HJT Log report help

Apologies for the delay in responding.

The workload on this forum is intense, and sometimes it is not possible to respond to every
inquiry.


Please read the following carefully before downloading the program indicated. If this procedure is not done as directed, it does not work!!
Also, in the event you already downloaded ComboFix, this is a new version, so please remove the version you have.


Download ComboFix
Save to the Desktop <<< Important!!

• During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
• Please do not rename ComboFix to any other name, but only to the one indicated: Combo-Fix
• Close any open browsers, and close/disable your AntiVirus and any AntiSpyware programs so they do not interfere with the running of Combo-Fix.
• Double click on Combo-Fix.exe and follow the prompts.
  
  [*]Combo-Fix disconnects the computer from the Internet as soon as it starts
  [*]Please do not attempt to re-connect to the Internet until Combo-Fix has completely finished.
  [*]If there is no Internet connection after running Combo-Fix, then restart the computer to restore the connection.​
• Do not click on the window while the program is running, it may cause the system to stall.
• When finished, the program produces a report: C:\Combo-Fix.txt

~~~~
Run HijackThis once again to obtain a new log.

~~~~
Please post the Combo-Fix.txt, and a new HijackThis log in your reply.

ComboFix 08-03-22.1 - Admin 2008-03-22 11:45:13.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.184 [GMT -4:00]
Running from: C:\Documents and Settings\Admin\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-22 to 2008-03-22 )))))))))))))))))))))))))))))))
.

2008-03-22 12:01 . 2008-03-22 12:01 6,736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-03-21 19:20 . 2008-03-21 19:20 <DIR> d-------- C:\Program Files\Acesoft
2008-03-21 19:20 . 2007-01-23 00:43 277,504 --a------ C:\WINDOWS\system32\oestore.dll
2008-03-21 19:20 . 2004-03-09 00:00 224,016 --a------ C:\WINDOWS\system32\TabCtl32.ocx
2008-03-21 13:11 . 2008-03-21 13:13 <DIR> d-------- C:\Program Files\StorageCrypt v2.0
2008-03-17 17:13 . 2008-03-17 17:24 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-17 17:10 . 2008-03-17 18:18 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-17 17:10 . 2004-03-09 00:00 132,880 --a------ C:\WINDOWS\system32\msinet.ocx
2008-03-17 15:41 . 2008-03-17 15:41 <DIR> d-------- C:\Program Files\COMODO
2008-03-17 15:41 . 2008-03-17 16:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\comodo
2008-03-17 15:41 . 2008-03-17 15:41 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Comodo
2008-03-17 15:41 . 2008-03-17 15:41 139,008 --a------ C:\WINDOWS\system32\guard32.dll
2008-03-17 15:41 . 2008-03-17 15:41 85,112 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-03-17 15:41 . 2008-03-17 15:41 23,800 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-03-16 22:00 . 2008-03-16 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-16 22:00 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-03-16 22:00 . 2008-03-16 22:02 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-03-16 21:59 . 2008-03-17 16:52 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-03-16 21:57 . 2008-03-17 16:52 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-03-16 18:54 . 2008-03-22 11:45 <DIR> d-------- C:\QUARANTINE
2008-03-16 18:35 . 2008-03-16 18:35 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2008-03-16 18:35 . 2008-03-16 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-16 18:35 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-03-16 18:35 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-03-16 18:35 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-03-16 18:35 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-03-16 18:35 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-03-16 18:34 . 2008-03-16 18:35 <DIR> d-------- C:\Program Files\McAfee
2008-03-16 18:34 . 2008-03-16 18:34 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-03-16 18:34 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-03-16 18:34 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-03-16 14:07 . 2008-03-16 14:07 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-16 13:57 . 2008-03-16 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Raxco(2)
2008-03-16 13:02 . 2007-12-01 18:01 1,291,880 --a------ C:\WINDOWS\wweb32.dll
2008-03-16 11:02 . 2008-03-16 13:05 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\WordWeb
2008-03-16 10:49 . 2008-03-16 10:49 0 --a------ C:\hpfr5550.xml
2008-03-16 10:47 . 2008-03-16 21:23 <DIR> d-------- C:\Program Files\hp deskjet 5550 series
2008-03-16 10:47 . 2008-03-16 21:23 811 --a------ C:\WINDOWS\hpinfo.lnk
2008-03-16 10:46 . 2002-12-09 20:19 147,512 --a------ C:\WINDOWS\system32\hpzlnt07.dll
2008-03-16 00:10 . 2008-03-16 21:47 <DIR> d-------- C:\Program Files\Xvid
2008-03-16 00:10 . 2007-06-28 18:52 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-03-16 00:10 . 2007-06-28 18:54 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-03-16 00:10 . 2007-06-28 18:55 77,824 --a------ C:\WINDOWS\system32\xvid.ax
2008-03-13 19:36 . 2008-03-13 19:36 <DIR> d-------- C:\Program Files\QuickTime
2008-03-11 17:24 . 2008-03-12 20:07 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\AdobeUM
2008-03-11 09:05 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-11 09:05 . 2008-03-11 09:05 376 --a------ C:\WINDOWS\ODBC.INI
2008-03-11 09:04 . 2008-03-11 09:04 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-03-11 09:04 . 2008-03-11 09:04 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-03-11 09:02 . 2008-03-11 09:04 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-03-11 09:00 . 2008-03-11 09:00 <DIR> dr-h----- C:\MSOCache
2008-03-11 08:49 . 2008-03-11 08:49 <DIR> d-------- C:\Program Files\PowerISO
2008-03-10 22:48 . 2008-03-10 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-03-10 22:47 . 2008-03-21 19:19 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Azureus
2008-03-10 22:20 . 2008-03-16 14:07 <DIR> d-------- C:\Program Files\WordWeb
2008-03-10 22:12 . 2008-03-10 22:12 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Media Player Classic
2008-03-10 22:07 . 2008-03-22 11:33 <DIR> d-------- C:\Program Files\ePrompter
2008-03-10 22:07 . 2008-03-22 11:32 16,215 --a------ C:\WINDOWS\ePrompter.ini
2008-03-10 22:06 . 2008-03-10 23:00 <DIR> d-------- C:\Downloads
2008-03-10 21:24 . 2008-03-10 21:24 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-10 21:24 . 2008-03-10 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-10 21:23 . 2008-03-10 21:23 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-10 21:18 . 2008-03-10 21:18 <DIR> d-------- C:\Program Files\Eltima Software
2008-03-10 21:18 . 2008-03-10 21:18 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Eltima Software
2008-03-10 21:12 . 2008-03-10 21:12 <DIR> d-------- C:\Program Files\eRightSoft
2008-03-10 21:02 . 2008-03-10 21:02 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-03-10 21:02 . 2004-02-22 11:11 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-03-10 21:02 . 2006-10-07 18:43 502,784 --a------ C:\WINDOWS\x2.64.exe
2008-03-10 21:02 . 2007-11-13 10:31 399,360 --a------ C:\WINDOWS\system32\Smab.dll
2008-03-10 21:02 . 2007-05-17 18:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll
2008-03-10 21:02 . 2005-02-28 14:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2008-03-10 21:02 . 2006-04-12 10:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-03-10 21:02 . 2004-01-25 01:00 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll
2008-03-10 21:02 . 2004-01-25 01:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2008-03-10 21:02 . 2006-04-05 09:09 66,560 --a------ C:\WINDOWS\MOTA113.exe
2008-03-10 21:02 . 2005-07-14 13:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2008-03-10 21:01 . 2005-02-12 19:00 186,880 -r-hs---- C:\WINDOWS\system32\RLOgg.ax
2008-03-10 21:01 . 2005-01-17 19:26 179,200 -r-hs---- C:\WINDOWS\system32\DiracSplitter.ax
2008-03-10 21:01 . 2006-08-16 10:53 175,104 -r-hs---- C:\WINDOWS\system32\CoreAAC.ax
2008-03-10 21:01 . 2005-02-05 19:00 92,672 -r-hs---- C:\WINDOWS\system32\RLVorbisDec.ax
2008-03-10 21:01 . 2005-02-22 12:55 81,920 -r-hs---- C:\WINDOWS\system32\aac_parser.ax
2008-03-10 21:01 . 2005-02-12 19:00 67,584 -r-hs---- C:\WINDOWS\system32\RLTheoraDec.ax
2008-03-10 21:01 . 2005-02-12 19:00 51,712 -r-hs---- C:\WINDOWS\system32\RLSpeexDec.ax
2008-03-10 20:54 . 2008-03-10 21:37 <DIR> d-------- C:\Program Files\Orbitdownloader
2008-03-10 20:54 . 2008-03-21 18:31 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Orbit
2008-03-10 20:45 . 2008-03-10 20:45 <DIR> d-------- C:\Program Files\Azureus
2008-03-10 20:39 . 2008-03-12 00:47 <DIR> d-------- C:\Program Files\Real Alternative
2008-03-10 20:20 . 2008-03-10 20:20 <DIR> d-------- C:\Program Files\Dantz
2008-03-10 20:08 . 2008-03-10 20:08 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-03-10 20:08 . 2008-03-10 20:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-03-10 19:51 . 2008-03-10 19:51 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-10 19:50 . 2002-12-09 20:19 270,336 --a------ C:\WINDOWS\system32\hpzcon07.dll
2008-03-10 19:50 . 2002-12-09 20:19 208,896 --a------ C:\WINDOWS\system32\hpzcoi07.dll
2008-03-10 19:44 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-03-10 19:44 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-03-10 19:44 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-03-10 19:43 . 2008-03-10 19:43 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-03-10 19:41 . 2008-03-10 19:41 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-03-10 19:41 . 2008-03-10 19:42 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-03-10 19:03 . 2008-03-10 19:03 <DIR> d-------- C:\Program Files\Password 2000

