Browser Plug-in more information...
Details: Browser Helper Object
Status: Deleted

Infected files detected
c:\program files\esyndicate\uninst.exe

Infected registry entries detected
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\eSyndicate
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\eSyndicate DisplayName eSyndicate
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\eSyndicate UninstallString C:\Program Files\eSyndicate\Uninst.exe
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\eSyndicate NoModify 1
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\eSyndicate NoRepair 1


Unclassified.Spyware.43 Spyware more information...
Status: Deleted

Infected files detected
c:\windows\system32\wbcmuninst_helper.exe


PeopleOnPage Browser Hijacker more information...
Details: The PeopleOnPage program is an adware and browser hijacker that claims to be an Internet Explorer sidebar which claims to show a list of other users of the current site.
Status: Deleted

Infected files detected
C:\Documents and Settings\Ryan\Local Settings\Temp\AutoUpdate0\setup.inf


AproposMedia Browser Hijacker more information...
Details: A component of PeopleOnPage, sometimes found on machines without the commonly visible portion of the application. Spawns popup ads, and hijacks browser settings.
Status: Deleted

Infected files detected
C:\Documents and Settings\Ryan\Local Settings\Temp\~apropos0\ProxyStub.dll
C:\Documents and Settings\Ryan\Local Settings\Temp\~apropos0\WinGenerics.dll


WildTangent Low Risk Adware more information...
Details: WildTangent is an online gaming plugin bundle from Wildtangent.com similar to Macromedia’s flash. WildTangent uses a built in required feature that is used to provide adware based advertising to the user.
Status: Deleted

Infected files detected
C:\Program Files\AIM\AIMWDInstall.exe
C:\Program Files\AIM\Sysfiles\AIMWDInstall.exe
D:\Program Files\AIM\AIMWDInstall.exe
D:\Program Files\AIM\Sysfiles\AIMWDInstall.exe

