I feel like a pillock now - dropper.agent.git :(

[Tharrick]

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:17:44, on 14/01/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RTHDCPL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\NETGEAR\WPN111\wpn111.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Tharrick\Desktop\VundoFix.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Windows\system32\jkkji.exe
O1 - Hosts: ::1 localhost
O1 - Hosts: 207.210.93.28 game01.us.segaonline.jp
O1 - Hosts: 207.210.93.28 patch01.us.segaonline.jp
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\awvtr.dll,#1
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 5002 bytes




Cheers guys. I feel like such an idiot

[Gecko]

Hello Tharrick, and welcome to our forum.

Please download to your desktop.

Double click combofix.exe and follow the prompts.

When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

[Tharrick]

[Gecko]

[Tharrick]

[Gecko]

Yes remove those two instead.

You will also need to add these file to be deleted:
C:\windows\system32\vtstu.exe
c:\windows\system32\jkhhh.dll

[Tharrick]

OK, all done. I got a dialog box saying that my computer couldn't find vtstu.dll or vtstu.exe when I restarted though

HJT log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:18, on 14/01/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RTHDCPL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\NETGEAR\WPN111\wpn111.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Windows\system32\vtstu.exe
O1 - Hosts: ::1 localhost
O1 - Hosts: 207.210.93.28 game01.us.segaonline.jp
O1 - Hosts: 207.210.93.28 patch01.us.segaonline.jp
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\Windows\system32\windows
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 4660 bytes

[Gecko]

Tharrick,

That's looking better now, how is it running?

Start HijackThis and click "Do a system scan only" put a check next to each of the following entries:
F3 - REG:win.ini: load=C:\Windows\system32\vtstu.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\Windows\system32\windows

Now click the "Fixed checked" button and then close HijackThis

Restart your computer and see if you can now run combofix.

If not then please post a new HiJackThis log when you reply.

[Tharrick]

Still can't run combofix



HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:54:01, on 14/01/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RTHDCPL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\NETGEAR\WPN111\wpn111.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Windows\system32\vtstu.exe
O1 - Hosts: ::1 localhost
O1 - Hosts: 207.210.93.28 game01.us.segaonline.jp
O1 - Hosts: 207.210.93.28 patch01.us.segaonline.jp
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\Windows\system32\windows
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 4704 bytes



I notice that despite having had hijackthis fix those two entries, they keep coming back..

[Gecko]

Tharrick,

There is a file(s) that is reloading the registry, I think it in in this folder:
C:\Windows\system32\windows

Lets try two things.
1.We will try an old way to find and remove this type of infection.

Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe.
Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter.
This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.

Copy the contents of that log and paste it into this thread after you run AVG.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
------------------------------------------------------------

2. Please download AVG Anti-Spyware 7.5 from and save that file to your desktop.
This is a 30 day trial of the program

1. Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
3. On the main screen select the icon "Update" then select the "Update now" link.
Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
6. Under "Reports"
* Select "Automatically generate report after every scan"
* Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
Reboot your computer into SafeMode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning:
1. Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
2. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
3. AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
4. If you have any infections you will prompted, then select "Apply all actions"
5. Next select the "Reports" icon at the top.
6. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
7. Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan in your reply.

[Tharrick]

[Gecko]

Tharrick

Do NOT run option #2 OR any other files in the l2mfix folder unless I tell you to so!
Running any other tool from l2mfix when not infected can result in lost files and settings.

In your next reply I need to see the l2mfix.exe option #1 log and the AVG report.

[Tharrick]

Ah, I was getting confused with option 2 in l2mfix and stage 2 of your instructions, sorry.

Right. Despite me setting AVG to always produce a report, it didn't let me produce a report ('save report as' was greyed out). There were about 100 tracking cookies and one dropper.agent infected file

l2mfix report:

L2MFIX find log 032106
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\zylgenpe]
"Dllname"="zylgenpe.dll"
"Shutdown"="NotifyShutdown"
"Startup"="NotifyStartup"
"Logon"="NotifyLogon"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000000