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 22:29 --------- d-----w C:\Program Files\InstallShield Installation Information
2008-03-11 00:06 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-10 22:44 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-10 15:36 --------- d-----w C:\Program Files\Toshiba
2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-10 11:41 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00THotkey"="C:\WINDOWS\System32\00THotkey.exe" [2002-12-24 15:28 253952]
"000StTHK"="000StTHK.exe" [2001-06-24 00:28 24576 C:\WINDOWS\system32\000StTHK.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2002-12-04 01:22 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2002-12-04 01:21 569344]
"Tpwrtray"="TPWRTRAY.EXE" [2002-12-10 14:49 237568 C:\WINDOWS\system32\TPWRTRAY.EXE]
"TouchED"="C:\Program Files\TOSHIBA\TouchED\TouchED.Exe" [2002-07-31 15:41 126976]
"TFncKy"="TFncKy.exe" []
"TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-09-09 19:07 49152]
"NDSTray.exe"="C:\Program Files\Toshiba\ConfigFree\NDSTray.exe" [2002-12-11 11:42 450560]
"TMESBS.EXE"="C:\Program Files\TOSHIBA\TME3\TMESBS32.exe" [2002-09-05 20:08 77824]
"TFNF5"="TFNF5.exe" [2001-08-03 04:08 73728 C:\WINDOWS\system32\TFNF5.exe]
"ezShieldProtector for Px"="C:\WINDOWS\System32\ezSP_Px.exe" [2002-08-19 21:29 40960]
"Drag'n Drop CD"="C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe" [2002-11-13 22:10 802816]
"NvCplDaemon"="NvQTwk" []
"nwiz"="nwiz.exe" [2002-12-12 17:17 438272 C:\WINDOWS\system32\nwiz.exe]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2002-11-24 21:23 172032]
"MaxtorOneTouch"="C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe" [2003-05-21 16:30 45056]
"MXO Auto Loader"="C:\WINDOWS\MXOALDR.EXE" [2003-04-07 19:09 118784]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 19:26 217088]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-13 19:36 385024]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-09 20:19 188416]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-03-17 15:41 1503488]

C:\Documents and Settings\Admin\Start Menu\Programs\Startup\
ePrompter.lnk - C:\Program Files\ePrompter\ePrompter.exe [2008-03-10 22:07:36 782336]
WordWeb Pro.lnk - C:\Program Files\WordWeb\wweb32.exe [2008-03-16 13:02:50 44384]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-03-10 20:08:02 25214]
LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-03-10 18:44:25 57344]
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-03-10 20:54:44 1674440]
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2003-01-06 20:14:17 151552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PmProxy]
--a------ 2002-11-13 21:04 40960 C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R0 TVALG;Toshiba Value Added Logical and General Purpose Device Driver;C:\WINDOWS\system32\DRIVERS\TVALG.SYS [2001-09-13 23:53]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-03-17 15:41]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-03-17 15:41]
R2 Tmesbs;Tmesbs32;"C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service []
R3 tsdhd;TOSHIBA SD Card Host Controller Driver;C:\WINDOWS\system32\DRIVERS\tsdhd.sys [2002-11-05 07:02]
S3 pciSd;pciSd;C:\WINDOWS\system32\DRIVERS\tossdpci.sys [2002-10-08 22:18]
S3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2002-12-13 04:16]
S3 wlags48b;Wireless LAN PCCard Driver;C:\WINDOWS\system32\DRIVERS\wlags48b.sys [2002-06-27 19:29]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-22 12:03:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-03-22 12:04:46
ComboFix-quarantined-files.txt 2008-03-22 16:04:35
.
2008-03-12 14:08:47 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:08:35 PM, on 22/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\explorer.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Documents and Settings\Admin\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 28
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe"
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Drag'n Drop CD] C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Startup: WordWeb Pro.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\system32\wweb32.dll/lookup.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1205163774112
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://web1.dillon.ca/viewer/activeXViewer/activexviewer.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe

--
End of file - 11017 bytes

Please open Notepad (Start > Run > in the Open field type: notepad)
Click: OK

• Copy/paste all the content of the code box below:
• Save it as Options.txt , on your Desktop, and as type"All Files"

RegSearch Options File

[Search]
hldrrr
srosa
drvsyskit
wintems
FirstRRRun
Down
mdelk

[Exclude]

[Options]
Filter=KVDLU

Click to expand...

Next, download Registry Search.zip
Save to the Desktop.

• Right-click and select: Extract all…
• Click on the Registry Search icon on your desktop to open the program.
• Click regsearch.exe to start the program.
• Click on "Import" and Select the file "Options.txt" that you created above, located on the Desktop.
• Click "OK" and Registry Search will search the Registry and report what it finds.

Please post the Registry Search results in your reply.

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 22/03/2008 2:48:39 PM for strings:
; 'hldrrr'
; 'srosa'
; 'drvsyskit'
; 'wintems'
; 'firstrrrun'
; 'down'
; 'mdelk'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\7.0\FeatureLockDown]

[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\7.0\FeatureLockDown\cDefaultLaunchAttachmentPerms]

