[chargerguy1973]

Hello,

My roommate's computer has been infected with the Smitfraud.c Trojan. I managed to install Spybot on his machine (which eliminated a number of other issues), but as a result of the infection, the machine will not allow me to install neither Ad-Aware nor AVG anti-virus. I have run HijackThis! as recommended and saved a logfile. The log is as follows:

Logfile of HijackThis v1.99.1
Scan saved at 6:42:20 PM, on 5/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\combop.exe
C:\WINDOWS\system32\combo.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar...spx?tb_id=50154
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKLM\..\Run: [Component Windows] C:\WINDOWS\system32\egac32r.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Global Startup: Belkin Wireless Network Monitor Utility (USB).lnk = C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1094601221400
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifes...ll/pinstall.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc1.webresp...p/TLIEFlash.CAB
O16 - DPF: {D05F33E0-3F75-11D3-A176-006008944486} (Audible Words Codec) - http://download.audi...36/awrdscdc.cab
O16 - DPF: {F229AB32-7BF9-4225-B78F-B4680AE6FC23} (Snapfish File Upload ActiveX Control) - http://www.snapfish....pfishUpload.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://content.konti...current/kdx.cab
O21 - SSODL: Remote Component - {944A59A8-D6ED-4CE2-8691-0771B2D09BB8} - C:\WINDOWS\system32\inetpapi.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Any and all help is appreciated in this matter. I look forward to resolving this issue on his computer quickly and efficiently.

Chris W.

Edit: I would like to note that the infection also disallows the opening of a variety of programs, from games to installers. However, it does allow Windows Media Player to run without issues thus far.

Edited by chargerguy1973, 12 May 2005 - 07:52 PM.

[Advertisements]

Hi there and welcome to GeeksToGo! my name is Kat, and I will be helping you get your pc fixed back up and on the go!

Since it has been a few days since your post, could you please post a fresh HJT log here for me to review? I will be back in the morning to take a look!

[Kat]

Hi there and welcome to GeeksToGo! my name is Kat, and I will be helping you get your pc fixed back up and on the go!

Since it has been a few days since your post, could you please post a fresh HJT log here for me to review? I will be back in the morning to take a look!

[chargerguy1973]

I apologize, but my roommate failed to log-on to his machine before he left for class, so I will try to get a new log this afternoon. Really, I am sorry for this inconvenience!

Edited by chargerguy1973, 19 May 2005 - 08:26 AM.

[Kat]

That's ok! I will be here most of the day!

[chargerguy1973]

Got it. I took this log from his computer about 5 minutes ago:

Logfile of HijackThis v1.99.1
Scan saved at 12:29:53 PM, on 5/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\system32\combop.exe
C:\WINDOWS\system32\combo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Avant Browser\avant.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar...spx?tb_id=50154
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: FlashEnhancer Ext - {5EDB03AF-0341-4e96-9E9B-3171522E4BAF} - c:\Program Files\Fla\fla.dll
O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [FlaCPY] "c:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKLM\..\RunOnce: [fla] "c:\Program Files\Common Files\Java\flaclean.exe"
O4 - HKLM\..\RunOnce: [f] "c:\Program Files\Fla\flaclean.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Global Startup: Belkin Wireless Network Monitor Utility (USB).lnk = C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1094601221400
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifes...ll/pinstall.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc1.webresp...p/TLIEFlash.CAB
O16 - DPF: {D05F33E0-3F75-11D3-A176-006008944486} (Audible Words Codec) - http://download.audi...36/awrdscdc.cab
O16 - DPF: {F229AB32-7BF9-4225-B78F-B4680AE6FC23} (Snapfish File Upload ActiveX Control) - http://www.snapfish....pfishUpload.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://content.konti...current/kdx.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

... There. That should do it! I look forward to your next reply!

[Kat]

ok, there are a few nasty infections running on this machine. I'm going to give you step by step instructions to get it cleaned back up. Please print my directions, or save them to a NotePad file on the desktop. Much of the fix will require you to be in Safe Mode, which will not allow you to access the internet. Please take your time, and follow each step in order.