**********************************************************************************
useragent:
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"="Computers and Devices"
"{E7DE9B1A-7533-4556-9484-B26FB486475E}"=""
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{4A1E5ACD-A108-4100-9E26-D2FAFA1BA486}"="IGD Property Sheet Handler"
"{92dbad9f-5025-49b0-9078-2d78f935e341}"="Microsoft Windows Mail Html Preview Handler"
"{b9815375-5d7f-4ce2-9245-c9d4da436930}"="Microsoft Windows Mail Html Preview Handler"
"{f8b8412b-dea3-4130-b36c-5e8be73106ac}"="Microsoft Windows Mail Html Preview Handler"
"{5FA29220-36A1-40f9-89C6-F4B384B7642E}"="Shell Message Handler"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{BC476F4C-D9D7-4100-8D4E-E043F6DEC409}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{73CFD649-CD48-4fd8-A272-2070EA56526B}"="IE BandProxy"
"{07C45BB1-4A8C-4642-A1F5-237E7215FF66}"="IE Microsoft BrowserBand"
"{43886CD5-6529-41c4-A707-7B3C92C05E68}"="IE Navigation Bar"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="IE Search Band"
"{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E}"="IE Registry Tree Options Utility"
"{3028902F-6374-48b2-8DC6-9725E775B926}"="IE AutoComplete"
"{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8}"="IE MRU AutoComplete List"
"{FDE7673D-2E19-4145-8376-BBD58C4BC7BA}"="IE Custom MRU AutoCompleted List"
"{6038EF75-ABFC-4e59-AB6F-12D397F6568D}"="IE Microsoft History AutoComplete List"
"{9D958C62-3954-4b44-8FAB-C4670C1DB4C2}"="IE Microsoft Shell Folder AutoComplete List"
"{B31C5FAE-961F-415b-BAF0-E697A5178B94}"="IE Microsoft Multiple AutoComplete List Container"
"{E6EE9AAC-F76B-4947-8260-A9F136138E11}"="IE Shell Band Site Menu"
"{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}"="IE Shell Rebar BandSite"
"{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}"="IE User Assist"
"{4B78D326-D922-44f9-AF2A-07805C2A3560}"="IE Menu Band"
"{6CF48EF8-44CD-45d2-8832-A16EA016311B}"="IE IShellFolderBand"
"{F2CF5485-4E02-4f68-819C-B92DE9277049}"="&Links"
"{1C1EDB47-CE22-4bbb-B608-77B48F83C823}"="IE Fade Task"
"{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE}"="IE Tracking Shell Menu"
"{44C76ECD-F7FA-411c-9929-1B77BA77F524}"="IE Menu Site"
"{205D7A97-F16D-4691-86EF-F3075DCCA57D}"="IE Menu Desk Bar"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E}"="IE RSS Feeder Folder"
"{8856f961-340a-11d0-a96b-00c04fd705a2}"="Microsoft Web Browser"
"{3050f3d9-98b5-11cf-bb82-00aa00bdce0b}"="MSHTML Document"
"{25336920-03f9-11cf-8fd0-00aa00686f13}"="HTML Document"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Mail Service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Desktop Shortcut"
"{00020d75-0000-0000-c000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{b2c761c6-29bc-4f19-9251-e6195265baf1}"="Color Control Panel Applet"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{36eef7db-88ad-4e81-ad49-0e313f0c35f8}"="Windows Update"
"{74246bfc-4c96-11d0-abef-0020af6b0b7a}"="Device Manager"
"{7A979262-40CE-46ff-AEEE-7884AC3B6136}"="Add New Hardware"
"{7b81be6a-ce2b-4676-a29e-eb907a5126c5}"="Programs and Features"
"{15eae92e-f17a-4431-9f28-805e482dafd4}"="Install New Programs"
"{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}"="Installed Updates"
"{ceefea1b-3e29-4ef1-b34c-fec79c4f70af}"="New Shortcut Wizard"
"{0BFCF7B7-E7B6-433a-B205-2904FCF040DD}"="New Shortcut Wizard Modal"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{3e7efb4c-faf1-453d-89eb-56026875ef90}"="Get Programs Online"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyFolder Properties"
"{44f3dab6-4392-4186-bb7b-6282ccb7a9f6}"="MyDocuments menu and properties"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}"="Start Menu OEM Command"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{3080F90D-D7AD-11D9-BD98-0000947B0257}"="Show Desktop"
"{3080F90E-D7AD-11D9-BD98-0000947B0257}"="Window Switcher"
"{eb124705-128b-40d4-8dd8-d93ed12589a4}"="WPL property store"
"{3c2654c6-7372-4f6b-b310-55d6128f49d2}"="Alphabetical Categorizer"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{708e1662-b832-42a8-bbe1-0a77121e3908}"="Tree property value folder"
"{71f96385-ddd6-48d3-a0c1-ae06e8b055fb}"="Explorer Browser"
"{b2952b16-0e07-4e5a-b993-58c52cb94cae}"="Search Folders"
"{437ff9c0-a07f-4fa0-af80-84b6c6440a16}"="Command Folder"
"{90f8c90b-04e0-4e92-a186-e6e9c125d664}"="Property Labels"
"{1b24a030-9b20-49bc-97ac-1be4426f9e59}"="ActiveDirectory Folder"
"{34449847-FD14-4fc8-A75A-7432F5181EFB}"="ActiveDirectory Folder"
"{C8494E42-ACDD-4739-B0FB-217361E4894F}"="Sam Account Folder"
"{E29F9716-5C08-4FCD-955A-119FDB5A522D}"="Sam Account Folder"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{b155bdf8-02f0-451e-9a26-ae317cfd7779}"="nethood delegate folder"
"{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"="users files delegate folder"
"{ed50fc29-b964-48a9-afb3-15ebb9b97f36}"="printhood delegate folder"
"{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"="Layout Folder"
"{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"="Control Panel command object for Start menu"
"{E44E5D18-0652-4508-A4E2-8A090067BCB0}"="Default Programs command object for Start menu"
"{4336a54d-038b-4685-ab02-99bb52d3fb8b}"="Public Folder"
"{00021401-0000-0000-C000-000000000046}"="Shortcut"
"{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9}"="Search Folder"
"{0AFCCBA6-BF90-4A4E-8482-0AC960981F5B}"=".fon, .otf, .ttc or .ttf files"
"{66742402-F9B9-11D1-A202-0000F81FEDEE}"=".cpl, .dll, .exe, .ocx, .rll or .sys files"
"{D34A6CA6-62C2-4C34-8A7C-14709C1AD938}"="Common Places Folder"