[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\7.0\FeatureLockDown\cDefaultLaunchURLPerms]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll]
"Content Type"="application/x-msdownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
"Content Type"="application/x-msdownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSi.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSi.1]
@="AcroIEBackgroundDownloadEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSi.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin]
@="AcroIEBackgroundDownloadEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin\CurVer]
@="Adobe.AcroIEBackgroundDownloadEventSi.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Azureus]
@="Azureus Vuze Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214}\InprocServer32]
@="C:\\Program Files\\Orbitdownloader\\orbitcth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FDF6D6B-D672-463B-846E-C6FF49109662}]
@="RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FDF6D6B-D672-463B-846E-C6FF49109662}\ProgID]
@="rmocx.RealPlayer Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FDF6D6B-D672-463B-846E-C6FF49109662}\VersionIndependentProgID]
@="rmocx.RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13FA5947-561C-11D1-BE3F-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EDB660-7CDD-11CF-8DAB-00AA006C1A01}]
@="Internet Explorer Ratings Downloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{224E833B-2CC6-42D9-AE39-90B6A38A4FA2}]
@="RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{224E833B-2CC6-42D9-AE39-90B6A38A4FA2}\ProgID]
@="rmocx.RealPlayer SMIL Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{224E833B-2CC6-42D9-AE39-90B6A38A4FA2}\VersionIndependentProgID]
@="rmocx.RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22BF0C20-6DA7-11D0-B373-00A0C9034938}]
@="Download Status"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}]
@="RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}\ProgID]
@="rmocx.RealPlayer RAM Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}\VersionIndependentProgID]
@="rmocx.RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050f5be-98b5-11cf-bb82-00aa00bdce0b}]
@="DownloadBehavior Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050f5be-98b5-11cf-bb82-00aa00bdce0b}\ProgID]
@="DownloadBehavior.DownloadBehavior.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050f5be-98b5-11cf-bb82-00aa00bdce0b}\VersionIndependentProgID]
@="DownloadBehavior.DownloadBehavior"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B5E0503-DE28-4BE8-919C-76E0E894A3C2}]
@="RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B5E0503-DE28-4BE8-919C-76E0E894A3C2}\ProgID]
@="rmocx.RealPlayer RNX Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B5E0503-DE28-4BE8-919C-76E0E894A3C2}\VersionIndependentProgID]
@="rmocx.RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F1D494B-0CEF-4468-96C9-386E2E4DEC90}\InprocServer32]
@="C:\\Program Files\\Orbitdownloader\\orbitmxt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}]
@="RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\ProgID]
@="rmocx.RealPlayer RMP Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\VersionIndependentProgID]
@="rmocx.RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAF654A-5A07-4264-A255-9FF54C7151E7}]
@="UpdateDownloader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAF654A-5A07-4264-A255-9FF54C7151E7}\ProgID]
@="Microsoft.Update.Downloader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAF654A-5A07-4264-A255-9FF54C7151E7}\VersionIndependentProgID]
@="Microsoft.Update.Downloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71C140F3-1A84-430b-9035-68815582DC79}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71C140F3-1A84-430b-9035-68815582DC79}\ToolboxBitmap32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll, 101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75347086-7260-11D1-BE46-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75C66E66-8949-11D2-BF6D-00A0C9DA4FA2}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75C66E68-8949-11D2-BF6D-00A0C9DA4FA2}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}]
@="Customdown Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}\InprocServer32]
@="C:\\Program Files\\Orbitdownloader\\orbitcth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}\ProgID]
@="Orbitcth.Customdown.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}\VersionIndependentProgID]
@="Orbitcth.Customdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D559C10-9FE9-11d0-93F7-00AA0059CE02}]
@="Code Download Agent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}]
@="Cleaner for Downloaded Program Files"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FB78BEE-4BCB-4627-8672-86B64B8AED5A}]
@="AcroIEBackgroundDownloadEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FB78BEE-4BCB-4627-8672-86B64B8AED5A}\ProgID]
@="Adobe.AcroIEBackgroundDownloadEventSi.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FB78BEE-4BCB-4627-8672-86B64B8AED5A}\VersionIndependentProgID]
@="Adobe.AcroIEBackgroundDownloadEventSin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0E5F37E-CA67-11D1-A817-00A0C92784CD}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3E41207-BE04-492A-AFF0-19E880FF7545}]
@="WMI instrumentation: Win32_ComputerShutdownEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BE4CB0-3A20-11D3-A5F0-00A0C9A40F1D}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BD10A9C1-07CC-11D2-BEFF-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\sviewhlp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFC880F1-7484-11d0-8309-00AA00B6015C}]
@="Download Site Manager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4847596-972C-11D0-9567-00A0C9273C2A}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4847596-972C-11D0-9567-00A0C9273C2A}\ToolboxBitmap32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F41-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source About"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F42-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source Static Info"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source Dynamic Info"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2CA2115-C8D2-11D1-BEBD-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2CA2119-C8D2-11D1-BEBD-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior]
@="DownloadBehavior Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior\CurVer]
@="DownloadBehavior.DownloadBehavior.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior.1]
@="DownloadBehavior Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\FDF19CE3A9EF5D34694CA8C942735200\SourceList]
; Contents of value:
; n;1;C:\WINDOWS\Downloaded Installations\{BB90C5EA-6B3A-4AB2-A040-3B416E91787A}\
"LastUsedSource"=hex(2):6e,00,3b,00,31,00,3b,00,43,00,3a,00,5c,00,57,00,49,00,\
4e,00,44,00,4f,00,57,00,53,00,5c,00,44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,\
00,64,00,65,00,64,00,20,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,61,00,\
74,00,69,00,6f,00,6e,00,73,00,5c,00,7b,00,42,00,42,00,39,00,30,00,43,00,35,\
00,45,00,41,00,2d,00,36,00,42,00,33,00,41,00,2d,00,34,00,41,00,42,00,32,00,\
2d,00,41,00,30,00,34,00,30,00,2d,00,33,00,42,00,34,00,31,00,36,00,45,00,39,\
00,31,00,37,00,38,00,37,00,41,00,7d,00,5c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\FDF19CE3A9EF5D34694CA8C942735200\SourceList\Net]
; Contents of value:
; C:\WINDOWS\Downloaded Installations\{BB90C5EA-6B3A-4AB2-A040-3B416E91787A}\
"1"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,\
44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,65,00,64,00,20,00,49,00,6e,\
00,73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,6f,00,6e,00,73,00,5c,00,\
7b,00,42,00,42,00,39,00,30,00,43,00,35,00,45,00,41,00,2d,00,36,00,42,00,33,\
00,41,00,2d,00,34,00,41,00,42,00,32,00,2d,00,41,00,30,00,34,00,30,00,2d,00,\
33,00,42,00,34,00,31,00,36,00,45,00,39,00,31,00,37,00,38,00,37,00,41,00,7d,\
00,5c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}]
@="IRundown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0002088B-0000-0000-C000-000000000046}]
@="DropDown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0002088C-0000-0000-C000-000000000046}]
@="DropDowns"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000208C6-0000-0000-C000-000000000046}]
@="DownBars"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020925-0000-0000-C000-000000000046}]
@="DropDown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00024703-0000-0000-C000-000000000046}]
@="DownBars"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{094B316F-7C55-404E-A0C2-17A589FA7A2E}]
@="ISusDownloadCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A319C7F-85F9-436C-B88E-82FD88000E1C}]
@="IWMPDownloadCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14170A90-183E-415A-A16D-9FBDFE76FF75}]
@="IWMDownloadDestinationInfo"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{203C06F8-5C88-4073-ABD5-12FD4F41E4E2}]
@="IWMDownloadCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3050F5BD-98B5-11CF-BB82-00AA00BDCE0B}]
@="IDownloadBehavior"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{324FF2C6-4981-4B04-9412-57481745AB24}]
@="IDownloadProgressChangedCallbackArgs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3CD141F4-3C6A-11D2-BCAA-00C04FD929DB}]
@="IAutoCompleteDropDown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48FF3109-A366-4B56-B340-01FAE758BA64}]
@="_IWmiProviderAbnormalShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4AD6A88B-AAEB-4234-AD09-9B0E449313E0}]
@="IWMDownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54A2CB2D-9A0C-48B6-8A50-9ABB69EE2D02}]
@="IUpdateDownloadContent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B945024-DC8C-4C06-B262-E29A10AE15ED}]
@="IWMDownloadMgr"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68F1C6F9-7ECC-4666-A464-247FE12496C3}]
@="IUpdateDownloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77254866-9F5B-4C8E-B9E2-C77A8530D64B}]
@="IDownloadCompletedCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{794A71CD-C835-4A19-ACAE-BA287D7942BE}]
@="IWMDownloadContext"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AAA2D24-B37A-4E11-82C1-E071246463A4}]
@="IWMPDownloadCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CB647D7-F02A-4B13-A2FC-2E22BD0D45B5}]
@="IWMDownloadCore"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7FA5509F-B1E3-4CB5-BD4A-749018A96C5E}]
@="IAcroIEBackgroundDownloadEventSink"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C3F1CDD-6173-4591-AEBD-A56A53CA77C1}]
@="IDownloadProgressChangedCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9FBB3336-6DA3-479D-B8FF-67D46E20A987}]
@="IWMPDownloadItem2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A26B97B2-A28D-4008-B034-FA1622E04C20}]
@="ICustomdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A91708E4-F1BD-463E-8E2D-C9101FA3DB37}]
@="IWMPBkgDownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A951B11A-C712-45B3-B884-2469A6243368}]
@="ITIMEMediaDownloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A976C28D-75A1-42AA-94AE-8AF8B872089A}]
@="IUpdateLockdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}]
@="IWbemShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC5513C8-B3B8-4BF7-A4D4-361C0D8C88BA}]
@="IUpdateDownloadContentCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF99AF76-B575-42AD-8AA4-33CBB5477AF1}]
@="IUpdateDownloadResult"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C574DE85-7358-43F6-AAE8-8697E62D8BA7}]
@="IDownloadJob"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C9470E8E-3F6B-46A9-A0A9-452815C34297}]
@="IWMPDownloadItem"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C97AD11B-F257-420B-9D9F-377F733F6F68}]
@="IUpdateDownloadContent2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB8DD6DE-8A11-4FAE-B2AD-CD82D0CDCCDD}]
@="IWMDownload2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D31A5BAC-F719-4178-9DBB-5E2CB47FD18A}]
@="IDownloadProgress"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAA4FDD0-4727-4DBE-A1E7-745DCA317144}]
@="IDownloadResult"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD8D4A1A-8187-41E9-AC76-5D128F0AA0F5}]
@="IAutoUpdateInstallAtShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E15E9AD1-8F20-4CC4-9EC7-1A328CA86A0D}]
@="IWMPDownloadManager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA565B23-498C-47A0-979D-E7D5B1813360}]
@="IDownloadCompletedCallbackArgs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader]
@="UpdateDownloader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader\CurVer]
@="Microsoft.Update.Downloader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader.1]
@="UpdateDownloader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown]
@="Customdown Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown\CurVer]
@="Orbitcth.Customdown.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown.1]
@="Customdown Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler]
@="RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler\CurVer]
@="rmocx.RealPlayer Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler.1]
@="RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler]
@="RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler\CurVer]
@="rmocx.RealPlayer RAM Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler.1]
@="RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler]
@="RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler\CurVer]
@="rmocx.RealPlayer RMP Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler.1]
@="RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler]
@="RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler\CurVer]
@="rmocx.RealPlayer RNX Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler.1]
@="RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler]
@="RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler\CurVer]
@="rmocx.RealPlayer SMIL Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler.1]
@="RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BEB5790-E4C7-11D3-A625-00A0C9A40F1D}\1.0\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BEB5790-E4C7-11D3-A625-00A0C9A40F1D}\1.0\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0880527-DC28-4EBB-BA27-D22102F22A9F}\1.0\0\win32]
@="C:\\Program Files\\Orbitdownloader\\orbitmxt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0880527-DC28-4EBB-BA27-D22102F22A9F}\1.0\HELPDIR]
@="C:\\Program Files\\Orbitdownloader\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BCDDE143-FAE3-4C57-B22B-C4E8678CFDC0}\1.0\0\win32]
@="C:\\Program Files\\Orbitdownloader\\orbitcth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BD10A9B3-07CC-11D2-BEFF-00A0C95A6A5C}\1.0\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\sviewhlp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BD10A9B3-07CC-11D2-BEFF-00A0C95A6A5C}\1.0\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C4847593-972C-11D0-9567-00A0C9273C2A}\8.0\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C4847593-972C-11D0-9567-00A0C9273C2A}\8.0\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F2CA2107-C8D2-11D1-BEBD-00A0C95A6A5C}\1.1\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F2CA2107-C8D2-11D1-BEBD-00A0C95A6A5C}\1.1\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMDFile]
@="Windows Media Player Download Package"