1. A malicious .DLL file is disrupting the LSP chain on your computer. We need to get rid of it.

1. Please download LSPFix from here.
2. Run the LSPFix.exe that you have just finished downloading.
3. Check the I know what I'm doing box.
4. In the Keep box you should see one or more instances of flsmngr.dll
5. Select every instance of flsmngr.dll and move each one to the Remove box by clicking the >> button.
6. When you are done click Finish>>.

2. Please download the attachment smitfraud.zip. (found as an attachment to this post at the bottom of my reply) Save it to
your desktop. Now right click the zip and extract the smitfraud folder to your desktop. Do not open or use it yet, we will use it later.

3. Download CWShredder Here. Don’t do anything with it yet other than save it on your computer. We will use this program later.

4. I need you to download MWav to a convenient location.We will use this later.

5. Uninstall the following programs (if present) by going to
Start>Control Panel>Add and Remove Programs:
FlashEnhancer (or FLN)
FLA


6. Go to Start>Run and type "services.msc" (without quote) and hit OK. Locate the following service names, right click on them and choose properties. If they are running, stop them..set them to disabled. Click Apply, then Ok.

Remote Packet Capture Protocol v.0

Now, open HJT and click the "Open Misc Tools section
Click on "Delete an NT service" and enter Remote Packet Capture Protocol v.0
and click OK
Do the same for ATI Smart, then reboot your computer.

7. Reboot into Safe Mode by repeatedly tapping the F8 key as
your computer begins to Boot. You will be given an option to enter Safe
Mode. Logon to your user account.

Also, configure Windows Explorer to view hidden files as well as system files and extensions for known file
types.

8. Delete the following folders in bold (if present)
c:\Program Files\Fln
c:\Program Files\Fla

and the following files

C:\WINDOWS\system32\combop.exe
C:\WINDOWS\system32\combo.exe
C:\WINDOWS\system32\egac32r.exe
C:\WINDOWS\System32\spoolsrv32.exe
c:\Program Files\Common Files\Java\flacpy.exe
c:\Program Files\Common Files\Java\flaclean.exe


9. Open the smitfraud folder and double click the
RunThis.bat file to start the tool. Follow the prompts.

10. Locate CWShredder, and double click it to open.
Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

11. Open My Computer, right click Local disk C: and choose
properties, then disk cleanup. Check all boxes except compress old files
and click OK.


12. Please re-open HiJackThis and scan. Check the boxes next
to all the entries listed below (IF still present).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar...spx?tb_id=50154
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll

O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKLM\..\Run: [Component Windows] C:\WINDOWS\system32\egac32r.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKLM\..\Run: [FlaCPY] "c:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKLM\..\RunOnce: [fla] "c:\Program Files\Common Files\Java\flaclean.exe"
O4 - HKLM\..\RunOnce: [f] "c:\Program Files\Fla\flaclean.exe"

O9 - Extra button: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll
O9 - Extra button: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D38A0315-565B-4CEE-8ECE-787701933983} - C:\WINDOWS\system32\wldr.dll (HKCU)

O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifes...ll/pinstall.cab
O16 - DPF: {D05F33E0-3F75-11D3-A176-006008944486} (Audible Words Codec) - http://download.audi...36/awrdscdc.cab

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Now close all windows other than HiJackThis, then click Fix
Checked.

13. Locate the MWav program you downloaded earlier. This scan might take around 3+ hours to finish when set to scan everything.
I need you to run MWav by double-clicking on mwav.exe.
Put a check next to the below items before scanning:

• Memory
• Startup Folders
• Drive - All Local Drives
• Folder - then click "browse" to change the directory to C: (default is C:\Windows)
• Registry
• System Folders
• Services
• Include Sub-Directory
• Scan All Files

Please make sure ALL of these are checked, then press the Scan button. This typically will take hours to complete.