"{865e5e76-ad83-4dca-a109-50dc2113ce9a}"="Programs Folder and Fast Items"
"{21ec2020-3aea-1069-a2dd-08002b30309d}"="Control Panel"
"{25585dc7-4da0-438d-ad04-e42c8d2d64b9}"="Client application shell extension"
"{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}"="Folder Options"
"{a42c2ccb-67d3-46fa-abe6-7d2f3488c7a3}"="Microsoft Windows RTF Preview Handler"
"{1531d583-8375-4d3f-b5fb-d23bbd169f22}"="Window TXT Preview Handler"
"{97e467b4-98c6-4f19-9588-161b7773d6f6}"="Office Document Property Handler"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{056440FD-8568-48e7-A632-72157243B55B}"="Explorer Navigation Bar"
"{C4EC38BD-4E9E-4b5e-935A-D1BFF237D980}"="Explorer Travel Band"
"{6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F}"="Explorer Search Band"
"{2C2577C2-63A7-40e3-9B7F-586602617ECB}"="Explorer Query Band"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{a542e116-8088-4146-a352-b0d06e7f6af6}"="Address EditBox"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{596742A5-1393-4e13-8765-AE1DF71ACAFB}"="Microsoft Breadcrumb Bar"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}"="Search Control"
"{4d5c8c2a-d075-11d0-b416-00c04fb90376}"="Microsoft CommBand"
"{DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}"="File Open Dialog"
"{C0B4E2F3-BA21-4773-8DBA-335EC946EB8B}"="File Save Dialog"
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References"
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}"="ShellLink for Application References"
"{92337A8C-E11D-11D0-BE48-00C04FC30DF6}"="OlePrn.PrinterURL"
"{45670FA8-ED97-4F44-BC93-305082590BFB}"="Microsoft XPS Properties"
"{44121072-A222-48f2-A58A-6D9AD51EBBE9}"="Microsoft XPS Thumbnail"
"{38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b}"="View Available Networks"
"{13D3C4B8-B179-4ebb-BF62-F704173E7448}"="Windows Contact Preview Handler"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}"="Contacts folder"
"{4F58F63F-244B-4c07-B29F-210BE59BE9B4}"=".group shell extension handler"
"{8082C5E6-4C27-48ec-A809-B8E1122E8F97}"=".contact shell extension handler"
"{16C2C29D-0E5F-45f3-A445-03E03F587B7D}"="group_wab_auto_file"
"{CF67796C-F57F-45F8-92FB-AD698826C602}"="contact_wab_auto_file"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Property Page"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{4026492f-2f69-46b8-b9bf-5654fc07e423}"="Windows Firewall"
"{D555645E-D4F8-4c29-A827-D93C859C4F2A}"=""
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{fcfeecae-ee1b-4849-ae50-685dcf7717ec}"="Problem Reports and Solutions"
"{a304259d-52b8-4526-8b1a-a1d6cecc8243}"="iSCSI Initiator"
"{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}"=""
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{025A5937-A6BE-4686-A844-36FE4BEC8B6D}"="Microsoft Power Options"
"{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}"=""
"{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}"=""
"{17cd9488-1228-4b2f-88ce-4298e93e0966}"=""
"{60632754-c523-4b62-b45c-4172da012619}"=""
"{9C60DE1E-E5FC-40f4-A487-460851A8D915}"=""
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{11dbb47c-a525-400b-9e80-a54615a090c0}"="Execute Folder"
"{90b9bce2-b6db-4fd3-8451-35917ea1081b}"="Search Execute Command"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Microsoft Windows Font Folder"
"{2BC0DA0E-F1BC-43AB-B4B5-738EB6B51E7E}"="Microsoft Windows Font File Icon Handler"
"{1a184871-359e-4f67-aad9-5b9905d62232}"="Microsoft Windows Font File Context Menu Handler"
"{8a7cae0e-5951-49cb-bf20-ab3fa1e44b01}"="Microsoft Windows Font Previewer"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}"="Compressed (zipped) Folder Context Menu"
"{ed9d80b9-d157-457b-9192-0e7280313bf0}"="Compressed (zipped) Folder Drop Handler"
"{911051fa-c21c-4246-b470-070cd8df6dc4}"=".cab or .zip files"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{da67b8ad-e81b-4c70-9b91b417b5e33527}"="Windows Search Shell Service"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell.DfsShell Property Sheet"
"{a38b883c-1682-497e-97b0-0a3a9e801682}"="IPropertyStore Handler for Images"
"{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}"="Photo Thumbnail Provider"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Photo Thumbnail Extractor"
"{BC65FB43-1958-4349-971A-210290480130}"="Network Explorer Property Sheet Handler"
"{d3e34b21-9d75-101a-8c3d-00aa001a1652}"="Bitmap Image"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E598560B-28D5-46aa-A14A-8A3BEA34B576}"="Windows Photo Gallery Viewer Video Verbs"
"{00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3}"="Microsoft.ScannersAndCameras"
"{0a4286ea-e355-44fb-8086-af3df7645bd9}"="Windows Media Player"
"{BB6B2374-3D79-41DB-87F4-896C91846510}"="EMDFileProperties"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{E95A4861-D57A-4be1-AD0F-35267E261739}"=""
"{89D83576-6BD1-4c86-9454-BEB04E94C819}"="MAPI Search Namespace Extension"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A0F6AB7-ED84-46B6-B47E-02AA159A152B}"="Sync Center Simple Conflict Presenter"
"{9D687A4C-1404-41ef-A089-883B6FBECDE6}"="Windows Photo Gallery Viewer Autoplay Handler"
"{D9EF8727-CAC2-4e60-809E-86F80A666C91}"="BitLocker Drive Encryption CPL"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="DropTarget Object for Photo Printing Wizard"
"{37efd44d-ef8d-41b1-940d-96973a50e9e0}"="Windows Sidebar Properties"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{00f20eb5-8fd6-4d9d-b75e-36801766c8f1}"="PhotoAcqDropTarget"
"{BC48B32F-5910-47F5-8570-5074A8A5636A}"="Sync Results Delegate Folder"