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore]
"LockDownEnabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
"bScanFloppyOnShutdown"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation]
"OSD"="C:\\WINDOWS\\Downloaded Program Files\\DirectAnimation Java Classes.osd"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation]
"OSD"="C:\\WINDOWS\\Downloaded Program Files\\Microsoft XML Parser for Java.osd"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\DownloadInformation]
"INF"="C:\\WINDOWS\\Downloaded Program Files\\QTPlugin.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6414512B-B978-451D-A0D8-FCFDF33E833C}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6414512B-B978-451D-A0D8-FCFDF33E833C}\DownloadInformation]
"INF"="C:\\WINDOWS\\Downloaded Program Files\\wuweb.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation]
"CODEBASE"="http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab"
"INF"="C:\\WINDOWS\\Downloaded Program Files\\erma.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C4847596-972C-11D0-9567-00A0C9273C2A}\Contains\Files]
"C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"=""
"C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"=""
"C:\\WINDOWS\\Downloaded Program Files\\sviewhlp.dll"=""
"C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C4847596-972C-11D0-9567-00A0C9273C2A}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C4847596-972C-11D0-9567-00A0C9273C2A}\DownloadInformation]
"INF"="C:\\WINDOWS\\Downloaded Program Files\\crviewer.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}]
"$Function"="CORLockDownProvider"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer]
"DownloadUI"="{7854F00C-DC77-477E-A10E-603F48442D3B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\NOTIFYDOWNLOADCOMPLETE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\NOTIFYDOWNLOADCOMPLETE]
"Text"="Notify when downloads complete"
"ValueName"="NotifyDownloadComplete"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CD_LMZ_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CD_LMZ_LOCKDOWN]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CHECK_SIG]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Download"
"Text"="Check for signatures on downloaded programs"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\LMZ_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\LMZ_LOCKDOWN]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\RUN_INV_SIG]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Download"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PLACEHOLDERS]
"Text"="Show image download placeholders"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Download]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{2BDB5D05-9A0B-4256-80AF-A920F8C01AE1}}]
; Contents of value:
; C:\Program Files\Orbitdownloader
"AppPath"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4f,00,72,00,62,00,69,00,74,00,64,\
00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,65,00,72,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SUBDOWNLOAD_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\DropDownPlaylist]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\DropDownPlaylist\Column]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\ItemsPlaylist]
"dropDownVisible"="false"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\MuteButton]
"downToolTip"="res://wmploc.dll/RT_STRING/#1808"
"down"="wmpproplayer.settings.mute"
"onClick"="player.settings.mute=down;"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\RepeatButton]
"downToolTip"="res://wmploc.dll/RT_STRING/#1817"
"down"="jscriptlayer.settings.GetMode(\"loop\");"
"onClick"="player.settings.setMode(\"loop\", down);"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\SeekSlider]
"foregroundProgress"="wmpproplayer.network.downloadProgress"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\ShuffleButton]
"downToolTip"="res://wmploc.dll/RT_STRING/#1815"
"down"="jscriptlayer.settings.GetMode(\"shuffle\");"
"onClick"="player.settings.setMode(\"shuffle\", down);"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Publish\{9AB5C98B-AA7B-4ff4-A8EB-9D8E23C0D59E}]
@="WMPlayer Downlevel CD Burn Publish Provider"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Devices\AudioCD]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Devices\DVD]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.aif]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.aifc]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.aiff]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asf]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.au]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.avi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.cda]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dvr-ms]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.m1v]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.m2v]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.m3u]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.midi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mod]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mp2]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mp2v]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mp3]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpa]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpe]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpv2]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.rmi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.snd]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wav]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wax]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wm]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wma]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmd]
"MediaType.Description"="Windows Media Player Download Package"
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmv]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmz]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wpl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wvx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\IEHardening]
"FEATURE_LOCALMACHINE_LOCKDOWN"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/vnd.ms-wpl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-mplayer2]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmd]
@="Windows Media Player Download Package"
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmz]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/aiff]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/basic]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/midi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mp3]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mpegurl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/wav]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-aiff]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-midi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mp3]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mpegurl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wax]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wma]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-wav]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\midi/mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/avi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/msvideo]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-mpeg2a]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf-plugin]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wm]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmv]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wvx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-msvideo]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mms]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmst]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmsu]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\msbd]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Internet]
"LocationOfComponents"="C:\\Documents and Settings\\Admin\\My Documents\\Azureus Downloads\\Microsoft Office 2003 Professional\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Delivery\{90110409-6000-11D3-8CFE-0150048383C9}]
"DownloadCode"="90000409-6000-11D3-8CFE-0150048383C9"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\PowerPoint\Translators]
"Downrev"="C:\\Program Files\\Microsoft Office\\OFFICE11\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}]
"SmartSourceDir"="C:\\Documents and Settings\\Admin\\My Documents\\Azureus Downloads\\Microsoft Office 2003 Professional\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Properties]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\A2561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\A3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\A4561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\AV561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CC561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CD561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CF561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CL561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CM561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CP561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CR561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DW20.ADM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DW20.EXE_0001]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DWDCW20.DLL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DWINTL20.DLL_0001_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DWTRIG20.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\E2561410.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\E3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\E4561410.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\EV561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\G3561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\GV561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\IJ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\IS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\IU561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L2561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L3561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L4561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L9561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\LV561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M2561406.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M3561404.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M4561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M9561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MA561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MC561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MG561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MH561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MO561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MT561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\O0561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\O1561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\O9561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLEAN.DLL_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLNCORE.OPC_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLNCUST.OPC_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLNINTL.OPC_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OFFCLN.EXE_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OSE.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\P2561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\P3561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\P4561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PA561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PR103368.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PR103678.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PR308246.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PRO11.MSI]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PSS10O.CHM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PSS10R.CHM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PV561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PW561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\Q2561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\Q3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\Q4561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\QV561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\SETUP.CHM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\SKU011.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\SKU011.XML_0002_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\TR103621.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\TR308222.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\V3561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\W2561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\W3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\W4561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\WV561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\X2561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\X3561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YA561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YB561408.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YC561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YH561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YI561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YL561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YM561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YO561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YT561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZA561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZC561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZD561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZE561406.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZF561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZG561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZH561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZI561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZJ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZK561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZM561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZN561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZO561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZQ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZR561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZT561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZU561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZV561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZY561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZZ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Sources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Sources\90110409-6000-11D3-8CFE-0150048383C9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Sources\90110409-6000-11D3-8CFE-0150048383C9]
"Path"="C:\\Documents and Settings\\Admin\\My Documents\\Azureus Downloads\\Microsoft Office 2003 Professional\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Properties]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Resources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Resources\AlrtIntl.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Sources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Sources\alrtintl1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Properties]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Resources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Resources\WatsonRC.dat]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Sources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Sources\watsonrcsrc]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping]
"PackageName"="Microsoft National Language Support Downlevel APIs"
"Description"="Microsoft National Language Support Downlevel APIs"
"ARPLink"="HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\NLSDownlevelMapping"
"UninstallCommand"="C:\\WINDOWS\\$NtServicePackUninstallNLSDownlevelMapping$\\spuninst\\spuninst.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping\Filelist]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping\Filelist\0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM]
; Contents of value:
; C:\WINDOWS\system32\WBEM\cimwin32.mof
; C:\WINDOWS\system32\WBEM\cimwin32.mfl
; C:\WINDOWS\system32\WBEM\system.mof
; C:\WINDOWS\system32\WBEM\wmipcima.mof
; C:\WINDOWS\system32\WBEM\wmipcima.mfl
; C:\WINDOWS\system32\WBEM\regevent.mof
; C:\WINDOWS\system32\WBEM\regevent.mfl
; C:\WINDOWS\system32\WBEM\ntevt.mof
; C:\WINDOWS\system32\WBEM\ntevt.mfl
; C:\WINDOWS\system32\WBEM\secrcw32.mof
; C:\WINDOWS\system32\WBEM\secrcw32.mfl
; C:\WINDOWS\system32\WBEM\dsprov.mof
; C:\WINDOWS\system32\WBEM\dsprov.mfl
; C:\WINDOWS\system32\WBEM\msi.mof
; C:\WINDOWS\system32\WBEM\msi.mfl
; C:\WINDOWS\system32\WBEM\subscrpt.mof
; C:\WINDOWS\system32\WBEM\wmi.mof
; C:\WINDOWS\system32\WBEM\wmi.mfl
; C:\WINDOWS\system32\WBEM\scm.mof
; C:\WINDOWS\system32\WBEM\fevprov.mof
; C:\WINDOWS\system32\WBEM\fevprov.mfl
; C:\WINDOWS\system32\WBEM\wmitimep.mof
; C:\WINDOWS\system32\WBEM\wmitimep.mfl
; C:\WINDOWS\system32\WBEM\wmipdskq.mof
; C:\WINDOWS\system32\WBEM\wmipdskq.mfl
; C:\WINDOWS\system32\WBEM\wmipicmp.mof
; C:\WINDOWS\system32\WBEM\wmipicmp.mfl
; C:\WINDOWS\system32\WBEM\wmipiprt.mof
; C:\WINDOWS\system32\WBEM\wmipiprt.mfl
; C:\WINDOWS\system32\WBEM\wmipjobj.mof
; C:\WINDOWS\system32\WBEM\wmipjobj.mfl
; C:\WINDOWS\system32\WBEM\wmipsess.mof
; C:\WINDOWS\system32\WBEM\wmipsess.mfl
; C:\WINDOWS\system32\WBEM\krnlprov.mof
; C:\WINDOWS\system32\WBEM\krnlprov.mfl
; C:\WINDOWS\system32\WBEM\tscfgwmi.mof
; C:\WINDOWS\system32\WBEM\tscfgwmi.mfl
; C:\WINDOWS\system32\WBEM\licwmi.mof
; C:\WINDOWS\system32\WBEM\licwmi.mfl
; C:\WINDOWS\system32\WBEM\evntrprv.mof
; C:\WINDOWS\system32\WBEM\hnetcfg.mof
; C:\WINDOWS\system32\WBEM\sr.mof
; C:\WINDOWS\system32\WBEM\dgnet.mof
; C:\WINDOWS\system32\WBEM\whqlprov.mof
; C:\WINDOWS\system32\WBEM\ieinfo5.mof
; c:\windows\softwaredistribution\download\16b2c96a0c41f4dfdb4d3cc228a4f819\licwmi.mof
; C:\WINDOWS\system32\wbem\wscenter.mof
; C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\OINFOP11.MOF