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT.1\CLSID {FA13A9FA-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT.1 WildTangent Control
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT\CLSID {FA13A9FA-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT\CurVer WT3D.WT.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WT3D.WT WildTangent Control
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver.1\CLSID {7F23E6E5-0E79-4aee-B723-B1463805D5A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver.1 WTVisReceiver Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver\CLSID {7F23E6E5-0E79-4aee-B723-B1463805D5A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver\CurVer WTVis.WTVisReceiver.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisReceiver WTVisReceiver Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender.1\CLSID {B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender.1 WTVisSender Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender\CLSID {B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender\CurVer WTVis.WTVisSender.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WTVis.WTVisSender WTVisSender Class
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9}
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\sound.dll
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9}\InprocServer32 ThreadingModel Free
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9}\ProgID WTVis.WTVisReceiver.1
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9}\TypeLib {93795291-63D3-489c-B30E-5564CF578ABC}
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9}\VersionIndependentProgID WTVis.WTVisReceiver
HKEY_CLASSES_ROOT\clsid\{7f23e6e5-0e79-4aee-b723-b1463805d5a9} WTVisReceiver Class
HKEY_CLASSES_ROOT\clsid\{8ecf83a0-1ac9-11d4-8501-00a0cc5d1f63}
HKEY_CLASSES_ROOT\clsid\{8ecf83a0-1ac9-11d4-8501-00a0cc5d1f63}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax
HKEY_CLASSES_ROOT\clsid\{8ecf83a0-1ac9-11d4-8501-00a0cc5d1f63}\InprocServer32 ThreadingModel Both
HKEY_CLASSES_ROOT\clsid\{8ecf83a0-1ac9-11d4-8501-00a0cc5d1f63} WMplug Property Page
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5}
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\sound.dll
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5}\InprocServer32 ThreadingModel Free
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5}\ProgID WTVis.WTVisSender.1
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5}\TypeLib {B89CF276-BABD-4c52-8303-A44A335C6F84}
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5}\VersionIndependentProgID WTVis.WTVisSender
HKEY_CLASSES_ROOT\clsid\{b9ba256a-075b-49ea-b9e2-7dbc2ef021d5} WTVisSender Class
HKEY_CLASSES_ROOT\clsid\{ecfbe6e0-1ac8-11d4-8501-00a0cc5d1f63}
HKEY_CLASSES_ROOT\clsid\{ecfbe6e0-1ac8-11d4-8501-00a0cc5d1f63}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax
HKEY_CLASSES_ROOT\clsid\{ecfbe6e0-1ac8-11d4-8501-00a0cc5d1f63}\InprocServer32 ThreadingModel Both
HKEY_CLASSES_ROOT\clsid\{ecfbe6e0-1ac8-11d4-8501-00a0cc5d1f63} WMplug
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\MiscStatus\1 131473
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\MiscStatus 0
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\ProgID WT3D.WT.1
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\ToolboxBitmap32 C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll, 101
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\Version 1.0
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3}\VersionIndependentProgID WT3D.WT
HKEY_CLASSES_ROOT\clsid\{fa13a9fa-ca9b-11d2-9780-00104b242ea3} WildTangent Control
HKEY_CLASSES_ROOT\interface\{05ef74a5-e109-11d2-a566-444553540000}
HKEY_CLASSES_ROOT\interface\{05ef74a5-e109-11d2-a566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{05ef74a5-e109-11d2-a566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{05ef74a5-e109-11d2-a566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{05ef74a5-e109-11d2-a566-444553540000}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{05ef74a5-e109-11d2-a566-444553540000} IWTDrop
HKEY_CLASSES_ROOT\interface\{0e7ae465-ee8d-11d2-a566-444553540000}
HKEY_CLASSES_ROOT\interface\{0e7ae465-ee8d-11d2-a566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{0e7ae465-ee8d-11d2-a566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{0e7ae465-ee8d-11d2-a566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{0e7ae465-ee8d-11d2-a566-444553540000}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{0e7ae465-ee8d-11d2-a566-444553540000} IWTVector3D
HKEY_CLASSES_ROOT\interface\{1113c0b6-5300-4d5d-b2d7-35c14b28341b}
HKEY_CLASSES_ROOT\interface\{1113c0b6-5300-4d5d-b2d7-35c14b28341b}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{1113c0b6-5300-4d5d-b2d7-35c14b28341b}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{1113c0b6-5300-4d5d-b2d7-35c14b28341b}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{1113c0b6-5300-4d5d-b2d7-35c14b28341b}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{1113c0b6-5300-4d5d-b2d7-35c14b28341b} IWTActor
HKEY_CLASSES_ROOT\interface\{111d8b01-96c5-46dd-94d1-c6e8b1f69f44}
HKEY_CLASSES_ROOT\interface\{111d8b01-96c5-46dd-94d1-c6e8b1f69f44}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{111d8b01-96c5-46dd-94d1-c6e8b1f69f44}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{111d8b01-96c5-46dd-94d1-c6e8b1f69f44}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{111d8b01-96c5-46dd-94d1-c6e8b1f69f44}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{111d8b01-96c5-46dd-94d1-c6e8b1f69f44} IWTVisualizer
HKEY_CLASSES_ROOT\interface\{16410859-886f-4579-bc1f-330a139d0f0f}
HKEY_CLASSES_ROOT\interface\{16410859-886f-4579-bc1f-330a139d0f0f}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{16410859-886f-4579-bc1f-330a139d0f0f}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{16410859-886f-4579-bc1f-330a139d0f0f}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{16410859-886f-4579-bc1f-330a139d0f0f}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{16410859-886f-4579-bc1f-330a139d0f0f} IWTOnLoadEvent
HKEY_CLASSES_ROOT\interface\{35ed7dfb-a8ed-4216-a4bb-bc08c326ef08}
HKEY_CLASSES_ROOT\interface\{35ed7dfb-a8ed-4216-a4bb-bc08c326ef08}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{35ed7dfb-a8ed-4216-a4bb-bc08c326ef08}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{35ed7dfb-a8ed-4216-a4bb-bc08c326ef08}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{35ed7dfb-a8ed-4216-a4bb-bc08c326ef08}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{35ed7dfb-a8ed-4216-a4bb-bc08c326ef08} IWTCollisionInfo
HKEY_CLASSES_ROOT\interface\{399a8818-2000-436c-9a55-0016e5e3d227}
HKEY_CLASSES_ROOT\interface\{399a8818-2000-436c-9a55-0016e5e3d227}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{399a8818-2000-436c-9a55-0016e5e3d227}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{399a8818-2000-436c-9a55-0016e5e3d227}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{399a8818-2000-436c-9a55-0016e5e3d227}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{399a8818-2000-436c-9a55-0016e5e3d227} IWTPortal
HKEY_CLASSES_ROOT\interface\{52889e01-cb46-11d2-96bc-00104b242e64}
HKEY_CLASSES_ROOT\interface\{52889e01-cb46-11d2-96bc-00104b242e64}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{52889e01-cb46-11d2-96bc-00104b242e64}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{52889e01-cb46-11d2-96bc-00104b242e64}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{52889e01-cb46-11d2-96bc-00104b242e64}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{52889e01-cb46-11d2-96bc-00104b242e64} IWTCamera
HKEY_CLASSES_ROOT\interface\{5c49cbd2-8ed7-439b-8668-32149f84a235}