"{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}"="Games Folder"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{4E77131D-3629-431c-9818-C5679DC83E81}"="Offline Files Icon Overlay Handler"
"{E413D040-6788-4C22-957E-175D1C513A34}"="Sync Center Conflict Delegate Folder"
"{67718415-c450-4f3c-bf8a-b487642dc39b}"="Windows Features"
"{335a31dd-f04b-4d76-a925-d6b47cf360df}"=""
"{91ADC906-6722-4B05-A12B-471ADDCCE132}"="Touch Band"
"{7D4734E6-047E-41e2-AEAA-E763B4739DC4}"="Windows Media Player Play as Playlist Context Menu Handler"
"{2781761E-28E0-4109-99FE-B9D127C57AFE}"="Windows Defender IOfficeAntiVirus implementation"
"{96AE8D84-A250-4520-95A5-A47A7E3C548B}"=""
"{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A}"="Windows Photo Gallery Viewer Image Verbs"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Play as Playlist Context Menu Handler"
"{4B534112-3AF6-4697-A77C-D62CE9B9E7CF}"="Sync Center Event Properties Extension"
"{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C}"="Sync Setup Delegate Folder"
"{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}"="Offline Files Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{4E5BFBF8-F59A-4e87-9805-1F9B42CC254A}"="GameUX.RichGameMediaThumbnail"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{7EFA68C6-086B-43e1-A2D2-55A113531240}"="Offline Files Property Sheet Extension"
"{d8559eb9-20c0-410e-beda-7ed416aecc2a}"="Windows Defender"
"{576C9E85-1300-4EF5-BF6B-D00509F4EDCD}"="Sync Center Handler Properties Extension"
"{5ea4f148-308c-46d7-98a9-49041b1dd468}"="Mobility Center Control Panel"
"{289978AC-A101-4341-A817-21EBA7FD046D}"="Sync Center Conflict Folder"
"{877ca5ac-cb41-4842-9c69-9136e42d47e2}"="File Backup Index"
"{71D99464-3B6B-475C-B241-E15883207529}"="Sync Results Folder"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{B32D3949-ED98-4DBB-B347-17A144969BBA}"="Sync Center Item Properties Extension"
"{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}"="Portable Devices Menu"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{2E9E59C0-B437-4981-A647-9C34B9B90891}"="Sync Setup Folder"
"{58E3C745-D971-4081-9034-86E34B30836A}"=""
"{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}"=""
"{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}"="Sync Center Folder"
"{CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1}"="Welcome Center"
"{15D633E2-AD00-465b-9EC7-F56B7CDF8E27}"="Tablet PC Input Panel"
"{78F3955E-3B90-4184-BD14-5397C15F1EFC}"=""
"{F04CC277-03A2-4277-96A9-77967471BDFF}"="Sync Center Conflict Properties Extension"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{53BEDF0B-4E5B-4183-8DC9-B844344FA104}"="Microsoft Windows MAPI Preview Handler"
"{6b9228da-9c15-419e-856c-19e768a13bdc}"="Windows gadget DropTarget"
"{8E25992B-373E-486E-80E5-BD23AE417E66}"="Sync Center Device Notification Sink"
"{35786D3C-B075-49b9-88DD-029876E11C01}"="Portable Devices"
"{031EE060-67BC-460d-8847-E4A7C5E45A27}"="Windows Media Player Rich Preview Handler"
"{1FA9085F-25A2-489B-85D4-86326EEDCD87}"="Manage Wireless Networks"
"{7dda204b-2097-47c9-8323-c40bb840ae44}"="XPS document"
"{ECDD6472-2B9B-4b4b-AE36-F316DF3C8D60}"="RichGameMediaPropertyStore Class"
"{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}"="Client Side Cache Namespace Extension"
"{8A734961-C4AA-4741-AC1E-791ACEBF5B39}"="Windows Media Player Shop Music Context Menu Handler"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}"="The Core Media Player Shell Extension"
"{0561EC90-CE54-4f0c-9C55-E226110A740C}"="Haali Column Provider"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}"="Microsoft Office Metadata Handler"
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}"="Microsoft Office Thumbnail Handler"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E7DE9B1A-7533-4556-9484-B26FB486475E}]
@="Network Map"
"System.ApplicationName"="Microsoft.NetworkMap"
"System.ControlPanel.Category"=dword:00000003
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,\
6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,4d,00,61,00,70,00,2e,00,64,00,\
6c,00,6c,00,2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,\
6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,4d,00,61,00,70,00,2e,00,\
64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{E7DE9B1A-7533-4556-9484-B26FB486475E}\DefaultIcon]
@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,65,00,\
74,00,77,00,6f,00,72,00,6b,00,4d,00,61,00,70,00,2e,00,64,00,6c,00,6c,00,2c,\
00,30,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{E7DE9B1A-7533-4556-9484-B26FB486475E}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{E7DE9B1A-7533-4556-9484-B26FB486475E}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{E7DE9B1A-7533-4556-9484-B26FB486475E}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,4d,00,61,00,70,00,2e,00,64,00,6c,\
00,6c,00,00,00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{E7DE9B1A-7533-4556-9484-B26FB486475E}\ShellFolder]
"Attributes"=dword:a0100000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D555645E-D4F8-4c29-A827-D93C859C4F2A}]
@="Ease of Access"
"System.ApplicationName"="Microsoft.EaseOfAccessCenter"
"System.ControlPanel.Category"="7,1"
"System.ControlPanel.EnableInSafeMode"=dword:00000003
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,61,00,63,00,63,00,65,00,73,00,73,00,69,00,62,00,69,00,6c,00,69,00,74,00,\
79,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,34,00,35,00,00,\
00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,61,00,63,00,63,00,65,00,73,00,73,00,69,00,62,00,69,00,6c,00,69,00,\
74,00,79,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,30,\
00,00,00