**NOTE*** Sometimes MWav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.

Highlight the portion of the scan that lists infected items and hold CTRL + C to Copy then paste it here. The whole log will be extremely BIG so there is no way to copy the whole thing. I just need the infected items list.

14. Make a reply here when all above steps are done. I would like to see a copy of the Infected Items List (if there is one) from MWav, along with a fresh HJT log. Also, let me know how things are running!

Edited by ~Kat~, 03 June 2005 - 10:39 AM.

[chargerguy1973]

Well, after a slightly-under-six-hour scan, it found over 120 virii. I was indeed surprised. The infected items are as follows:

Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "BetterInternet Adware" found in File System! Action Taken: No Action Taken.
Object "BetterInternet Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "myway Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "wsxsvc Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "GrokSter Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\FilePlanetDownloadCtrl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\pinstall.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\SnapfishUpload1405.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\plugincpl131.cpl". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-dan.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-cht.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-nld.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-fra.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-ita.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-jpn.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-kor.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-nor.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-ptg.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-rus.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-esp.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-fin.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-ptb.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-chs.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-plk.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-csy.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-sky.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-slv.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-hun.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-tha.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-trk.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-ell.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-esl.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Chs.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Cht.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Esp.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Fra.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Ita.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Jpn.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Kor.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Nld.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Ptg.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_chs.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_cht.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_deu.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_esl.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_esp.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_fra.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_ita.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_jpn.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_kor.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_nld.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_ptg.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Documents and Settings\All Users\Application Data\Ahead\NeroDigital\settings.xml". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Nero2\Nero ShowTime\ShowTime-Deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Nero2\Nero Recode\Recode-Deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\SnapfishUpload1405.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulac32.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\uvAC3Enc.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\pinstall.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Symantec Shared\Sevinst.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\FilePlanetDownloadCtrl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00014C0D-B007-4448-B89B-4EC3E857961D}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0098EEE0-75CD-11D3-8DD3-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00DBD9B0-4D98-11D3-ADEB-0004AC96AAB2}" refers to invalid object "C:\Program Files\ICQ\ICQPhon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{00F6280E-E711-11D3-BCF3-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQSMS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{036D5CD2-0631-11D4-BD1A-0004AC96B3B4}" refers to invalid object "C:\Program Files\ICQ\icqhops.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C0A83A0-7146-11D3-8DD2-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQInUn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C116522-3028-11D2-8A05-00104B9B48AB}" refers to invalid object "C:\Program Files\ICQ\ICQGreet.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C116523-3028-11D2-8A05-00104B9B48AB}" refers to invalid object "C:\Program Files\ICQ\ICQGreet.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0C9FD8E4-5DF3-11D3-ADFC-0004AC96AAB2}" refers to invalid object "C:\Program Files\ICQ\ICQPhon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0ED937FD-6612-11D3-BCCD-0004AC96B3B4}" refers to invalid object "C:\Program Files\ICQ\ICQPhon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{104DD9C3-402D-11D3-AF32-0090271A8BEA}" refers to invalid object "C:\Program Files\ICQ\ICQMlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1167C47F-01F9-4C08-8564-1D6C9BAAFB60}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\PATHFI~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1335272F-9B20-4CC3-8F24-5E95BE1D94BF}" refers to invalid object "C:\Program Files\ICQ\ICQSimpleApiPlugin.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1629A280-2D8C-11D3-BCCB-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQPict.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{18C55FEC-6614-11D3-BCCD-0004AC96B3B4}" refers to invalid object "C:\Program Files\ICQ\ICQPhon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1D009A58-1C67-11D4-BCD9-0004AC96DD96}" refers to invalid object "C:\Program Files\ICQ\ICQSearc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1D215721-7033-11D3-ADDF-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1EB5BE89-55B9-11D4-A49A-00D0B759B1D9}" refers to invalid object "C:\Program Files\ICQ\ICQSMS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{205D2DFB-BBAD-4DC4-A0BB-CDA12A1639CE}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{22803C10-1FD3-11D5-BE64-001083023C0D}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\g2p.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{229b78d5-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{229b78df-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{229b78e0-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{229b78e1-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{229b78e2-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}" refers to invalid object "C:\WINDOWS\system32\RMSDVDC.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{23DF73B4-D740-11D4-8DEE-0010B56F9E9E}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{23DF73B5-D740-11D4-8DEE-0010B56F9E9E}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{23DF73B6-D740-11D4-8DEE-0010B56F9E9E}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{23DF73B8-D740-11D4-8DEE-0010B56F9E9E}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{250B0184-3052-4EFB-AAA7-24429B8C0627}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\CTABRI~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{270FBE58-2F1D-415E-9C7F-16A1FFD79DA0}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{271BC450-D971-11D4-8DEF-0010B56F9E9E}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{279BCBAA-F6DE-11D4-BDA5-0004AC96B3B4}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{28069770-0265-11D3-8DB3-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQConLb.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{29188C02-B8A7-11D4-AE1A-0090270D8F00}" refers to invalid object "C:\Program Files\ICQ\ICQTsLib.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2A7E6911-211E-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2A7E6912-211E-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2A7E6913-211E-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2A7E6914-211E-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2A7E6915-211E-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2bf50447-ef62-11d3-bd00-0004ac96b3b4}" refers to invalid object "C:\Program Files\ICQ\icqhops.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2C217C90-4D91-11D3-ADEB-0004AC96AAB2}" refers to invalid object "C:\Program Files\ICQ\ICQPhon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2CF86D50-DE72-11D3-AB21-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQSearc.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DC84132-7F0E-11D3-AF37-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\ICQMlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DC84133-7F0E-11D3-AF37-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\ICQSdMl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DC84134-7F0E-11D3-AF37-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\ICQMlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E1174E9-F29B-11D3-BCE3-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQPhPl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E1174EA-F29B-11D3-BCE3-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQPhPl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E1174EB-F29B-11D3-BCE3-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQPhPl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2E30EDEA-572F-11D4-BD1D-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{302405BD-EB23-48C1-BFB1-6EDA3303B24F}" refers to invalid object "C:\Program Files\ICQ\ICQAddUs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{307E43FD-E76F-11D3-BCDE-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQOtlX.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{307E43FF-E76F-11D3-BCDE-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQOtlX.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{308D7795-5F17-4452-83C3-8E10492ABE22}" refers to invalid object "C:\WINDOWS\system32\AVICreator.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{30C7EEE2-DC7A-11D3-BCDD-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQOutL.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{30C7EEE4-DC7A-11D3-BCDD-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQOutL.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{30C8A6E1-351E-11D2-8A0B-00104B9B48AB}" refers to invalid object "C:\Program Files\ICQ\ICQUnkn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{312AF5B0-37BA-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{315C661F-270F-11D4-BD08-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQUsDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{315C6620-270F-11D4-BD08-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQUsDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{315C6621-270F-11D4-BD08-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQUsDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{315C6622-270F-11D4-BD08-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQUsDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{316DBA47-B612-489D-8CBF-7E455B05E0C7}" refers to invalid object "C:\Program Files\ICQ\ICQSimpleApi.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3421F881-3495-11D4-BD10-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQUsDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{343DA7CB-01A7-4503-A9AF-C84CF13B4381}" refers to invalid object "C:\Program Files\ICQ\ICQURL.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{34EAC540-2883-11D3-8DBB-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQPict.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{36CC7D55-EAF6-11D4-BD3B-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQPhCl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{371EF950-AFF7-11D4-B00A-00902736685D}" refers to invalid object "C:\Program Files\ICQ\Install\ICQToolsInstaller.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{373FE9A0-E94F-11D3-BCD2-0004AC96DD96}" refers to invalid object "C:\Program Files\ICQ\ICQInfM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{385963C5-6871-11D4-A4A4-00D0B759B1D9}" refers to invalid object "C:\Program Files\ICQ\ICQSMS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{385EB63F-30A0-11D4-BD0F-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQPhSt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{38BA1DB0-91F8-11D4-B002-00902736685A}" refers to invalid object "C:\Program Files\ICQ\ICQft.