HKEY_CLASSES_ROOT\interface\{5c49cbd2-8ed7-439b-8668-32149f84a235}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{5c49cbd2-8ed7-439b-8668-32149f84a235}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{5c49cbd2-8ed7-439b-8668-32149f84a235}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{5c49cbd2-8ed7-439b-8668-32149f84a235}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{5c49cbd2-8ed7-439b-8668-32149f84a235} IWTSurfaceShader
HKEY_CLASSES_ROOT\interface\{6e6cf8e5-d795-11d2-a566-444553540000}
HKEY_CLASSES_ROOT\interface\{6e6cf8e5-d795-11d2-a566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{6e6cf8e5-d795-11d2-a566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{6e6cf8e5-d795-11d2-a566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{6e6cf8e5-d795-11d2-a566-444553540000}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{6e6cf8e5-d795-11d2-a566-444553540000} IWTBitmap
HKEY_CLASSES_ROOT\interface\{79884200-3ade-11d3-ac39-00105a2057fa}
HKEY_CLASSES_ROOT\interface\{79884200-3ade-11d3-ac39-00105a2057fa}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{79884200-3ade-11d3-ac39-00105a2057fa}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{79884200-3ade-11d3-ac39-00105a2057fa}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{79884200-3ade-11d3-ac39-00105a2057fa}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{79884200-3ade-11d3-ac39-00105a2057fa} IWTFile
HKEY_CLASSES_ROOT\interface\{810e95c2-f908-4e02-9b28-b92c3a778d0d}
HKEY_CLASSES_ROOT\interface\{810e95c2-f908-4e02-9b28-b92c3a778d0d}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{810e95c2-f908-4e02-9b28-b92c3a778d0d}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{810e95c2-f908-4e02-9b28-b92c3a778d0d}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{810e95c2-f908-4e02-9b28-b92c3a778d0d}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{810e95c2-f908-4e02-9b28-b92c3a778d0d} IWTAudioClip3D
HKEY_CLASSES_ROOT\interface\{aa0c96f9-a994-42d7-9543-842cf85e1ba7}
HKEY_CLASSES_ROOT\interface\{aa0c96f9-a994-42d7-9543-842cf85e1ba7}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{aa0c96f9-a994-42d7-9543-842cf85e1ba7}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{aa0c96f9-a994-42d7-9543-842cf85e1ba7}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{aa0c96f9-a994-42d7-9543-842cf85e1ba7}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{aa0c96f9-a994-42d7-9543-842cf85e1ba7} IWTJoystick
HKEY_CLASSES_ROOT\interface\{b57613b6-ef02-4d96-99c6-70c9a2014a14}
HKEY_CLASSES_ROOT\interface\{b57613b6-ef02-4d96-99c6-70c9a2014a14}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{b57613b6-ef02-4d96-99c6-70c9a2014a14}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{b57613b6-ef02-4d96-99c6-70c9a2014a14}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{b57613b6-ef02-4d96-99c6-70c9a2014a14}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{b57613b6-ef02-4d96-99c6-70c9a2014a14} IWTKeyboardPollInfo
HKEY_CLASSES_ROOT\interface\{bdb9b021-caff-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{bdb9b021-caff-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{bdb9b021-caff-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{bdb9b021-caff-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{bdb9b021-caff-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{bdb9b021-caff-11d2-9780-00104b242ea3} IWT
HKEY_CLASSES_ROOT\interface\{bdb9b022-caff-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{bdb9b022-caff-11d2-9780-00104b242ea3}\ProxyStubClsid {00020420-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{bdb9b022-caff-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020420-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{bdb9b022-caff-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{bdb9b022-caff-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{bdb9b022-caff-11d2-9780-00104b242ea3} _IWTEvents
HKEY_CLASSES_ROOT\interface\{c1da7ab8-54fc-4971-9afb-1bcb9afc3aa2}
HKEY_CLASSES_ROOT\interface\{c1da7ab8-54fc-4971-9afb-1bcb9afc3aa2}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c1da7ab8-54fc-4971-9afb-1bcb9afc3aa2}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c1da7ab8-54fc-4971-9afb-1bcb9afc3aa2}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{c1da7ab8-54fc-4971-9afb-1bcb9afc3aa2}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{c1da7ab8-54fc-4971-9afb-1bcb9afc3aa2} IWTString3D
HKEY_CLASSES_ROOT\interface\{c3a156d4-503f-4779-a673-657308d94faf}
HKEY_CLASSES_ROOT\interface\{c3a156d4-503f-4779-a673-657308d94faf}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c3a156d4-503f-4779-a673-657308d94faf}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c3a156d4-503f-4779-a673-657308d94faf}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{c3a156d4-503f-4779-a673-657308d94faf}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{c3a156d4-503f-4779-a673-657308d94faf} IWTShadow
HKEY_CLASSES_ROOT\interface\{d72ac8e7-f41d-11d2-a566-444553540000}
HKEY_CLASSES_ROOT\interface\{d72ac8e7-f41d-11d2-a566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{d72ac8e7-f41d-11d2-a566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{d72ac8e7-f41d-11d2-a566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{d72ac8e7-f41d-11d2-a566-444553540000}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{d72ac8e7-f41d-11d2-a566-444553540000} IWTOrientation3D
HKEY_CLASSES_ROOT\interface\{de3e540a-f0f2-4761-99be-afc6dc427e30}
HKEY_CLASSES_ROOT\interface\{de3e540a-f0f2-4761-99be-afc6dc427e30}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{de3e540a-f0f2-4761-99be-afc6dc427e30}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{de3e540a-f0f2-4761-99be-afc6dc427e30}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{de3e540a-f0f2-4761-99be-afc6dc427e30}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{de3e540a-f0f2-4761-99be-afc6dc427e30} IWTSysInfo
HKEY_CLASSES_ROOT\interface\{ea6f254d-1a8c-4518-8fe0-e9b94fd134ed}
HKEY_CLASSES_ROOT\interface\{ea6f254d-1a8c-4518-8fe0-e9b94fd134ed}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{ea6f254d-1a8c-4518-8fe0-e9b94fd134ed}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{ea6f254d-1a8c-4518-8fe0-e9b94fd134ed}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{ea6f254d-1a8c-4518-8fe0-e9b94fd134ed}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{ea6f254d-1a8c-4518-8fe0-e9b94fd134ed} IWTMousePollInfo
HKEY_CLASSES_ROOT\interface\{ec914a5c-7c4b-4ac8-8c86-c10ff5c0d23d}
HKEY_CLASSES_ROOT\interface\{ec914a5c-7c4b-4ac8-8c86-c10ff5c0d23d}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{ec914a5c-7c4b-4ac8-8c86-c10ff5c0d23d}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{ec914a5c-7c4b-4ac8-8c86-c10ff5c0d23d}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{ec914a5c-7c4b-4ac8-8c86-c10ff5c0d23d}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{ec914a5c-7c4b-4ac8-8c86-c10ff5c0d23d} IWTFont
HKEY_CLASSES_ROOT\interface\{f10493c1-d0b6-11d2-a566-444553540000}
HKEY_CLASSES_ROOT\interface\{f10493c1-d0b6-11d2-a566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{f10493c1-d0b6-11d2-a566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{f10493c1-d0b6-11d2-a566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{f10493c1-d0b6-11d2-a566-444553540000}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{f10493c1-d0b6-11d2-a566-444553540000} IWTLight
HKEY_CLASSES_ROOT\interface\{fa13aa3a-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aa3a-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa3a-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa3a-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aa3a-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aa3a-ca9b-11d2-9780-00104b242ea3} IWTObject