[HKEY_CLASSES_ROOT\CLSID\{D555645E-D4F8-4c29-A827-D93C859C4F2A}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,61,00,63,00,\
63,00,65,00,73,00,73,00,69,00,62,00,69,00,6c,00,69,00,74,00,79,00,63,00,70,\
00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{D555645E-D4F8-4c29-A827-D93C859C4F2A}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{D555645E-D4F8-4c29-A827-D93C859C4F2A}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{D555645E-D4F8-4c29-A827-D93C859C4F2A}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
61,00,63,00,63,00,65,00,73,00,73,00,69,00,62,00,69,00,6c,00,69,00,74,00,79,\
00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{D555645E-D4F8-4c29-A827-D93C859C4F2A}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}]
@="Network and Sharing Center"
"System.ControlPanel.Category"="3"
"System.ControlPanel.EnableInSafeMode"=dword:00000002
"System.ApplicationName"="Microsoft.NetworkAndSharingCenter"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,6e,00,65,00,74,00,63,00,65,00,6e,00,74,00,65,00,72,00,2e,00,64,00,6c,00,\
6c,00,2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,6e,00,65,00,74,00,63,00,65,00,6e,00,74,00,65,00,72,00,2e,00,64,00,\
6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6e,00,65,00,\
74,00,63,00,65,00,6e,00,74,00,65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
6e,00,65,00,74,00,63,00,65,00,6e,00,74,00,65,00,72,00,2e,00,64,00,6c,00,6c,\
00,00,00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}]
@="System"
"System.ApplicationName"="Microsoft.System"
"System.ControlPanel.Category"="5"
"System.ControlPanel.EnableInSafeMode"=dword:00000003
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,73,00,79,00,73,00,74,00,65,00,6d,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,\
6c,00,2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,63,00,70,00,6c,00,2e,00,64,00,\
6c,00,6c,00,2c,00,2d,00,31,00,00,00
"System.Software.TasksFileUrl"="Internal"