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 22/03/2008 2:48:39 PM for strings:
; 'hldrrr'
; 'srosa'
; 'drvsyskit'
; 'wintems'
; 'firstrrrun'
; 'down'
; 'mdelk'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\7.0\FeatureLockDown]

[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\7.0\FeatureLockDown\cDefaultLaunchAttachmentPerms]

[HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\7.0\FeatureLockDown\cDefaultLaunchURLPerms]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dll]
"Content Type"="application/x-msdownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
"Content Type"="application/x-msdownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSi.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSi.1]
@="AcroIEBackgroundDownloadEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSi.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin]
@="AcroIEBackgroundDownloadEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Adobe.AcroIEBackgroundDownloadEventSin\CurVer]
@="Adobe.AcroIEBackgroundDownloadEventSi.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Azureus]
@="Azureus Vuze Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214}\InprocServer32]
@="C:\\Program Files\\Orbitdownloader\\orbitcth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FDF6D6B-D672-463B-846E-C6FF49109662}]
@="RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FDF6D6B-D672-463B-846E-C6FF49109662}\ProgID]
@="rmocx.RealPlayer Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0FDF6D6B-D672-463B-846E-C6FF49109662}\VersionIndependentProgID]
@="rmocx.RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13FA5947-561C-11D1-BE3F-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EDB660-7CDD-11CF-8DAB-00AA006C1A01}]
@="Internet Explorer Ratings Downloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{224E833B-2CC6-42D9-AE39-90B6A38A4FA2}]
@="RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{224E833B-2CC6-42D9-AE39-90B6A38A4FA2}\ProgID]
@="rmocx.RealPlayer SMIL Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{224E833B-2CC6-42D9-AE39-90B6A38A4FA2}\VersionIndependentProgID]
@="rmocx.RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22BF0C20-6DA7-11D0-B373-00A0C9034938}]
@="Download Status"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}]
@="RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}\ProgID]
@="rmocx.RealPlayer RAM Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}\VersionIndependentProgID]
@="rmocx.RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050f5be-98b5-11cf-bb82-00aa00bdce0b}]
@="DownloadBehavior Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050f5be-98b5-11cf-bb82-00aa00bdce0b}\ProgID]
@="DownloadBehavior.DownloadBehavior.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3050f5be-98b5-11cf-bb82-00aa00bdce0b}\VersionIndependentProgID]
@="DownloadBehavior.DownloadBehavior"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B5E0503-DE28-4BE8-919C-76E0E894A3C2}]
@="RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B5E0503-DE28-4BE8-919C-76E0E894A3C2}\ProgID]
@="rmocx.RealPlayer RNX Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B5E0503-DE28-4BE8-919C-76E0E894A3C2}\VersionIndependentProgID]
@="rmocx.RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F1D494B-0CEF-4468-96C9-386E2E4DEC90}\InprocServer32]
@="C:\\Program Files\\Orbitdownloader\\orbitmxt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}]
@="RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\ProgID]
@="rmocx.RealPlayer RMP Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44CCBCEB-BA7E-4C99-A078-9F683832D493}\VersionIndependentProgID]
@="rmocx.RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAF654A-5A07-4264-A255-9FF54C7151E7}]
@="UpdateDownloader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAF654A-5A07-4264-A255-9FF54C7151E7}\ProgID]
@="Microsoft.Update.Downloader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAF654A-5A07-4264-A255-9FF54C7151E7}\VersionIndependentProgID]
@="Microsoft.Update.Downloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71C140F3-1A84-430b-9035-68815582DC79}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71C140F3-1A84-430b-9035-68815582DC79}\ToolboxBitmap32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll, 101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75347086-7260-11D1-BE46-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75C66E66-8949-11D2-BF6D-00A0C9DA4FA2}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75C66E68-8949-11D2-BF6D-00A0C9DA4FA2}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}]
@="Customdown Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}\InprocServer32]
@="C:\\Program Files\\Orbitdownloader\\orbitcth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}\ProgID]
@="Orbitcth.Customdown.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B}\VersionIndependentProgID]
@="Orbitcth.Customdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D559C10-9FE9-11d0-93F7-00AA0059CE02}]
@="Code Download Agent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8369AB20-56C9-11D0-94E8-00AA0059CE02}]
@="Cleaner for Downloaded Program Files"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FB78BEE-4BCB-4627-8672-86B64B8AED5A}]
@="AcroIEBackgroundDownloadEventSink Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FB78BEE-4BCB-4627-8672-86B64B8AED5A}\ProgID]
@="Adobe.AcroIEBackgroundDownloadEventSi.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FB78BEE-4BCB-4627-8672-86B64B8AED5A}\VersionIndependentProgID]
@="Adobe.AcroIEBackgroundDownloadEventSin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0E5F37E-CA67-11D1-A817-00A0C92784CD}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3E41207-BE04-492A-AFF0-19E880FF7545}]
@="WMI instrumentation: Win32_ComputerShutdownEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9BE4CB0-3A20-11D3-A5F0-00A0C9A40F1D}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BD10A9C1-07CC-11D2-BEFF-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\sviewhlp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFC880F1-7484-11d0-8309-00AA00B6015C}]
@="Download Site Manager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4847596-972C-11D0-9567-00A0C9273C2A}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4847596-972C-11D0-9567-00A0C9273C2A}\ToolboxBitmap32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F40-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F41-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source About"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F42-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source Static Info"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C69E8F43-D5C8-11D0-A520-145405C10000}]
@="Indeo Video (r) 5.1 Progressive Download Source Dynamic Info"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2CA2115-C8D2-11D1-BEBD-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2CA2119-C8D2-11D1-BEBD-00A0C95A6A5C}\InprocServer32]
@="C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior]
@="DownloadBehavior Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior\CurVer]
@="DownloadBehavior.DownloadBehavior.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior.1]
@="DownloadBehavior Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DownloadBehavior.DownloadBehavior.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\FDF19CE3A9EF5D34694CA8C942735200\SourceList]
; Contents of value:
; n;1;C:\WINDOWS\Downloaded Installations\{BB90C5EA-6B3A-4AB2-A040-3B416E91787A}\
"LastUsedSource"=hex(2):6e,00,3b,00,31,00,3b,00,43,00,3a,00,5c,00,57,00,49,00,\
4e,00,44,00,4f,00,57,00,53,00,5c,00,44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,\
00,64,00,65,00,64,00,20,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,61,00,\
74,00,69,00,6f,00,6e,00,73,00,5c,00,7b,00,42,00,42,00,39,00,30,00,43,00,35,\
00,45,00,41,00,2d,00,36,00,42,00,33,00,41,00,2d,00,34,00,41,00,42,00,32,00,\
2d,00,41,00,30,00,34,00,30,00,2d,00,33,00,42,00,34,00,31,00,36,00,45,00,39,\
00,31,00,37,00,38,00,37,00,41,00,7d,00,5c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\FDF19CE3A9EF5D34694CA8C942735200\SourceList\Net]
; Contents of value:
; C:\WINDOWS\Downloaded Installations\{BB90C5EA-6B3A-4AB2-A040-3B416E91787A}\
"1"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,\
44,00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,65,00,64,00,20,00,49,00,6e,\