HKEY_CLASSES_ROOT\interface\{fa13aa3e-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aa3e-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa3e-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa3e-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aa3e-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aa3e-ca9b-11d2-9780-00104b242ea3} IWTModel
HKEY_CLASSES_ROOT\interface\{fa13aa40-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aa40-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa40-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa40-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aa40-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aa40-ca9b-11d2-9780-00104b242ea3} IWTContainer
HKEY_CLASSES_ROOT\interface\{fa13aa44-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aa44-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa44-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa44-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aa44-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aa44-ca9b-11d2-9780-00104b242ea3} IWTStage
HKEY_CLASSES_ROOT\interface\{fa13aa46-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aa46-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa46-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa46-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aa46-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aa46-ca9b-11d2-9780-00104b242ea3} IWTGroup
HKEY_CLASSES_ROOT\interface\{fa13aa50-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aa50-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa50-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aa50-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aa50-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aa50-ca9b-11d2-9780-00104b242ea3} IWTEvent
HKEY_CLASSES_ROOT\interface\{fa13aafa-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\interface\{fa13aafa-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aafa-ca9b-11d2-9780-00104b242ea3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{fa13aafa-ca9b-11d2-9780-00104b242ea3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{fa13aafa-ca9b-11d2-9780-00104b242ea3}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{fa13aafa-ca9b-11d2-9780-00104b242ea3} IWTAudioClip
HKEY_CLASSES_ROOT\interface\{feca7cfa-1083-4073-a98a-cf3389fcaf6a}
HKEY_CLASSES_ROOT\interface\{feca7cfa-1083-4073-a98a-cf3389fcaf6a}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{feca7cfa-1083-4073-a98a-cf3389fcaf6a}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{feca7cfa-1083-4073-a98a-cf3389fcaf6a}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\interface\{feca7cfa-1083-4073-a98a-cf3389fcaf6a}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{feca7cfa-1083-4073-a98a-cf3389fcaf6a} IWTSpout
HKEY_CLASSES_ROOT\typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}
HKEY_CLASSES_ROOT\typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}\1.0\0\win32 C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll
HKEY_CLASSES_ROOT\typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}\1.0\HELPDIR C:\WINDOWS\wt\webdriver\4.1.1\
HKEY_CLASSES_ROOT\typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}\1.0 WebDriver 1.0 Type Library
HKEY_CLASSES_ROOT\wt3d.wt
HKEY_CLASSES_ROOT\wt3d.wt\CLSID {FA13A9FA-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\wt3d.wt\CurVer WT3D.WT.1
HKEY_CLASSES_ROOT\wt3d.wt WildTangent Control
HKEY_CLASSES_ROOT\wt3d.wt.1
HKEY_CLASSES_ROOT\wt3d.wt.1\CLSID {FA13A9FA-CA9B-11D2-9780-00104B242EA3}
HKEY_CLASSES_ROOT\wt3d.wt.1 WildTangent Control
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver\CLSID {7F23E6E5-0E79-4aee-B723-B1463805D5A9}
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver\CurVer WTVis.WTVisReceiver.1
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver WTVisReceiver Class
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver.1
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver.1\CLSID {7F23E6E5-0E79-4aee-B723-B1463805D5A9}
HKEY_CLASSES_ROOT\wtvis.wtvisreceiver.1 WTVisReceiver Class
HKEY_CLASSES_ROOT\wtvis.wtvissender
HKEY_CLASSES_ROOT\wtvis.wtvissender\CLSID {B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}
HKEY_CLASSES_ROOT\wtvis.wtvissender\CurVer WTVis.WTVisSender.1
HKEY_CLASSES_ROOT\wtvis.wtvissender WTVisSender Class
HKEY_CLASSES_ROOT\wtvis.wtvissender.1
HKEY_CLASSES_ROOT\wtvis.wtvissender.1\CLSID {B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}
HKEY_CLASSES_ROOT\wtvis.wtvissender.1 WTVisSender Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\sound.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}\InprocServer32 ThreadingModel Free
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}\ProgID WTVis.WTVisReceiver.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}\TypeLib {93795291-63D3-489c-B30E-5564CF578ABC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9}\VersionIndependentProgID WTVis.WTVisReceiver
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F23E6E5-0E79-4aee-B723-B1463805D5A9} WTVisReceiver Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63}\InprocServer32 ThreadingModel Both
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ECF83A0-1AC9-11D4-8501-00A0CC5D1F63} WMplug Property Page
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\sound.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}\InprocServer32 ThreadingModel Free
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}\ProgID WTVis.WTVisSender.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}\TypeLib {B89CF276-BABD-4c52-8303-A44A335C6F84}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5}\VersionIndependentProgID WTVis.WTVisSender
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BA256A-075B-49ea-B9E2-7DBC2EF021D5} WTVisSender Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63}\InprocServer32 ThreadingModel Both
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECFBE6E0-1AC8-11D4-8501-00A0CC5D1F63} WMplug
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\InprocServer32 C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\InprocServer32 ThreadingModel Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\MiscStatus\1 131473
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\MiscStatus 0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\ProgID WT3D.WT.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\ToolboxBitmap32 C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll, 101
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3}\VersionIndependentProgID WT3D.WT
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA13A9FA-CA9B-11D2-9780-00104B242EA3} WildTangent Control
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05EF74A5-E109-11D2-A566-444553540000}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05EF74A5-E109-11D2-A566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05EF74A5-E109-11D2-A566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05EF74A5-E109-11D2-A566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05EF74A5-E109-11D2-A566-444553540000}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05EF74A5-E109-11D2-A566-444553540000} IWTDrop
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E7AE465-EE8D-11D2-A566-444553540000}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E7AE465-EE8D-11D2-A566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E7AE465-EE8D-11D2-A566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E7AE465-EE8D-11D2-A566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E7AE465-EE8D-11D2-A566-444553540000}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0E7AE465-EE8D-11D2-A566-444553540000} IWTVector3D