[HKEY_CLASSES_ROOT\CLSID\{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6d,00,\
61,00,67,00,65,00,72,00,65,00,73,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,\
00,34,00,39,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,79,00,73,00,74,00,65,00,6d,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,\
00,00,00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}]
@="Personalization CPL Provider"
"System.ApplicationName"="Microsoft.Personalization"
"System.ControlPanel.Category"="1,2,11"
"System.ControlPanel.EnableInSafeMode"=dword:00000003
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,74,00,68,00,65,00,6d,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,\
2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,74,00,68,00,65,00,6d,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,\
6c,00,2c,00,2d,00,31,00,00,00
"System.Software.TasksFileUrl"="Internal"

[HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,74,00,68,00,\
65,00,6d,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,\
00,00,00

[HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
74,00,68,00,65,00,6d,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,\
00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\ShellFolder]
"Attributes"=dword:a00001a0
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{17cd9488-1228-4b2f-88ce-4298e93e0966}]
@="Set User Defaults"
"System.ApplicationName"="Microsoft.DefaultPrograms"
"System.ControlPanel.Category"="8"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,73,00,75,00,64,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,30,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,73,00,75,00,64,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00
"System.Software.TasksFileUrl"="Internal"

[HKEY_CLASSES_ROOT\CLSID\{17cd9488-1228-4b2f-88ce-4298e93e0966}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6d,00,\
61,00,67,00,65,00,72,00,65,00,73,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,\
00,34,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{17cd9488-1228-4b2f-88ce-4298e93e0966}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{17cd9488-1228-4b2f-88ce-4298e93e0966}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{17cd9488-1228-4b2f-88ce-4298e93e0966}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,75,00,64,00,2e,00,64,00,6c,00,6c,00,00,00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{17cd9488-1228-4b2f-88ce-4298e93e0966}\ShellFolder]
"Attributes"=dword:a00001a0
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{60632754-c523-4b62-b45c-4172da012619}]
@="User Accounts"
"System.ApplicationName"="Microsoft.UserAccounts"
"System.ControlPanel.Category"="9"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,75,00,73,00,65,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,\
2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,75,00,73,00,65,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,\
2c,00,2d,00,31,00,00,00
"System.ControlPanel.EnableInSafeMode"=dword:00000003
"System.Software.TasksFileUrl"="Internal"

[HKEY_CLASSES_ROOT\CLSID\{60632754-c523-4b62-b45c-4172da012619}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,75,00,73,00,\
65,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,\
00

[HKEY_CLASSES_ROOT\CLSID\{60632754-c523-4b62-b45c-4172da012619}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{60632754-c523-4b62-b45c-4172da012619}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{60632754-c523-4b62-b45c-4172da012619}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
75,00,73,00,65,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{60632754-c523-4b62-b45c-4172da012619}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9C60DE1E-E5FC-40f4-A487-460851A8D915}]
@="AutoPlay"
"System.ApplicationName"="Microsoft.AutoPlay"
"System.ControlPanel.Category"="2,4"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,61,00,75,00,74,00,6f,00,70,00,6c,00,61,00,79,00,2e,00,64,00,6c,00,6c,00,\
2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,61,00,75,00,74,00,6f,00,70,00,6c,00,61,00,79,00,2e,00,64,00,6c,00,\
6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{9C60DE1E-E5FC-40f4-A487-460851A8D915}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,61,00,75,00,\
74,00,6f,00,70,00,6c,00,61,00,79,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,\
00,00,00

[HKEY_CLASSES_ROOT\CLSID\{9C60DE1E-E5FC-40f4-A487-460851A8D915}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{9C60DE1E-E5FC-40f4-A487-460851A8D915}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{9C60DE1E-E5FC-40f4-A487-460851A8D915}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
61,00,75,00,74,00,6f,00,70,00,6c,00,61,00,79,00,2e,00,64,00,6c,00,6c,00,00,\
00
"ResourceID"=dword:00000064

[HKEY_CLASSES_ROOT\CLSID\{9C60DE1E-E5FC-40f4-A487-460851A8D915}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E95A4861-D57A-4be1-AD0F-35267E261739}]
@="Windows SideShow"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,41,00,75,00,78,00,69,00,6c,00,69,00,61,00,72,00,79,00,44,00,69,00,73,00,\
70,00,6c,00,61,00,79,00,43,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,\
00,37,00,30,00,31,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,41,00,75,00,78,00,69,00,6c,00,69,00,61,00,72,00,79,00,44,00,69,00,\
73,00,70,00,6c,00,61,00,79,00,43,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,\
00,2d,00,31,00,00,00
"System.ApplicationName"="Microsoft.WindowsSideShow"
"System.ControlPanel.Category"="2,8"

[HKEY_CLASSES_ROOT\CLSID\{E95A4861-D57A-4be1-AD0F-35267E261739}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,41,00,75,00,\
78,00,69,00,6c,00,69,00,61,00,72,00,79,00,44,00,69,00,73,00,70,00,6c,00,61,\
00,79,00,43,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{E95A4861-D57A-4be1-AD0F-35267E261739}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{E95A4861-D57A-4be1-AD0F-35267E261739}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{E95A4861-D57A-4be1-AD0F-35267E261739}\Instance\InitPropertyBag]
"ResourceID"=dword:00000064
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
41,00,75,00,78,00,69,00,6c,00,69,00,61,00,72,00,79,00,44,00,69,00,73,00,70,\
00,6c,00,61,00,79,00,43,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{E95A4861-D57A-4be1-AD0F-35267E261739}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{335a31dd-f04b-4d76-a925-d6b47cf360df}]
@="Backup and Restore Center"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,62,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,\
00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,62,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,\
31,00,00,00
"System.ApplicationName"="Microsoft.BackupAndRestoreCenter"
"System.ControlPanel.Category"="5"

[HKEY_CLASSES_ROOT\CLSID\{335a31dd-f04b-4d76-a925-d6b47cf360df}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,62,00,72,00,\
63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{335a31dd-f04b-4d76-a925-d6b47cf360df}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{335a31dd-f04b-4d76-a925-d6b47cf360df}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{335a31dd-f04b-4d76-a925-d6b47cf360df}\Instance\InitPropertyBag]
"ResourceID"=dword:00000064
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
62,00,72,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{335a31dd-f04b-4d76-a925-d6b47cf360df}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{96AE8D84-A250-4520-95A5-A47A7E3C548B}]
@="Parental Controls"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,77,00,70,00,63,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,\
31,00,30,00,31,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,77,00,70,00,63,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,\
2d,00,31,00,30,00,30,00,00,00
"System.ApplicationName"="Microsoft.ParentalControls"
"System.ControlPanel.Category"="9,10"