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3BA899E4-5333-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3DA8F160-4991-11D3-8DBE-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQRndP.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4025D2B0-379E-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{403D93E4-A7F1-11D2-AD33-00104B5F8CD8}" refers to invalid object "C:\Program Files\ICQ\ICQHttp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4062F230-379E-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{41250300-379E-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{42551950-379E-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{432C6240-5E77-47C8-906A-00B20FCF32EA}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{43E5F7CC-E85C-11D3-BCDF-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQCom45.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{43E5F7CE-E85C-11D3-BCDF-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQCom45.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{44C09855-B5F6-4ED1-8F4C-95216D580094}" refers to invalid object "C:\Program Files\ICQ\ICQAutomation.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{453020FA-3743-480c-B979-472C5FC25572}" refers to invalid object "C:\WINDOWS\system32\mptiff.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{467D0E2A-7676-11D4-BCE6-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQSndCntctLst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{47A11B2C-2B1C-11D4-BD1B-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQSMS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{483BE501-E42A-11D1-B679-006097E1E294}" refers to invalid object "C:\Program Files\ICQ\ICQGreet.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{488943DF-9280-480C-A94A-72722D3F4207}" refers to invalid object "C:\Program Files\ICQ\ICQSimpleApiPlugin.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4C11CA11-69D3-11D3-ADDE-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4E7AF4B0-8FCF-11D3-8DD7-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4E97BE17-3300-4A4F-B380-5988DD771F1F}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\ares.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{51F4ECE1-FD07-11D4-AE2F-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{532556E0-F055-11D3-BD01-0004AC96B3B4}" refers to invalid object "C:\Program Files\ICQ\icqhops.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{53F41597-20E8-11D4-BCFD-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5598DA60-70EA-11D3-AF2E-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\ICQP3c.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{561C9ED1-503B-11D4-AE29-0090271A8BEA}" refers to invalid object "C:\Program Files\ICQ\ICQCheck.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5696745A-F3BD-11D4-8A1D-001083023C0D}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\IE_NDS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{56D7C520-5E0B-11D3-8DC8-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{570158C3-B87B-11D4-BD2F-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQChtE.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5788DAE8-4B72-4BE6-89A0-1E6123E4CBC2}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\cerberus.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5A881D65-2A73-11D4-BD0A-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQWp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5C1E1E50-DD9E-11D3-AB1F-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQWhite.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5D11ADA3-5342-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5E87218D-E854-11D3-BCE1-0004AC96A2D7}" refers to invalid object "C:\Program Files\ICQ\ICQPhCl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5FD4D15E-7F33-11D3-BCC6-0004AC96AB1F}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6090EBD0-4421-11D3-8DBC-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{61C9CA32-1F7D-11D4-AE17-0090271A8BEA}" refers to invalid object "C:\Program Files\ICQ\ICQCheck.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{639A19DD-1D97-4A6E-A0D1-01E04FED563F}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{63B9B0A3-E2DE-405E-BADB-F1ED7B921783}" refers to invalid object "C:\Program Files\ICQ\ICQft.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6410C3A0-A732-11D3-9CFD-00A0C95949D5}" refers to invalid object "C:\Program Files\Creative\ShareDLL\pfmod.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{644E6D31-144E-11D4-ADF8-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\MapiMl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{651E794E-CB38-4657-A3D6-CF3F698E02AC}" refers to invalid object "C:\Program Files\ICQ\ICQFeatures.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{66537E70-DC99-11D3-AB1C-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6833E600-F6D8-11D4-8A1F-001083023C0D}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\IE_NDS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{692A08F5-8D7F-11D4-A4C5-00D0B759B1D9}" refers to invalid object "C:\Program Files\ICQ\ICQURL.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{692A08F6-8D7F-11D4-A4C5-00D0B759B1D9}" refers to invalid object "C:\Program Files\ICQ\ICQURL.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6EDA439D-F7C7-11d4-8A20-001083023C0D}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\IE_NDS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{70061810-7154-11D3-8DD2-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQStUn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71BF02F0-7143-11D3-8DD2-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQInUn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{72581C37-87E9-11D4-A4C1-00D0B759B1D9}" refers to invalid object "C:\Program Files\ICQ\ICQURL.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{739CBE18-2C58-4DC5-9E48-E30AB45174A7}" refers to invalid object "C:\WINDOWS\system32\WMVCreator.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}" refers to invalid object "C:\WINDOWS\system32\RMSDVDC.