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1113C0B6-5300-4D5D-B2D7-35C14B28341B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1113C0B6-5300-4D5D-B2D7-35C14B28341B}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1113C0B6-5300-4D5D-B2D7-35C14B28341B}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1113C0B6-5300-4D5D-B2D7-35C14B28341B}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1113C0B6-5300-4D5D-B2D7-35C14B28341B}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1113C0B6-5300-4D5D-B2D7-35C14B28341B} IWTActor
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{111D8B01-96C5-46DD-94D1-C6E8B1F69F44} IWTVisualizer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16410859-886F-4579-BC1F-330A139D0F0F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16410859-886F-4579-BC1F-330A139D0F0F}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16410859-886F-4579-BC1F-330A139D0F0F}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16410859-886F-4579-BC1F-330A139D0F0F}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16410859-886F-4579-BC1F-330A139D0F0F}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{16410859-886F-4579-BC1F-330A139D0F0F} IWTOnLoadEvent
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35ED7DFB-A8ED-4216-A4BB-BC08C326EF08} IWTCollisionInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{399A8818-2000-436C-9A55-0016E5E3D227}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{399A8818-2000-436C-9A55-0016E5E3D227}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{399A8818-2000-436C-9A55-0016E5E3D227}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{399A8818-2000-436C-9A55-0016E5E3D227}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{399A8818-2000-436C-9A55-0016E5E3D227}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{399A8818-2000-436C-9A55-0016E5E3D227} IWTPortal
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52889E01-CB46-11D2-96BC-00104B242E64}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52889E01-CB46-11D2-96BC-00104B242E64}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52889E01-CB46-11D2-96BC-00104B242E64}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52889E01-CB46-11D2-96BC-00104B242E64}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52889E01-CB46-11D2-96BC-00104B242E64}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52889E01-CB46-11D2-96BC-00104B242E64} IWTCamera
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C49CBD2-8ED7-439B-8668-32149F84A235}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C49CBD2-8ED7-439B-8668-32149F84A235}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C49CBD2-8ED7-439B-8668-32149F84A235}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C49CBD2-8ED7-439B-8668-32149F84A235}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C49CBD2-8ED7-439B-8668-32149F84A235}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5C49CBD2-8ED7-439B-8668-32149F84A235} IWTSurfaceShader
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E6CF8E5-D795-11D2-A566-444553540000}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E6CF8E5-D795-11D2-A566-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E6CF8E5-D795-11D2-A566-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E6CF8E5-D795-11D2-A566-444553540000}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E6CF8E5-D795-11D2-A566-444553540000}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6E6CF8E5-D795-11D2-A566-444553540000} IWTBitmap
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79884200-3ADE-11D3-AC39-00105A2057FA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79884200-3ADE-11D3-AC39-00105A2057FA}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79884200-3ADE-11D3-AC39-00105A2057FA}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79884200-3ADE-11D3-AC39-00105A2057FA}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79884200-3ADE-11D3-AC39-00105A2057FA}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79884200-3ADE-11D3-AC39-00105A2057FA} IWTFile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{810E95C2-F908-4E02-9B28-B92C3A778D0D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{810E95C2-F908-4E02-9B28-B92C3A778D0D}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{810E95C2-F908-4E02-9B28-B92C3A778D0D}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{810E95C2-F908-4E02-9B28-B92C3A778D0D}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{810E95C2-F908-4E02-9B28-B92C3A778D0D}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{810E95C2-F908-4E02-9B28-B92C3A778D0D} IWTAudioClip3D
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0C96F9-A994-42D7-9543-842CF85E1BA7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0C96F9-A994-42D7-9543-842CF85E1BA7}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0C96F9-A994-42D7-9543-842CF85E1BA7}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0C96F9-A994-42D7-9543-842CF85E1BA7}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0C96F9-A994-42D7-9543-842CF85E1BA7}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA0C96F9-A994-42D7-9543-842CF85E1BA7} IWTJoystick
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B57613B6-EF02-4D96-99C6-70C9A2014A14}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B57613B6-EF02-4D96-99C6-70C9A2014A14}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B57613B6-EF02-4D96-99C6-70C9A2014A14}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B57613B6-EF02-4D96-99C6-70C9A2014A14}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B57613B6-EF02-4D96-99C6-70C9A2014A14}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B57613B6-EF02-4D96-99C6-70C9A2014A14} IWTKeyboardPollInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDB9B021-CAFF-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDB9B021-CAFF-11D2-9780-00104B242EA3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDB9B021-CAFF-11D2-9780-00104B242EA3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDB9B021-CAFF-11D2-9780-00104B242EA3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDB9B021-CAFF-11D2-9780-00104B242EA3}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BDB9B021-CAFF-11D2-9780-00104B242EA3} IWT
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AA46-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AA46-CA9B-11D2-9780-00104B242EA3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AA46-CA9B-11D2-9780-00104B242EA3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AA46-CA9B-11D2-9780-00104B242EA3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AA46-CA9B-11D2-9780-00104B242EA3}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AA46-CA9B-11D2-9780-00104B242EA3} IWTGroup
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AAFA-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AAFA-CA9B-11D2-9780-00104B242EA3}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AAFA-CA9B-11D2-9780-00104B242EA3}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AAFA-CA9B-11D2-9780-00104B242EA3}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AAFA-CA9B-11D2-9780-00104B242EA3}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA13AAFA-CA9B-11D2-9780-00104B242EA3} IWTAudioClip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A}\TypeLib {FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A}\TypeLib Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FECA7CFA-1083-4073-A98A-CF3389FCAF6A} IWTSpout
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}\1.0\0\win32 C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}\1.0\FLAGS 0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}\1.0\HELPDIR C:\WINDOWS\wt\webdriver\4.1.1\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FA13AA2E-CA9B-11D2-9780-00104B242EA3}\1.0 WebDriver 1.0 Type Library