[HKEY_CLASSES_ROOT\CLSID\{96AE8D84-A250-4520-95A5-A47A7E3C548B}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,70,00,\
63,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{96AE8D84-A250-4520-95A5-A47A7E3C548B}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{96AE8D84-A250-4520-95A5-A47A7E3C548B}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{96AE8D84-A250-4520-95A5-A47A7E3C548B}\Instance\InitPropertyBag]
"ResourceID"=dword:00000064
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
77,00,70,00,63,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{96AE8D84-A250-4520-95A5-A47A7E3C548B}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{58E3C745-D971-4081-9034-86E34B30836A}]
@="Speech Recognition Options"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,53,00,70,00,65,00,65,00,63,00,68,00,5c,00,53,00,70,00,65,00,65,00,63,00,\
68,00,55,00,58,00,5c,00,73,00,70,00,65,00,65,00,63,00,68,00,75,00,78,00,63,\
00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,53,00,70,00,65,00,65,00,63,00,68,00,5c,00,53,00,70,00,65,00,65,00,\
63,00,68,00,55,00,58,00,5c,00,73,00,70,00,65,00,65,00,63,00,68,00,75,00,78,\
00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00
"System.ApplicationName"="Microsoft.SpeechRecognitionOptions"
"System.ControlPanel.Category"="7"

[HKEY_CLASSES_ROOT\CLSID\{58E3C745-D971-4081-9034-86E34B30836A}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,70,00,\
65,00,65,00,63,00,68,00,5c,00,53,00,70,00,65,00,65,00,63,00,68,00,55,00,58,\
00,5c,00,73,00,70,00,65,00,65,00,63,00,68,00,75,00,78,00,63,00,70,00,6c,00,\
2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{58E3C745-D971-4081-9034-86E34B30836A}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{58E3C745-D971-4081-9034-86E34B30836A}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{58E3C745-D971-4081-9034-86E34B30836A}\Instance\InitPropertyBag]
"ResourceID"=dword:00000064
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
53,00,70,00,65,00,65,00,63,00,68,00,5c,00,53,00,70,00,65,00,65,00,63,00,68,\
00,55,00,58,00,5c,00,73,00,70,00,65,00,65,00,63,00,68,00,75,00,78,00,63,00,\
70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{58E3C745-D971-4081-9034-86E34B30836A}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}]
@="Windows Ultimate Extras"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,55,00,6c,00,74,00,69,00,6d,00,\
61,00,74,00,65,00,45,00,78,00,74,00,72,00,61,00,73,00,43,00,50,00,4c,00,2e,\
00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,55,00,6c,00,74,00,69,00,\
6d,00,61,00,74,00,65,00,45,00,78,00,74,00,72,00,61,00,73,00,43,00,50,00,4c,\
00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00
"System.ApplicationName"="Microsoft.WindowsUltimateExtras"

[HKEY_CLASSES_ROOT\CLSID\{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,69,00,\
6e,00,64,00,6f,00,77,00,73,00,55,00,6c,00,74,00,69,00,6d,00,61,00,74,00,65,\
00,45,00,78,00,74,00,72,00,61,00,73,00,43,00,50,00,4c,00,2e,00,64,00,6c,00,\
6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}\Instance\InitPropertyBag]
"ResourceID"=dword:00000064
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,55,00,6c,00,74,00,69,00,6d,00,61,\
00,74,00,65,00,45,00,78,00,74,00,72,00,61,00,73,00,43,00,50,00,4c,00,2e,00,\
64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{4D1209BD-36E2-4e2f-840D-6C7FB879DD9E}\ShellFolder]
"Attributes"=dword:a0100000
"WantsParseDisplayName"=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}]
@="Performance Information and Tools"
"System.Software.TasksFileUrl"="Internal"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,50,00,65,00,72,00,66,00,43,00,65,00,6e,00,74,00,65,00,72,00,43,00,50,00,\
4c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,32,00,00,00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,50,00,65,00,72,00,66,00,43,00,65,00,6e,00,74,00,65,00,72,00,43,00,\
50,00,4c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00
"System.ApplicationName"="Microsoft.PerformanceInformationAndTools"
"System.ControlPanel.Category"="5"

[HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,50,00,65,00,\
72,00,66,00,43,00,65,00,6e,00,74,00,65,00,72,00,43,00,50,00,4c,00,2e,00,64,\
00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}\Instance\InitPropertyBag]
"ResourceID"=dword:00000064
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
50,00,65,00,72,00,66,00,43,00,65,00,6e,00,74,00,65,00,72,00,43,00,50,00,4c,\
00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}\ShellFolder]
"Attributes"=dword:a0000000
"WantsParseDisplayName"=""