00,73,00,74,00,61,00,6c,00,6c,00,61,00,74,00,69,00,6f,00,6e,00,73,00,5c,00,\
7b,00,42,00,42,00,39,00,30,00,43,00,35,00,45,00,41,00,2d,00,36,00,42,00,33,\
00,41,00,2d,00,34,00,41,00,42,00,32,00,2d,00,41,00,30,00,34,00,30,00,2d,00,\
33,00,42,00,34,00,31,00,36,00,45,00,39,00,31,00,37,00,38,00,37,00,41,00,7d,\
00,5c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}]
@="IRundown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0002088B-0000-0000-C000-000000000046}]
@="DropDown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0002088C-0000-0000-C000-000000000046}]
@="DropDowns"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000208C6-0000-0000-C000-000000000046}]
@="DownBars"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020925-0000-0000-C000-000000000046}]
@="DropDown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00024703-0000-0000-C000-000000000046}]
@="DownBars"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{094B316F-7C55-404E-A0C2-17A589FA7A2E}]
@="ISusDownloadCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0A319C7F-85F9-436C-B88E-82FD88000E1C}]
@="IWMPDownloadCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14170A90-183E-415A-A16D-9FBDFE76FF75}]
@="IWMDownloadDestinationInfo"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{203C06F8-5C88-4073-ABD5-12FD4F41E4E2}]
@="IWMDownloadCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3050F5BD-98B5-11CF-BB82-00AA00BDCE0B}]
@="IDownloadBehavior"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{324FF2C6-4981-4B04-9412-57481745AB24}]
@="IDownloadProgressChangedCallbackArgs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3CD141F4-3C6A-11D2-BCAA-00C04FD929DB}]
@="IAutoCompleteDropDown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48FF3109-A366-4B56-B340-01FAE758BA64}]
@="_IWmiProviderAbnormalShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4AD6A88B-AAEB-4234-AD09-9B0E449313E0}]
@="IWMDownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54A2CB2D-9A0C-48B6-8A50-9ABB69EE2D02}]
@="IUpdateDownloadContent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B945024-DC8C-4C06-B262-E29A10AE15ED}]
@="IWMDownloadMgr"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{68F1C6F9-7ECC-4666-A464-247FE12496C3}]
@="IUpdateDownloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77254866-9F5B-4C8E-B9E2-C77A8530D64B}]
@="IDownloadCompletedCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{794A71CD-C835-4A19-ACAE-BA287D7942BE}]
@="IWMDownloadContext"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7AAA2D24-B37A-4E11-82C1-E071246463A4}]
@="IWMPDownloadCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CB647D7-F02A-4B13-A2FC-2E22BD0D45B5}]
@="IWMDownloadCore"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7FA5509F-B1E3-4CB5-BD4A-749018A96C5E}]
@="IAcroIEBackgroundDownloadEventSink"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C3F1CDD-6173-4591-AEBD-A56A53CA77C1}]
@="IDownloadProgressChangedCallback"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9FBB3336-6DA3-479D-B8FF-67D46E20A987}]
@="IWMPDownloadItem2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A26B97B2-A28D-4008-B034-FA1622E04C20}]
@="ICustomdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A91708E4-F1BD-463E-8E2D-C9101FA3DB37}]
@="IWMPBkgDownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A951B11A-C712-45B3-B884-2469A6243368}]
@="ITIMEMediaDownloader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A976C28D-75A1-42AA-94AE-8AF8B872089A}]
@="IUpdateLockdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7B31DF9-D515-11D3-A11C-00105A1F515A}]
@="IWbemShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BC5513C8-B3B8-4BF7-A4D4-361C0D8C88BA}]
@="IUpdateDownloadContentCollection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF99AF76-B575-42AD-8AA4-33CBB5477AF1}]
@="IUpdateDownloadResult"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C574DE85-7358-43F6-AAE8-8697E62D8BA7}]
@="IDownloadJob"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C9470E8E-3F6B-46A9-A0A9-452815C34297}]
@="IWMPDownloadItem"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C97AD11B-F257-420B-9D9F-377F733F6F68}]
@="IUpdateDownloadContent2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CB8DD6DE-8A11-4FAE-B2AD-CD82D0CDCCDD}]
@="IWMDownload2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D31A5BAC-F719-4178-9DBB-5E2CB47FD18A}]
@="IDownloadProgress"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAA4FDD0-4727-4DBE-A1E7-745DCA317144}]
@="IDownloadResult"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD8D4A1A-8187-41E9-AC76-5D128F0AA0F5}]
@="IAutoUpdateInstallAtShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E15E9AD1-8F20-4CC4-9EC7-1A328CA86A0D}]
@="IWMPDownloadManager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA565B23-498C-47A0-979D-E7D5B1813360}]
@="IDownloadCompletedCallbackArgs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader]
@="UpdateDownloader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader\CurVer]
@="Microsoft.Update.Downloader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader.1]
@="UpdateDownloader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Update.Downloader.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown]
@="Customdown Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown\CurVer]
@="Orbitcth.Customdown.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown.1]
@="Customdown Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Orbitcth.Customdown.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler]
@="RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler\CurVer]
@="rmocx.RealPlayer Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler.1]
@="RealPlayer Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler]
@="RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler\CurVer]
@="rmocx.RealPlayer RAM Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler.1]
@="RealPlayer RAM Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RAM Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler]
@="RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler\CurVer]
@="rmocx.RealPlayer RMP Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler.1]
@="RealPlayer RMP Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RMP Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler]
@="RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler\CurVer]
@="rmocx.RealPlayer RNX Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler.1]
@="RealPlayer RNX Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer RNX Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler]
@="RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler\CurVer]
@="rmocx.RealPlayer SMIL Download Handler.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler.1]
@="RealPlayer SMIL Download Handler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\rmocx.RealPlayer SMIL Download Handler.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BEB5790-E4C7-11D3-A625-00A0C9A40F1D}\1.0\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BEB5790-E4C7-11D3-A625-00A0C9A40F1D}\1.0\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0880527-DC28-4EBB-BA27-D22102F22A9F}\1.0\0\win32]
@="C:\\Program Files\\Orbitdownloader\\orbitmxt.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A0880527-DC28-4EBB-BA27-D22102F22A9F}\1.0\HELPDIR]
@="C:\\Program Files\\Orbitdownloader\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BCDDE143-FAE3-4C57-B22B-C4E8678CFDC0}\1.0\0\win32]
@="C:\\Program Files\\Orbitdownloader\\orbitcth.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BD10A9B3-07CC-11D2-BEFF-00A0C95A6A5C}\1.0\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\sviewhlp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BD10A9B3-07CC-11D2-BEFF-00A0C95A6A5C}\1.0\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C4847593-972C-11D0-9567-00A0C9273C2A}\8.0\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C4847593-972C-11D0-9567-00A0C9273C2A}\8.0\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F2CA2107-C8D2-11D1-BEBD-00A0C95A6A5C}\1.1\0\win32]
@="C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F2CA2107-C8D2-11D1-BEBD-00A0C95A6A5C}\1.1\HELPDIR]
@="C:\\WINDOWS\\Downloaded Program Files\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WMDFile]
@="Windows Media Player Download Package"