TrojanDownloader.systemSoapPro.soap.exe Trojan more information...
Details: System Soap Pro is a shareware program to clean internet usage. It is also a Trojan for loading other adware programs.
Status: Deleted

Infected files detected
D:\Program Files\Acesoft\Tracks Eraser Pro\Plugins\quick.exe


SEP Adware more information...
Details: SEP installs a Browser Helper Object and an Internet Explorer toolbar.
Status: Deleted

Infected registry entries detected
HKEY_CURRENT_USER\Software\sep
HKEY_CURRENT_USER\Software\sep Guid {520850F0-A746-4FDE-8A69-77C9AA4C4F8A}
HKEY_CURRENT_USER\Software\sep SettingsUpdate 38497.7
HKEY_CURRENT_USER\Software\sep SearchEngineUpdate 38494.8
HKEY_CURRENT_USER\Software\sep SettingsInterval 48
HKEY_CURRENT_USER\Software\sep SettingsUrl http://www.searchreslt.com/settings/
HKEY_CURRENT_USER\Software\sep SearchEngineInterval 72
HKEY_CURRENT_USER\Software\sep SearchEngineUrl http://www.searchreslt.com/selist/
HKEY_CURRENT_USER\Software\sep AdUrl http://www.searchreslt.com/ad/
HKEY_CURRENT_USER\Software\sep PBPV 0


Memory Watcher Adware more information...
Details: Memory Watcher downloads files to the user's computer, possibly adware which will open pop-up windows.
Status: Deleted

Infected registry entries detected
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\memorywatcher
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\memorywatcher SlowInfoCache
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app management\arpcache\memorywatcher Changed 0


Cok.a.websponsors Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][1].txt


Cok.ad.yieldmanager Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][1].txt


AdKnowledge.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@adknowledge[2].txt


adrevolver Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@adrevolver[1].txt
c:\documents and settings\ray\cookies\ray@adrevolver[2].txt


PointRoll.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][2].txt


Adserver Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@adserver[1].txt


AdsRemote.Scripps.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][1].txt


Cok.PriceBandit Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@apmebf[2].txt


as-us.falkag Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][2].txt


BannerSpace.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@bannerspace[2].txt


Claria.DashBar Cookie Cookie more information...
Details: DashBar cookie is a small text file placed on the user's computer after when visiting the Claria/GAIN DashBar website.
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@belnk[1].txt


Bizrate Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@bizrate[1].txt


BurstNet.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@burstnet[2].txt


casalemedia.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@casalemedia[2].txt


CGI-Bin Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@cgi-bin[1].txt
c:\documents and settings\ray\cookies\ray@cgi-bin[2].txt


Clickability.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@clickability[2].txt


cookie.monster Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][2].txt


DealTime Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@dealtime[2].txt


Ru4.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][2].txt


GeoCities Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@geocities[1].txt


IndexTools.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@indextools[1].txt


Radar Spy 1.0 Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\[email protected][1].txt


maxserving Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@maxserving[1].txt