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
acctres.dll Sat 20 Oct 2007 21:37:54 A.... 39,424 38.50 K
advpack.dll Wed 12 Dec 2007 13:19:24 A.... 124,928 122.00 K
asferror.dll Wed 12 Dec 2007 13:20:02 A.... 2,048 2.00 K
authui.dll Sat 20 Oct 2007 21:26:16 A.... 1,984,512 1.89 M
avicap32.dll Sat 20 Oct 2007 21:26:14 A.... 65,024 63.50 K
avifil32.dll Sat 20 Oct 2007 21:26:14 A.... 88,576 86.50 K
cdd.dll Wed 12 Dec 2007 22:16:58 A.... 36,864 36.00 K
cmdlin~1.dll Thu 27 Dec 2007 13:46:34 A.... 107,888 105.36 K
cmifw.dll Sat 20 Oct 2007 21:32:12 A.... 61,952 60.50 K
crypt32.dll Sat 20 Oct 2007 21:25:18 A.... 974,336 951.50 K
cscmig.dll Sat 20 Oct 2007 21:26:20 A.... 105,984 103.50 K
csrsrv.dll Sat 20 Oct 2007 21:36:54 A.... 49,664 48.50 K
dhcpcsvc.dll Sat 20 Oct 2007 21:26:16 A.... 204,800 200.00 K
dps.dll Sat 20 Oct 2007 21:38:30 A.... 134,656 131.50 K
dxmasf.dll Sat 20 Oct 2007 21:32:48 A.... 4,096 4.00 K
dxtmsft.dll Wed 12 Dec 2007 13:19:20 A.... 347,136 339.00 K
dxtrans.dll Wed 12 Dec 2007 13:19:22 A.... 214,528 209.50 K
gameux.dll Wed 9 Jan 2008 10:41:30 A.... 1,686,016 1.61 M
hccoin.dll Thu 15 Nov 2007 1:06:34 A.... 8,704 8.50 K
hcrstco.dll Thu 15 Nov 2007 1:06:34 A.... 8,704 8.50 K
icardie.dll Wed 12 Dec 2007 13:19:20 A.... 63,488 62.00 K
icfupgd.dll Sat 20 Oct 2007 21:32:12 A.... 86,016 84.00 K
ieapfltr.dll Wed 12 Dec 2007 13:19:22 A.... 383,488 374.50 K
ieframe.dll Wed 12 Dec 2007 13:19:28 A.... 6,065,664 5.78 M
iernonce.dll Wed 12 Dec 2007 13:19:18 A.... 44,544 43.50 K
iesetup.dll Wed 12 Dec 2007 13:19:18 A.... 56,320 55.00 K
ieui.dll Wed 12 Dec 2007 13:19:28 A.... 180,736 176.50 K
imagehlp.dll Sat 20 Oct 2007 21:25:26 A.... 152,576 149.00 K
inetcomm.dll Sat 20 Oct 2007 21:26:00 A.... 737,792 720.50 K
inetres.dll Sat 20 Oct 2007 21:26:00 A.... 84,480 82.50 K
iphlpsvc.dll Sat 20 Oct 2007 21:32:12 A.... 178,688 174.50 K
ipnathlp.dll Sat 20 Oct 2007 21:38:32 A.... 286,208 279.50 K
jsproxy.dll Wed 12 Dec 2007 13:19:22 A.... 27,648 27.00 K
laprxy.dll Wed 12 Dec 2007 13:20:02 A.... 9,728 9.50 K
localspl.dll Sat 20 Oct 2007 21:38:32 A.... 694,784 678.50 K
mciavi32.dll Sat 20 Oct 2007 21:26:14 A.... 82,944 81.00 K
mcmde.dll Sat 17 Nov 2007 11:14:06 A.... 1,244,672 1.18 M
mljjjhf.dll Sun 13 Jan 2008 21:13:28 A.... 39,936 39.00 K
mpssvc.dll Sat 20 Oct 2007 21:32:12 A.... 396,800 387.50 K
msftedit.dll Sat 20 Oct 2007 21:38:32 A.... 564,736 551.50 K
mshtml.dll Wed 12 Dec 2007 13:19:26 A.... 3,590,656 3.42 M
mshtmled.dll Wed 12 Dec 2007 13:19:26 A.... 478,208 467.00 K
msoeacct.dll Sat 20 Oct 2007 21:37:54 A.... 205,824 201.00 K
msoert2.dll Sat 20 Oct 2007 21:37:54 A.... 87,040 85.00 K
msrle32.dll Sat 20 Oct 2007 21:26:14 A.... 12,800 12.50 K
msscp.dll Sat 20 Oct 2007 21:33:20 A.... 414,208 404.50 K
msshsq.dll Sat 17 Nov 2007 11:16:34 A.... 229,888 224.50 K
mstime.dll Wed 12 Dec 2007 13:19:20 A.... 671,232 655.50 K
msvcp71.dll Sun 21 Oct 2007 22:09:36 A.... 499,712 488.00 K
msvcr71.dll Sun 21 Oct 2007 22:09:36 A.... 348,160 340.00 K
msvfw32.dll

[Tharrick]

[Gecko]

Tharrick,

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select
Option #2 for Run Fix, by typing 2 and then pressing enter, then press any key to reboot your computer.

After a reboot, your desktop and icons will appear, then disappear (this is normal).
L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.

Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!