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore]
"LockDownEnabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\McShield\Configuration]
"bScanFloppyOnShutdown"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation]
"OSD"="C:\\WINDOWS\\Downloaded Program Files\\DirectAnimation Java Classes.osd"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation]
"OSD"="C:\\WINDOWS\\Downloaded Program Files\\Microsoft XML Parser for Java.osd"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\DownloadInformation]
"INF"="C:\\WINDOWS\\Downloaded Program Files\\QTPlugin.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6414512B-B978-451D-A0D8-FCFDF33E833C}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6414512B-B978-451D-A0D8-FCFDF33E833C}\DownloadInformation]
"INF"="C:\\WINDOWS\\Downloaded Program Files\\wuweb.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation]
"CODEBASE"="http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab"
"INF"="C:\\WINDOWS\\Downloaded Program Files\\erma.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C4847596-972C-11D0-9567-00A0C9273C2A}\Contains\Files]
"C:\\WINDOWS\\Downloaded Program Files\\reportparameterdialog.dll"=""
"C:\\WINDOWS\\Downloaded Program Files\\CRViewer.dll"=""
"C:\\WINDOWS\\Downloaded Program Files\\sviewhlp.dll"=""
"C:\\WINDOWS\\Downloaded Program Files\\swebrs.dll"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C4847596-972C-11D0-9567-00A0C9273C2A}\DownloadInformation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{C4847596-972C-11D0-9567-00A0C9273C2A}\DownloadInformation]
"INF"="C:\\WINDOWS\\Downloaded Program Files\\crviewer.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}]
"$Function"="CORLockDownProvider"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer]
"DownloadUI"="{7854F00C-DC77-477E-A10E-603F48442D3B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\NOTIFYDOWNLOADCOMPLETE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\NOTIFYDOWNLOADCOMPLETE]
"Text"="Notify when downloads complete"
"ValueName"="NotifyDownloadComplete"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CD_LMZ_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CD_LMZ_LOCKDOWN]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\\Settings"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CHECK_SIG]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Download"
"Text"="Check for signatures on downloaded programs"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\LMZ_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\LMZ_LOCKDOWN]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\RUN_INV_SIG]
"RegPath"="SOFTWARE\\Microsoft\\Internet Explorer\\Download"
"RegPoliciesPath"="SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Download"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PLACEHOLDERS]
"Text"="Show image download placeholders"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Download]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{2BDB5D05-9A0B-4256-80AF-A920F8C01AE1}}]
; Contents of value:
; C:\Program Files\Orbitdownloader
"AppPath"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4f,00,72,00,62,00,69,00,74,00,64,\
00,6f,00,77,00,6e,00,6c,00,6f,00,61,00,64,00,65,00,72,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SUBDOWNLOAD_LOCKDOWN]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\DropDownPlaylist]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\DropDownPlaylist\Column]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\ItemsPlaylist]
"dropDownVisible"="false"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\MuteButton]
"downToolTip"="res://wmploc.dll/RT_STRING/#1808"
"down"="wmpproplayer.settings.mute"
"onClick"="player.settings.mute=down;"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\RepeatButton]
"downToolTip"="res://wmploc.dll/RT_STRING/#1817"
"down"="jscriptlayer.settings.GetMode(\"loop\");"
"onClick"="player.settings.setMode(\"loop\", down);"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\SeekSlider]
"foregroundProgress"="wmpproplayer.network.downloadProgress"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Objects\ShuffleButton]
"downToolTip"="res://wmploc.dll/RT_STRING/#1815"
"down"="jscriptlayer.settings.GetMode(\"shuffle\");"
"onClick"="player.settings.setMode(\"shuffle\", down);"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\Publish\{9AB5C98B-AA7B-4ff4-A8EB-9D8E23C0D59E}]
@="WMPlayer Downlevel CD Burn Publish Provider"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Devices\AudioCD]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Devices\DVD]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.aif]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.aifc]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.aiff]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asf]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.asx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.au]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.avi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.cda]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dvr-ms]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.m1v]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.m2v]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.m3u]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.midi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mod]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mp2]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mp2v]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mp3]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpa]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpe]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.mpv2]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.rmi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.snd]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wav]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wax]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wm]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wma]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmd]
"MediaType.Description"="Windows Media Player Download Package"
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmv]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wmz]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wpl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.wvx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\IEHardening]
"FEATURE_LOCALMACHINE_LOCKDOWN"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/vnd.ms-wpl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-mplayer2]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmd]
@="Windows Media Player Download Package"
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\application/x-ms-wmz]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/aiff]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/basic]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/midi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mp3]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mpegurl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/wav]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-aiff]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-midi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mp3]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mpegurl]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wax]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-ms-wma]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\audio/x-wav]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\midi/mid]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/avi]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/mpg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/msvideo]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-mpeg]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-mpeg2a]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-asf-plugin]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wm]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmv]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wmx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-ms-wvx]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\MIME Types\video/x-msvideo]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mms]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmst]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\mmsu]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Protocols\msbd]
"UserApprovedOwning"="yes"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Internet]
"LocationOfComponents"="C:\\Documents and Settings\\Admin\\My Documents\\Azureus Downloads\\Microsoft Office 2003 Professional\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Delivery\{90110409-6000-11D3-8CFE-0150048383C9}]
"DownloadCode"="90000409-6000-11D3-8CFE-0150048383C9"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\PowerPoint\Translators]
"Downrev"="C:\\Program Files\\Microsoft Office\\OFFICE11\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}]
"SmartSourceDir"="C:\\Documents and Settings\\Admin\\My Documents\\Azureus Downloads\\Microsoft Office 2003 Professional\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Properties]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\A2561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\A3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\A4561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\AV561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CC561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CD561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CF561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CL561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CM561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CP561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CR561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\CS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DW20.ADM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DW20.EXE_0001]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DWDCW20.DLL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DWINTL20.DLL_0001_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\DWTRIG20.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\E2561410.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\E3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\E4561410.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\EV561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\G3561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\GV561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\IJ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\IS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\IU561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L2561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L3561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L4561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\L9561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\LV561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M2561406.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M3561404.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M4561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\M9561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MA561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MC561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MG561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MH561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MO561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\MT561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\O0561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\O1561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\O9561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLEAN.DLL_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLNCORE.OPC_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLNCUST.OPC_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OCLNINTL.OPC_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OFFCLN.EXE_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\OSE.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\P2561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\P3561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\P4561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PA561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PR103368.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PR103678.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PR308246.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PRO11.MSI]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PSS10O.CHM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PSS10R.CHM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PV561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\PW561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\Q2561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\Q3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\Q4561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\QV561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\SETUP.CHM_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\SKU011.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\SKU011.XML_0002_1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\TR103621.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\TR308222.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\V3561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\W2561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\W3561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\W4561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\WV561405.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\X2561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\X3561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YA561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YB561408.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YC561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YH561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YI561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YL561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YM561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YO561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\YT561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZA561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZC561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZD561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZE561406.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZF561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZG561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZH561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZI561402.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZJ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZK561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZM561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZN561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZO561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZQ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZR561403.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZS561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZT561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZU561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZV561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZY561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Resources\ZZ561401.CAB]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Sources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Sources\90110409-6000-11D3-8CFE-0150048383C9]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\90000409-6000-11D3-8CFE-0150048383C9\Sources\90110409-6000-11D3-8CFE-0150048383C9]
"Path"="C:\\Documents and Settings\\Admin\\My Documents\\Azureus Downloads\\Microsoft Office 2003 Professional\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Properties]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Resources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Resources\AlrtIntl.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Sources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.alrtintl.data\Sources\alrtintl1033]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Properties]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Resources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Resources\WatsonRC.dat]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Sources]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\microsoft.watson.watsonrc.data\Sources\watsonrcsrc]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping]
"PackageName"="Microsoft National Language Support Downlevel APIs"
"Description"="Microsoft National Language Support Downlevel APIs"
"ARPLink"="HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\NLSDownlevelMapping"
"UninstallCommand"="C:\\WINDOWS\\$NtServicePackUninstallNLSDownlevelMapping$\\spuninst\\spuninst.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping\Filelist]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows\SP1\NLSDownlevelMapping\Filelist\0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM]
; Contents of value:
; C:\WINDOWS\system32\WBEM\cimwin32.mof
; C:\WINDOWS\system32\WBEM\cimwin32.mfl
; C:\WINDOWS\system32\WBEM\system.mof
; C:\WINDOWS\system32\WBEM\wmipcima.mof
; C:\WINDOWS\system32\WBEM\wmipcima.mfl
; C:\WINDOWS\system32\WBEM\regevent.mof
; C:\WINDOWS\system32\WBEM\regevent.mfl
; C:\WINDOWS\system32\WBEM\ntevt.mof
; C:\WINDOWS\system32\WBEM\ntevt.mfl
; C:\WINDOWS\system32\WBEM\secrcw32.mof
; C:\WINDOWS\system32\WBEM\secrcw32.mfl
; C:\WINDOWS\system32\WBEM\dsprov.mof
; C:\WINDOWS\system32\WBEM\dsprov.mfl
; C:\WINDOWS\system32\WBEM\msi.mof
; C:\WINDOWS\system32\WBEM\msi.mfl
; C:\WINDOWS\system32\WBEM\subscrpt.mof
; C:\WINDOWS\system32\WBEM\wmi.mof
; C:\WINDOWS\system32\WBEM\wmi.mfl
; C:\WINDOWS\system32\WBEM\scm.mof
; C:\WINDOWS\system32\WBEM\fevprov.mof
; C:\WINDOWS\system32\WBEM\fevprov.mfl
; C:\WINDOWS\system32\WBEM\wmitimep.mof
; C:\WINDOWS\system32\WBEM\wmitimep.mfl
; C:\WINDOWS\system32\WBEM\wmipdskq.mof
; C:\WINDOWS\system32\WBEM\wmipdskq.mfl
; C:\WINDOWS\system32\WBEM\wmipicmp.mof
; C:\WINDOWS\system32\WBEM\wmipicmp.mfl
; C:\WINDOWS\system32\WBEM\wmipiprt.mof
; C:\WINDOWS\system32\WBEM\wmipiprt.mfl
; C:\WINDOWS\system32\WBEM\wmipjobj.mof
; C:\WINDOWS\system32\WBEM\wmipjobj.mfl
; C:\WINDOWS\system32\WBEM\wmipsess.mof
; C:\WINDOWS\system32\WBEM\wmipsess.mfl
; C:\WINDOWS\system32\WBEM\krnlprov.mof
; C:\WINDOWS\system32\WBEM\krnlprov.mfl
; C:\WINDOWS\system32\WBEM\tscfgwmi.mof
; C:\WINDOWS\system32\WBEM\tscfgwmi.mfl
; C:\WINDOWS\system32\WBEM\licwmi.mof
; C:\WINDOWS\system32\WBEM\licwmi.mfl
; C:\WINDOWS\system32\WBEM\evntrprv.mof
; C:\WINDOWS\system32\WBEM\hnetcfg.mof
; C:\WINDOWS\system32\WBEM\sr.mof
; C:\WINDOWS\system32\WBEM\dgnet.mof
; C:\WINDOWS\system32\WBEM\whqlprov.mof
; C:\WINDOWS\system32\WBEM\ieinfo5.mof
; c:\windows\softwaredistribution\download\16b2c96a0c41f4dfdb4d3cc228a4f819\licwmi.mof
; C:\WINDOWS\system32\wbem\wscenter.mof
; C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\OINFOP11.MOF

Hldrrr.exe is part of the Trojan Bagle. It is notorious for disabling security related applications, and damaging other files in the system.

The characteristic files that show up with this Trojan are not presently showing in the reports provided.

You may be at a stage where you are dealing with damage recovery, and sometimes that is not possible.


Please open Notepad
Copy/paste the following text in the code box below to Notepad:

Save the file to the Desktop
Save as mcshld.bat
Choose to save as type: All files
Close out of Notepad

On the Desktop, double-click on mcshld.bat

Search for: mcshld.txt, and provide its contents in your reply.

~~~~
Also, use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
The program launches and downloads the latest definition files.

• Once the files are downloaded click on Next
• Click on Scan Settings and configure as follows:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK and, under select a target to scan, select My Computer

When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report.





To obtain the report:
Click on: Save Report As (above - red blinking arrow)

Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save

~~~~
Please provide the contents of mcshld.txt, and the Kaspersky Online Scanner Report in your reply.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, March 23, 2008 11:15:19 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 23/03/2008
Kaspersky Anti-Virus database records: 628931
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 92401
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:43:29

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\comodo\Firewall Pro\cfplogdb.sdb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Pure Networks\Log\logfile.nmapp_exe.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Pure Networks\Log\logfile.nmctxth_exe.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Pure Networks\Log\logfile.nmsrvc_exe.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\SupportSoft\medicsp2\SYSTEM\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Admin\Application Data\user60.rdb Object is locked skipped
C:\Documents and Settings\Admin\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\Application Data\SupportSoft\medicsp2\Admin\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\History\History.IE5\MSHist012008031320080314\index.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\History\History.IE5\MSHist012008031420080315\index.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\Temp\Perflib_Perfdata_8f8.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Admin\ntuser.dat Object is locked skipped
C:\Documents and Settings\Admin\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\PeerGuardian2\history.db Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{43C201A9-B0CB-4B55-BEC4-9A114F3F5B35}\RP12\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_510.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

...will not allow any anti-virus software or anti-spyware to load or run.

Click to expand...

Try re-installing these applications.

Their executable files were probably damaged by Trojan_Bagle.

Also, try rebooting to Safe Mode, and see if it works. If it does not, try the following:

Download SafeBootKeyRepair

Save it to the Desktop
Double-click to run it

It takes a short moment for it to finish running, and produces a log.
Please post the SafeBoot_Repair log in your reply.

Let us know how it goes.

Reg export of SafeBoot key after repair:
========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sharedaccess]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\UploadMgr]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

========================

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\PSEXESVC

Logfile of HijackThis v1.97.7
Scan saved at 9:40:31 PM, on 24/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Admin\Local Settings\Application Data\FolderShare\FolderShare.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Admin\My Documents\My Shared Folder\My Software\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 28
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe"
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Drag'n Drop CD] C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Live FolderShare] "C:\Documents and Settings\Admin\Local Settings\Application Data\FolderShare\FolderShare.exe" /background
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Startup: WordWeb Pro.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\system32\wweb32.dll/lookup.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1205163774112
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://web1.dillon.ca/viewer/activeXViewer/activexviewer.cab

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 6:43:45 PM, on 25/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\WINDOWS\system32\TFNF5.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Admin\Local Settings\Application Data\FolderShare\FolderShare.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\ePrompter\ePrompter.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Admin\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 28
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe"
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Drag'n Drop CD] C:\Program Files\Drag'n Drop CD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Live FolderShare] "C:\Documents and Settings\Admin\Local Settings\Application Data\FolderShare\FolderShare.exe" /background
O4 - Startup: ePrompter.lnk = C:\Program Files\ePrompter\ePrompter.exe
O4 - Startup: WordWeb Pro.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\system32\wweb32.dll/lookup.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1205163774112
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://web1.dillon.ca/viewer/activeXViewer/activexviewer.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe

--
End of file - 11556 bytes