Offeroptimizer Cookie more information...
Details: Offeroptimizer is a cookie that tracks the unique visitors to a web site and their personal preferences.
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@offeroptimizer[2].txt


QuestionMarket.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@questionmarket[2].txt


RealMedia.com Cookie more information...
Status: Deleted

Infected cookies detected
c:\documents and settings\ray\cookies\ray@realmedia[1].txt


SageAnalyst Cookie more information...
Status: Deleted

Infected cookies detected
c:\docu
  • 0

#20
Buckeye_Sam
Posted 21 September 2006 - 03:57 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Select these items in blacklite and choose rename:



C:\WINDOWS\system32\protector.exe
c:\WINDOWS\system32\ntio256.sys



The tool will ask if you want to reboot (restart) choose yes.


==========



Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.
  • Save it to your desktop.
  • Please double-click Killbox.exe to run it.
  • Select:
    • Delete on Reboot
    • then Click on the All Files button.
  • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):



    C:\WINDOWS\system32\protector.exe.ren
    c:\WINDOWS\system32\ntio256.sys.ren



  • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

    If your computer does not restart automatically, please restart it manually.

  • After rebooting, open up Killbox again. Click File -> Logs -> Actions History Log
  • Post this log in your next reply.


Please post a new log from Blacklight.
Is Mcafee still upset about protector.exe now?
  • 0

#21
mondomon
Posted 22 September 2006 - 05:13 PM

mondomon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
I ran the blacklight scan, but it did not give me an option to rename. It scanned, then next to each file in it said <Action: none> I was not able to rename anything

Also, I ran the killbox scan but I could only do it for one file at a time. After each scan was completed, I got that message

"PendingFileRenameOperations Registry Data has been Removed by External Process!"

Here are the logs:

blacklight:
09/22/06 18:45:42 [Info]: BlackLight Engine 1.0.46 initialized
09/22/06 18:45:42 [Info]: OS: 5.1 build 2600 (Service Pack 1)
09/22/06 18:45:42 [Note]: 7019 4
09/22/06 18:45:42 [Note]: 7005 0
09/22/06 18:45:43 [Note]: 7006 0
09/22/06 18:45:43 [Note]: 7011 952
09/22/06 18:45:43 [Note]: 7026 0
09/22/06 18:45:43 [Note]: 7026 0
09/22/06 18:45:43 [Note]: 7024 3
09/22/06 18:45:43 [Info]: Hidden process: C:\WINDOWS\system32\protector.exe
09/22/06 18:45:43 [Note]: FSRAW library version 1.7.1019
09/22/06 18:50:39 [Info]: Hidden file: C:\WINDOWS\system32\protector.exe
09/22/06 18:50:39 [Note]: 7002 0
09/22/06 18:50:39 [Note]: 7003 1
09/22/06 18:50:39 [Note]: 10002 1
09/22/06 18:50:45 [Info]: Hidden file: c:\WINDOWS\system32\ntio256.sys
09/22/06 18:50:45 [Note]: 7002 0
09/22/06 18:50:45 [Note]: 7003 1
09/22/06 18:50:45 [Note]: 10002 1
09/22/06 18:53:35 [Note]: 7007 0


killbox:
Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Monday, September 04, 2006, 11:44 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\vhhcoqyi.exe


# 2 [Delete on Reboot]
Path = C:\57546148.exe


# 3 [Delete on Reboot]
Path = C:\16663120234.exe


I Rebooted @ 11:47:51 PM
Killbox Closed(Exit) @ 11:47:57 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Monday, September 04, 2006, 11:51 PM

Killbox Closed(Exit) @ 11:51:37 PM
__________________________________________________

Killbox Closed(Exit) @ 11:55:28 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Thursday, September 07, 2006, 8:15 PM

Killbox Closed(Exit) @ 8:16:02 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 6:54 PM

Killbox Closed(Exit) @ 6:57:26 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 6:57 PM

Killbox Closed(Exit) @ 6:58:51 PM
__________________________________________________

Pocket Killbox version
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 6:59 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\protector.exe.ren


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 7:01:09 PM
Killbox Closed(Exit) @ 7:01:43 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 7:04 PM

# 1 [Delete on Reboot]
Path = c:\WINDOWS\system32\ntio256.sys.ren


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 7:06:08 PM
Killbox Closed(Exit) @ 7:06:15 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 7:08 PM
  • 0

#22
Buckeye_Sam
Posted 23 September 2006 - 12:47 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Use Killbox to delete these files on reboot.

C:\WINDOWS\system32\protector.exe
c:\WINDOWS\system32\ntio256.sys


It's possible that Killbox will not be able to handle this job, so please run a new scan with Blacklight and post the log.
  • 0

#23
Buckeye_Sam
Posted 02 October 2006 - 03:22 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0

#24
Buckeye_Sam
Posted 02 October 2006 - 06:57 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Topic reopened.
  • 0

#25
mondomon
Posted 04 October 2006 - 06:47 PM

mondomon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
My backlight has expired. I have run a killbox scan, but I still get the McAfee warning.

