| Header | CLSID | Status | Name | Path/File | Description |
| Protocol | {53B95211-7D77-11D2-9F80-00104B107C96} | X | about | msxmlpp.dll | Adware.FindemNow |
| Protocol | {3050F406-98B5-11CF-BB82-00AA00BDCE0B} | L | about, javascript, mailto, res, vbscript | mshtml.dll | Items taken from whitelist of HijackThis |
| Protocol | {2A0C35F4-82A3-4C80-919D-7879FEE79DF6} | L | ActLink | actlink.dll | ACT! Link for Peachtree |
| Protocol | {7DC356B2-7366-4F19-BF7A-4875F6AABEA0} | X | advert | nodeipproc.dll | AdClicker.Oddbot |
| Protocol | {3050F406-98B5-11CF-BB82-00AA00BDCE0B} | L | aim, shell | mshtml.dll | Qwik-Fix Pro |
| Filter | {D962EF38-5FB0-4761-8638-C86F085E25E6} | X | application/hta | chp.dll, MWSHELP.DLL | CoolWebSearch parasite variant |
| Filter | {DFF82902-0B96-3B98-6F62-D655E146A23A} | L | application/msword, application/vnd.ms-excel,
application/vnd.ms-powerpoint,
application/x-microsoft-rpmsg-message | mime_filter.dll | Rights Management Add-on for Internet Explorer |
| Filter hijack | {F969FE8E-1937-45AD-AF42-8A4D11CBDC2A} | L | application/octet-stream | mime_filter.dll | Rights Management Add-on for Internet Explorer |
| Filter hijack | {6585E5B4-4D2A-4A1D-A219-4102C64BA999} | X | application/octet-stream | chp.dll, MWSHELP.DLL | CoolWebSearch parasite variant |
| Filter | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | L | application/vnd-backup-octet-stream | mscoree.dll | Rights Management Add-on for Internet Explorer |
| Filter | {CD4527E8-4FC7-48DB-9806-10537B501237} | L | application/vnd-viewer | (no file) | Rights Management Add-on for Internet Explorer |
| Filter | {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} | L | application/x-bt2 | bt2plugin.dll | BT2Net |
| Filter | {A173B69A-1F9B-4823-9FDA-412F641E65D6} | L | application/x-internet-signup | tiscalifilter.dll | Tiscali |
| Filter, Filter hijack | {32F66A26-7614-11D4-BD11-00104BD3F987} | L | application/xhtml+xml, text/xml, | MathMLMimer.dll | MathPlayer |
| Protocol | {8D32BA61-D15B-11D4-894B-000000000000} | L | asp, hsp, x-asp, x-hsp, x-zip, zip | EzTools\hsppp.dll | EzTools |
| Protocol | {07C0D34D-11D7-43F7-832B-C6BB41726F5F} | X | ayb | [random named].dll | C2Media/lop.com |
| Protocol | {A57721C9-B905-49B3-8BCA-B99FBB8C627E} | L | bega | DatabaseTools.dll | DIALUX Plugin for Bega |
| Protocol | {1730B77B-F429-498F-9B15-4514D83C8294} | L | bt2 | bt2plugin.dll | BT2Net |
| Protocol | {********-****-****-****-************} | O | bw*** (*=random digit) | BWPlugProtocol-8876480.dll | BackWeb |
| Protocol | {9462A756-7B47-47BC-8C80-C34B9B80B32B} | O | bwfile-8876480 | GAPlugProtocol-8876480.dll | BackWeb |
| Protocol | {********-****-****-****-************} | O | bwfile-8876480 | BWPlugProtocol-8876480.dll | BackWeb |
| Protocol | {3DD53D40-7B8B-11D0-B013-00AA0059CE02} | L | cdl | urlmon.dll | Item taken from whitelist of HijackThis |
| Protocol | {CD00020A-8B95-11D1-82DB-00C04FB1625D} | L | cdo | PKMCDO.DLL | Item taken from whitelist of HijackThis; Microsoft SharePoint Portal Server Object Model |
| Protocol | {AD43AA67-6860-4531-AC8A-0E68F9CF023E} | O | CDS300 | __CDS2.dll | CDS protection |
| Protocol | {CF184AD3-CDCB-4168-A3F7-8E447D129300} | L | cetihpz | hpuiprot.dll | HP printer |
| Protocol hijack | {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40} | X | cn | CNBABE.DLL | CommonName |
| Protocol | {D9656C75-5090-45C3-B27E-436FBC7ACFA7} | L | copernicdesktopsearch | COPERN~2.DLL | COPERNIC DESKTOP SEARCH |
| Protocol | {B861500A-A326-11D3-A248-0080C8F7DE1E} | L | crick | CrickPro.dll | Crick Software's Clicker |
| Protocol (hijack) | {774E529C-2458-48A2-8F57-3ED3105D8612} | L | ct, cw | cwproto.dll | CaseWare, Total Engagement Office (Accounting Program) |
| Protocol | {82D6F09F-4AC2-11D3-8BD9-0080ADB8683C} | L | dadb | dadb.dll | OrangeCD catalog |
| Protocol | {219A97F3-D661-4766-B658-646A771AE49E} | L | df2, df23chat, df3, df4, df5, df5demo, ofpjoin | df2proto.dll | DeltaForce2 |
| Protocol | {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} | L | dialux | DLXToolBox20.dll | DIALux 2.6 (program to simulate light setting) |
| Protocol | {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} | ? | dic | XDictExB.dll | Very probably Kingsoft PowerWord dictionary |
| Protocol | {12D51199-0DB5-46FE-A120-47A3D7D937CC} | L | dvd | msvidctl.dll | Item taken from whitelist of HijackThis |
| Protocol | {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} | ? | ebk | ebkp.dll | Unknown protocol considered safe to remove |
| Protocol | {0EFAEA2E-11C9-11D3-88E3-0000E867A001} | L | emistp | EmisAPP.dll | Emis |
| Protocol hijack | {3AAE7392-E7AA-11D2-969E-00105A088846} | L | eti | EtiPBrkr.dll | Enfish Professional |
| Protocol | {6344A3A0-96A7-11D4-88CC-000000000000} | L | ezstor | viewers\ezspp.dll | EzTools |
| {B3133379-8789-4D3C-9593-C205D7297501} | L | fcp | fcplugin.dll | FirstClass® Client |
| Protocol | {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} | L | file, ftp, gopher, http, https, local, mk | urlmon.dll | Items taken from whitelist of HijackThis |
| Protocol | {C7101FB0-28FB-11D5-883A-204C4F4F5020} | L | flowto | FlowHook.dll | Online investment software: NetExPro ; Harrisdirect |
| Protocol | {9EACF0FB-4FC7-436E-989B-3197142AD979} | L | g7ps | G7PS.dll | G7 Productivity Systems |
| Protocol | {88FED34C-F0CA-4636-A375-3CB6248B04CD} | L | grooveLocalGWS | GrooveSystemServices.dll, GR99D3~1.DLL | MicroSoft_Groove |
| Protocol | {4A8DADD4-5A25-4D41-8599-CB7458766220} | X | icoo | msopt.dll | TROJ_WINSHOW |
| Protocol | {86FE362E-74FA-4F71-8B69-B94D28880628} | X | icoo | icoou.dll | Icoo_Loader |
| Protocol | {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} | L | intu-help-qb1 | HelpAsyncPluggableProtocol.dll | Quickbooks |
| Protocol | {52BAEC6B-9405-46F9-A131-6D50720A3CC4} | L | intu-ir2007 | ic2007pp.dll | Impô tRapide |
| Protocol | {13834D94-C631-4CD1-963D-9B5F4593B127} | L | intu-qt2006 | ic2006pp.dll | Intuit QuickTax |
| Protocol | {9CE7D474-16F9-4889-9BB9-53E2008EAE8A} | L | intu-res | intu-res.dll | Intuit |
| Protocol | {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} | L | ipp, msdaipp | msdaipp.dll | Often shows up in logs as (no CLSID) - (no file)
Items taken from whitelist of HijackThis |