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{78591D32-61B5-4BD7-8BE1-231639F83A34}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{791A036E-D89A-11D3-BCD5-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQPhCl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7C9688C3-7279-474D-ABA5-A632373D2CDB}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{80874F19-2720-11D4-BD08-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83286680-2880-11D3-8DBB-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQPict.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{86BA0820-1E85-11D3-8DB6-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQTsLib.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{86E134E6-7748-11D4-BCE8-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQSndCntctLst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88CBF1CB-6F55-11D8-ABF8-C5E6374AC960}" refers to invalid object "C:\Program Files\Cheetah Burner\CheetahCtxMnu.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88EC1721-69D8-11D3-ADED-0090271A8BEA}" refers to invalid object "C:\Program Files\ICQ\ICQReg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{89712930-5BF1-11D3-8DC8-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8B434706-F79A-11D4-AE2A-0090270D8F00}" refers to invalid object "C:\Program Files\ICQ\ICQTsLib.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{93E8B802-4A97-11D3-AF3A-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}" refers to invalid object "C:\WINDOWS\system32\RMSDVDC.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{94492D50-42B3-11D3-8DBC-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96376877-24FE-11D4-BD05-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQPref.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96BDBE35-8D65-11D4-B001-00902736685A}" refers to invalid object "C:\Program Files\ICQ\ICQft.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96BDBE36-8D65-11D4-B001-00902736685A}" refers to invalid object "C:\Program Files\ICQ\ICQft.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{96E4C401-3569-11D4-BD10-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\icqentry.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99BAFE61-4758-11D4-AE09-0090270D827A}" refers to invalid object "C:\Program Files\ICQ\ICQMlp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9CA7F290-379E-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9D486540-379E-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9F82FA00-E332-11D3-AB31-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9F9012BA-E55B-11D3-ADE7-0090270D8F00}" refers to invalid object "C:\PROGRA~1\ICQ\ICQHTT~1.OCX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9F9892BA-D7F9-11D3-BCDE-0004AC96A2D7}" refers to invalid object "C:\Program Files\ICQ\ICQPhTel.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A105BD70-BF56-4D10-BC91-41C88321F47C}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A25884D1-CFF7-11D2-8A42-00104B9B48AB}" refers to invalid object "C:\Program Files\ICQ\ICQSmLib.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A74F4EF0-8FB4-11D3-8DD7-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A8EC79F0-354D-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ADE97025-ADB4-11D4-BD49-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ADE97026-ADB4-11D4-BD49-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AEA71671-51D3-11D4-AE2A-0090271A8BEA}" refers to invalid object "C:\Program Files\ICQ\ICQCheck.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AED456C4-4866-4420-863F-35767EBED514}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AFDED58B-211F-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AFDED58C-211F-11D4-BCFF-000629EE4DA1}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B0807FE0-008D-4E08-82D8-00BA8E47D3B2}" refers to invalid object "C:\WINDOWS\system32\fldrvw51.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B220F7BF-8E37-11D4-BD28-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQPlCht.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B220F7C8-8E37-11D4-BD28-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQPlCht.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B220F7C9-8E37-11D4-BD28-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQPlCht.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B4F80028-5714-4B7B-B9B1-5748B204799A}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B4FEEF4A-D8FA-11D3-BCEE-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQPhPl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B72370B3-3B95-4A43-8D10-2F4E1B09965B}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B728D180-65E1-11D3-BCEF-0050048EBC8A}" refers to invalid object "C:\Program Files\ICQ\icqDatLb.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B8276F44-7747-11D4-BCE8-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQSndCntctLst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B86631CA-E9C8-11D3-BCDF-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQEudo.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B86631CE-E9C8-11D3-BCDF-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQEudo.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B884ACF0-FE83-11D3-BCD2-0004AC96DD96}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B903C411-920E-11D3-AF5A-0090270D8F00}" refers to invalid object "C:\Program Files\ICQ\ICQUnkn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B9F3009B-976B-41C4-A992-229DCCF3367C}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\axtrack.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BA1AF90E-00C7-11D5-B024-00902736685A}" refers to invalid object "C:\Program Files\ICQ\ICQControls.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BA8943D1-CC5F-11D4-AE21-0090270D8F00}" refers to invalid object "C:\Program Files\ICQ\ICQBase.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BBDFEC89-3555-11D4-BD29-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\outlk.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BC55995F-D9F9-11D2-8A45-00104B9B48AB}" refers to invalid object "C:\Program Files\ICQ\ICQFTLib.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bc8a96c4-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bc8a96c5-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bc8a96c6-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bc8a96c7-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bc8a96c8-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\CDDBCO~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BEBAD152-915A-11D3-ADF8-0090271A8BEA}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BEC3B500-354D-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BEFAFF10-4A4E-11D3-8DBE-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQTsLib.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C0139EF2-53C6-11D3-AF47-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C0A1CA1E-9F8A-11D4-BD00-0004AC961EA6}" refers to invalid object "C:\Program Files\ICQ\ICQSndCntctLst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C0FEB746-F860-11D3-BCFB-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQSMS.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C5D28581-CA46-11D2-A150-00104B9B4C0E}" refers to invalid object "C:\Program Files\ICQ\PoP3.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C5D28583-CA46-11D2-A150-00104B9B4C0E}" refers to invalid object "C:\Program Files\ICQ\ICQCp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C60B7F30-379D-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C6D533F0-379D-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C748F300-6A47-11D3-BCF0-0050048EBC8A}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C750FA20-379D-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C7CA8B42-2707-11D4-BCFB-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQExCt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C83AB930-2CED-11D4-BCDF-0004AC96DD96}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C8842B90-35F9-11D3-BCD7-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C8D02300-6A47-11D3-BCF0-0050048EBC8A}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C933A1F0-705D-11D3-BCC5-0004AC96AB1F}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CD134661-AB31-42E4-B0F8-44096D2BB370}" refers to invalid object "C:\Program Files\ICQ\ICQAddUs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C49-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C4A-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C4B-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C4C-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C4E-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C4F-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C50-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C51-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C56-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C5A-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C5C-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C5D-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C5E-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C5F-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CF146C60-52F4-11D3-AF45-0090270D6DEC}" refers to invalid object "C:\Program Files\ICQ\ICQStDlg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D140CF10-E94F-11D3-BCD2-0004AC96DD96}" refers to invalid object "C:\Program Files\ICQ\ICQStatM.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D28EB020-65E1-11D3-BCEF-0050048EBC8A}" refers to invalid object "C:\Program Files\ICQ\icqDatLb.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D2DAF780-3C5F-11D3-BCE9-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D3C1567B-FABE-40F0-A47F-C03A48BCA64E}" refers to invalid object "C:\WINDOWS\system32\AVICreator.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D465B936-C361-4417-9AC5-35167066F84B}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D68E4B1C-02E7-11D4-BCE8-0004AC96D905}" refers to invalid object "C:\Program Files\ICQ\ICQExCt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D81ADC49-B724-468C-89FC-D39AEB8A9956}" refers to invalid object "C:\WINDOWS\system32\SMDC.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D8CA0A70-7510-11D3-8DD3-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQInUn.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D9122DF0-9130-11D3-8DD7-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQft.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D95D4430-FDBE-11D4-BDA7-0004AC96B3B4}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D9D23B50-3C5F-11D3-BCE9-0050048EBC8D}" refers to invalid object "C:\Program Files\ICQ\ICQCool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D9F99C6B-A3A6-11D4-AF64-444553546170}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DB8E4741-799A-11D3-AF44-0090270D8F00}" refers to invalid object "C:\Program Files\ICQ\ICQSdMl.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DF0E9111-01DF-11D5-BA23-001083780941}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\CALPRI~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DF66FBC0-4D97-11D3-ADEB-0004AC96AAB2}" refers to invalid object "C:\Program Files\ICQ\ICQPhon.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DFAB8460-53CC-11D3-8DC0-00104B06462E}" refers to invalid object "C:\Program Files\ICQ\ICQPict.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E126E584-7A88-433C-9920-99419257C7BF}" refers to invalid object "C:\Program Files\ICQ\ICQft.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}" refers to invalid object "C:\WINDOWS\system32\RMSDVDC.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E3852604-B619-11d6-94EC-00047521F020}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\nmpxchat\nmpxchat.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E3DAAAAB-2F30-11d4-BD24-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQSmsSt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E3DAAAAC-2F30-11d4-BD24-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQSmsSt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E3DAAAAD-2F30-11d4-BD24-0004AC969DC2}" refers to invalid object "C:\Program Files\ICQ\ICQSmsSt.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E5151CBE-F61D-11D4-BA21-001083780941}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\CALPRI~1.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E60ECC02-0F47-417D-86B4-4EFCF79CED3A}" refers to invalid object "C:\Program Files\ICQ\ICQAddUs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E769D661-2BEF-11D4-AF8B-0090270D8D35}" refers to invalid object "C:\Program Files\ICQ\ICQIfDg.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E8B69916-C453-4D89-A4A0-F6DC7A407DBC}" refers to invalid object "C:\Program Files\ICQ\ICQMcDgs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E946BF56-E0D7-11D4-AE27-0090270D8F00}" refers to invalid object "C:\Program Files\ICQ\ICQSndCntctLst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E981D791-F499-4837-A483-5AB22F1C548F}" refers to invalid object "C:\PROGRA~1\AMERIC~1.0\media\phobos.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EB23D909-0620-463F-8E71-F573182D262F}" refers to invalid object "C:\WINDOWS\system32\SuperMpeg.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{EB511AE4-87FE-4EFB-91A3-428B2F2601F7}" refers to inv

[Kat]

Hi again! Believe it or not, that is a *clean* MWav scan!! If you read it closely, you'll see that there are no files attached. Those are just leftover registry keys. Let's get those cleaned up for you, shall we?

Click here to get RegSeeker. You want to run a 'clean registry', and select all (make sure the backup box in the lower left corner is selected). Then, after it runs, right click within the results and delete.

Now, open your installed programs, and make sure that everything opens ok. If so, go back and run the RegSeeker again, do the same thing again if anything is found. When it finds nothing else, run the MWav again. (*Reboot between each run of this program)

Please post me the results of how this goes, along with a new HijackThis log.

[chargerguy1973]

Well, that's a relief that there's nothing actually infected! Since running the "heavy-duty" utilities, Drew (my roommate) has run many of his programs successfully, even from the desktop. I suppose all that's left is this registry cleanup operation (if we're lucky)? I'll run RegSeeker later this afternoon once the duty day's over and I can get him to log-on.

[chargerguy1973]

Hello again.

I apologize, but I wasn't able to get my roommate to log on his machine and run the scans, as our schedules conflicted today. I will try to get them done within two days. He and I appreciate all your help, and I sincerely hope I haven't offended you in any way by this. Please accept my apology.

Chris W.

[Kat]

you have absolutely not offended me! Take your time, and make a reply here when you are ready. I am subscribed to this thread, and will stay subscribed until we have it resolved. I will know whenever you make a reply!

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.