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Monday, September 04, 2006, 11:44 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\vhhcoqyi.exe


# 2 [Delete on Reboot]
Path = C:\57546148.exe


# 3 [Delete on Reboot]
Path = C:\16663120234.exe


I Rebooted @ 11:47:51 PM
Killbox Closed(Exit) @ 11:47:57 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Monday, September 04, 2006, 11:51 PM

Killbox Closed(Exit) @ 11:51:37 PM
__________________________________________________

Killbox Closed(Exit) @ 11:55:28 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Thursday, September 07, 2006, 8:15 PM

Killbox Closed(Exit) @ 8:16:02 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 6:54 PM

Killbox Closed(Exit) @ 6:57:26 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 6:57 PM

Killbox Closed(Exit) @ 6:58:51 PM
__________________________________________________

Pocket Killbox version
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 6:59 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\protector.exe.ren


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 7:01:09 PM
Killbox Closed(Exit) @ 7:01:43 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 7:04 PM

# 1 [Delete on Reboot]
Path = c:\WINDOWS\system32\ntio256.sys.ren


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 7:06:08 PM
Killbox Closed(Exit) @ 7:06:15 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Friday, September 22, 2006, 7:08 PM

Killbox Closed(Exit) @ 7:14:15 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Monday, October 02, 2006, 6:16 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\system32\protector.exe


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 6:17:20 PM
# 2 [Delete on Reboot]
Path = C:\WINDOWS\system32\protector.exe


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 6:17:50 PM
Killbox Closed(Exit) @ 6:17:51 PM
__________________________________________________

Pocket Killbox version 2.0.0.881
Running on Windows XP as Ray(Administrator)
was started @ Wednesday, October 04, 2006, 8:47 PM
  • 0

Advertisements

#26
Buckeye_Sam
Posted 04 October 2006 - 07:04 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Ok, let's go with another Rootkit scanner.

Download GMER from here:
http://www.gmer.net/gmer.zip

Unzip it to the desktop and start GMER.exe
Click the Rootkit tab and click the Scan button.

Warning! Please do not select the "Show all" checkbox during the scan.

Once done, click the Copy button.
This will copy the results to your clipboard.
Paste the results here in your next reply.
  • 0

#27
mondomon
Posted 09 October 2006 - 06:24 PM

mondomon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
I have ran the rootkit scan, but for some reason it stops in the middle of the scan at the screen that is attached below.
Here is what I did copy from what it did scan. I'm not sure how long I should have to wait, but after about 10-20mins, the screen wouldn't change so I assumed the scan was finished. I clicked on cancel and it gave a message saying the scan didn't finish yet so I let it run for 20mins but nothing changed.
Let me know what you think.

Thanks
GMER 1.0.11.11390 - http://www.gmer.net
Rootkit 2006-10-09 20:18:31
Windows 5.1.2600 Service Pack 1


---- System - GMER 1.0.11 ----

SSDT F9640B3E ZwCreateFile
SSDT F96415AC ZwEnumerateKey
SSDT F9641662 ZwEnumerateValueKey
SSDT F9640A8A ZwOpenFile
SSDT \??\C:\Program Files\ewido anti-spyware 4.0\guard.sys ZwOpenProcess
SSDT F964097E ZwQueryDirectoryFile
SSDT F9641EEE ZwTerminateProcess

---- Devices - GMER 1.0.11 ----

Device \Driver\ntio256 \Device\poofpoof IRP_MJ_CREATE F964061E
Device \Driver\ntio256 \Device\poofpoof IRP_MJ_CLOSE F964061E
Device \Driver\ntio256 \Device\poofpoof IRP_MJ_DEVICE_CONTROL F9640528

---- Modules - GMER 1.0.11 ----

Module \??\C:\WINDOWS\System32\ntio256.sys (*** hidden *** ) F9640000

---- Processes - GMER 1.0.11 ----

Process C:\WINDOWS\system32\protector.exe (*** hidden *** ) 1316
Library C:\WINDOWS\system32\protector.exe (*** hidden *** ) @ C:\WINDOWS\system32\protector.exe [1316] 0x00400000

---- Services - GMER 1.0.11 ----

Service C:\WINDOWS\System32\ntio256.sys (*** hidden *** ) [AUTO] ntio256 <-- ROOTKIT !!!

Attached Files

  • Attached File  Doc2.doc   54.5KB   12 downloads

  • 0

#28
Buckeye_Sam
Posted 10 October 2006 - 05:25 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
That's enough to see that it's still there.

1. Please download The Avenger by Swandog46 to your Desktop.
  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:

C:\WINDOWS\System32\ntio256.sys
C:\WINDOWS\system32\protector.exe



Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.
  • Under "Script file to execute" choose "Input Script Manually".
  • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
  • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
  • Click Done
  • Now click on the Green Light to begin execution of the script
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply



I will be away from my PC in about 24 hours and I'll be gone for a few days. If you can run through this and post back today, we should be able to get this wrapped up once and for all. :whistling:

Edited by Buckeye_Sam, 10 October 2006 - 05:25 PM.

  • 0

#29
mondomon
Posted 10 October 2006 - 03:37 PM

mondomon

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
I tried running the avenger but I get an error message, saying it is an invalid script. I followed the instructions as you said, and I got that error message, if I have to wait until you get back, then that is fine for me. It did not run the scan at all.

Thanks
  • 0

#30
Buckeye_Sam
Posted 10 October 2006 - 03:45 PM

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Do you have this part at the beginning?

Files to delete:
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP