| Header | CLSID | Status | Name | Path/File | Description |
| Protocol | {53B95211-7D77-11D2-9F80-00104B107C96} | X | about | msxmlpp.dll | Adware.FindemNow |
| Protocol | {3050F406-98B5-11CF-BB82-00AA00BDCE0B} | L | about, javascript, mailto, res, vbscript | mshtml.dll | Items taken from whitelist of HijackThis |
| Protocol | {2A0C35F4-82A3-4C80-919D-7879FEE79DF6} | L | ActLink | actlink.dll | ACT! Link for Peachtree |
| Protocol | {7DC356B2-7366-4F19-BF7A-4875F6AABEA0} | X | advert | nodeipproc.dll | AdClicker.Oddbot |
| Protocol | {3050F406-98B5-11CF-BB82-00AA00BDCE0B} | L | aim, shell | mshtml.dll | Qwik-Fix Pro |
| Filter | {D962EF38-5FB0-4761-8638-C86F085E25E6} | X | application/hta | chp.dll, MWSHELP.DLL | CoolWebSearch parasite variant |
| Filter | {DFF82902-0B96-3B98-6F62-D655E146A23A} | L | application/msword, application/vnd.ms-excel,
application/vnd.ms-powerpoint,
application/x-microsoft-rpmsg-message | mime_filter.dll | Rights Management Add-on for Internet Explorer |
| Filter hijack | {F969FE8E-1937-45AD-AF42-8A4D11CBDC2A} | L | application/octet-stream | mime_filter.dll | Rights Management Add-on for Internet Explorer |
| Filter hijack | {6585E5B4-4D2A-4A1D-A219-4102C64BA999} | X | application/octet-stream | chp.dll, MWSHELP.DLL | CoolWebSearch parasite variant |
| Filter | {1E66F26B-79EE-11D2-8710-00C04F79ED0D} | L | application/vnd-backup-octet-stream | mscoree.dll | Rights Management Add-on for Internet Explorer |
| Filter | {CD4527E8-4FC7-48DB-9806-10537B501237} | L | application/vnd-viewer | (no file) | Rights Management Add-on for Internet Explorer |
| Filter | {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} | L | application/x-bt2 | bt2plugin.dll | BT2Net |
| Filter | {A173B69A-1F9B-4823-9FDA-412F641E65D6} | L | application/x-internet-signup | tiscalifilter.dll | Tiscali |
| Filter, Filter hijack | {32F66A26-7614-11D4-BD11-00104BD3F987} | L | application/xhtml+xml, text/xml, | MathMLMimer.dll | MathPlayer |
| Protocol | {8D32BA61-D15B-11D4-894B-000000000000} | L | asp, hsp, x-asp, x-hsp, x-zip, zip | EzTools\hsppp.dll | EzTools |
| Protocol | {07C0D34D-11D7-43F7-832B-C6BB41726F5F} | X | ayb | [random named].dll | C2Media/lop.com |
| Protocol | {A57721C9-B905-49B3-8BCA-B99FBB8C627E} | L | bega | DatabaseTools.dll | DIALUX Plugin for Bega |
| Protocol | {1730B77B-F429-498F-9B15-4514D83C8294} | L | bt2 | bt2plugin.dll | BT2Net |
| Protocol | {********-****-****-****-************} | O | bw*** (*=random digit) | BWPlugProtocol-8876480.dll | BackWeb |
| Protocol | {9462A756-7B47-47BC-8C80-C34B9B80B32B} | O | bwfile-8876480 | GAPlugProtocol-8876480.dll | BackWeb |
| Protocol | {********-****-****-****-************} | O | bwfile-8876480 | BWPlugProtocol-8876480.dll | BackWeb |
| Protocol | {3DD53D40-7B8B-11D0-B013-00AA0059CE02} | L | cdl | urlmon.dll | Item taken from whitelist of HijackThis |
| Protocol | {CD00020A-8B95-11D1-82DB-00C04FB1625D} | L | cdo | PKMCDO.DLL | Item taken from whitelist of HijackThis; Microsoft SharePoint Portal Server Object Model |
| Protocol | {AD43AA67-6860-4531-AC8A-0E68F9CF023E} | O | CDS300 | __CDS2.dll | CDS protection |
| Protocol | {CF184AD3-CDCB-4168-A3F7-8E447D129300} | L | cetihpz | hpuiprot.dll | HP printer |
| Protocol hijack | {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40} | X | cn | CNBABE.DLL | CommonName |
| Protocol | {D9656C75-5090-45C3-B27E-436FBC7ACFA7} | L | copernicdesktopsearch | COPERN~2.DLL | COPERNIC DESKTOP SEARCH |
| Protocol | {B861500A-A326-11D3-A248-0080C8F7DE1E} | L | crick | CrickPro.dll | Crick Software's Clicker |
| Protocol (hijack) | {774E529C-2458-48A2-8F57-3ED3105D8612} | L | ct, cw | cwproto.dll | CaseWare, Total Engagement Office (Accounting Program) |
| Protocol | {82D6F09F-4AC2-11D3-8BD9-0080ADB8683C} | L | dadb | dadb.dll | OrangeCD catalog |
| Protocol | {219A97F3-D661-4766-B658-646A771AE49E} | L | df2, df23chat, df3, df4, df5, df5demo, ofpjoin | df2proto.dll | DeltaForce2 |
| Protocol | {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} | L | dialux | DLXToolBox20.dll | DIALux 2.6 (program to simulate light setting) |
| Protocol | {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} | ? | dic | XDictExB.dll | Very probably Kingsoft PowerWord dictionary |
| Protocol | {12D51199-0DB5-46FE-A120-47A3D7D937CC} | L | dvd | msvidctl.dll | Item taken from whitelist of HijackThis |
| Protocol | {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} | ? | ebk | ebkp.dll | Unknown protocol considered safe to remove |
| Protocol | {0EFAEA2E-11C9-11D3-88E3-0000E867A001} | L | emistp | EmisAPP.dll | Emis |
| Protocol hijack | {3AAE7392-E7AA-11D2-969E-00105A088846} | L | eti | EtiPBrkr.dll | Enfish Professional |
| Protocol | {6344A3A0-96A7-11D4-88CC-000000000000} | L | ezstor | viewers\ezspp.dll | EzTools |
| {B3133379-8789-4D3C-9593-C205D7297501} | L | fcp | fcplugin.dll | FirstClass® Client |
| Protocol | {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} | L | file, ftp, gopher, http, https, local, mk | urlmon.dll | Items taken from whitelist of HijackThis |
| Protocol | {C7101FB0-28FB-11D5-883A-204C4F4F5020} | L | flowto | FlowHook.dll | Online investment software: NetExPro ; Harrisdirect |
| Protocol | {9EACF0FB-4FC7-436E-989B-3197142AD979} | L | g7ps | G7PS.dll | G7 Productivity Systems |
| Protocol | {88FED34C-F0CA-4636-A375-3CB6248B04CD} | L | grooveLocalGWS | GrooveSystemServices.dll, GR99D3~1.DLL | MicroSoft_Groove |
| Protocol | {4A8DADD4-5A25-4D41-8599-CB7458766220} | X | icoo | msopt.dll | TROJ_WINSHOW |
| Protocol | {86FE362E-74FA-4F71-8B69-B94D28880628} | X | icoo | icoou.dll | Icoo_Loader |
| Protocol | {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} | L | intu-help-qb1 | HelpAsyncPluggableProtocol.dll | Quickbooks |
| Protocol | {52BAEC6B-9405-46F9-A131-6D50720A3CC4} | L | intu-ir2007 | ic2007pp.dll | Impô tRapide |
| Protocol | {13834D94-C631-4CD1-963D-9B5F4593B127} | L | intu-qt2006 | ic2006pp.dll | Intuit QuickTax |
| Protocol | {9CE7D474-16F9-4889-9BB9-53E2008EAE8A} | L | intu-res | intu-res.dll | Intuit |
| Protocol | {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} | L | ipp, msdaipp | msdaipp.dll | Often shows up in logs as (no CLSID) - (no file)
Items taken from whitelist of HijackThis |
| Protocol | {9D148291-B9C8-11D0-A4CC-0000F80149F6} | L | its, ms-its | itss.dll | Items taken from whitelist of HijackThis |
| Protocol | {EA5F5649-A6C7-11D4-9E3C-0020AF0FFB56} | L | iwd | IwdProtocol.dll | Insight Development Corporation NetKnowledge Tools |
| Protocol | {C4D10830-379D-11d4-9B2D-00C04F1579A5} | L | junomsg | ~none listed~ | Juno |
| Protocol | {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} | X | koboo, mbox | mbprot.dll | DuDuAccelerator |
| Protocol | {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} | O | KuGoo, KuGoo3 | KUGOO3~1.OCX, KuGoo3DownXControl.ocx | KuGoo Music download software |
| Protocol | {56831180-F115-11D2-B6AA-00104B2B9943} | L | lbxfile | FileProt.dll | Libronix Digital Library System |
| Protocol | {24508F1B-9E94-40EE-9759-9AF5795ADF52} | L | lbxres | ResProt.dll | Libronix Digital Library System |
| Protocol | {5C135180-9973-46D9-ABF4-148267CBB8BF} | L | lid | msvidctl.dll | Item taken from whitelist of HijackThis |
| Protocol | {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} | L | linkscanner | avgpp.dll | AVG_8
|
| Protocol | {********-****-****-****-************} | ? | mav-8551 | idsAX.dll | Nike_Joga_TV |
| Protocol | {DB47FDC2-8C38-4413-9C78-D1A68BF24EED} | L | mavencache | protocolHandlers.dll | Maven Networks |
| Protocol | {05300401-BCBC-11D0-85E3-00C04FD85AB4} | L | mhtml | inetcomm.dll | Item taken from whitelist of HijackThis |
| Protocol | {0EB00690-8FA1-11D3-96C7-829E3EA50C29} | X | MimeFilter | mimefilte.dll | WOW chinese malware |
| Protocol | {314111C7-A502-11D2-BBCA-00C04F8EC294} | L | ms-help | hxds.dll | Microsoft® Help Data Services Module |
| Protocol | {0A9007C0-4076-11D3-8789-0000F8105754} | L | ms-itss | msitss.dll | Item taken from whitelist of HijackThis |
| Protocol | {74D92DF3-6D9D-11D1-8B38-006097DBED7A} | L | msencarta, msref | MSREF.DLL | Microsoft Encarta |
| Protocol | {B0D92A71-886B-453B-A649-1B91F93801E7} | L | msero | msero.dll | Microsoft Encarta |
| Protocol | {828030A1-22C1-4009-854F-8E305202313F} | L | msnim | msgrapp.dll (often incorrectly listed by HijackThis as missing) | MSN Messenger 7.5 |
| Protocol | {3D9F03FA-7A94-11D3-BE81-0050048385D1} | L | mso-offdap | OWC10.DLL | Item taken from whitelist of HijackThis; Microsoft Office XP Web Components |
| Protocol | {4D034FC3-013F-4B95-B544-44D49ABE3E76} | L | myrm | myRmProt*.*.*.*.dll (*.*.*.*. = version number) | McAfee VirusScan ASaP on-line scanner |
| Protocol | {DF700763-3EAD-4B64-9626-22BEEFF3EA47} | L | nbso | NBSOPProt.dll | NBS Specification Writer |
| Protocol | {3D206AE2-3039-413B-B748-3ACC562EC22A} | L | nim | nmcg32.dll | Novell_Messenger |
| Protocol | {32505114-5902-49B2-880A-1F7738E5A384} | L | OWC11.mso-offdap | OWC11.DLL | Item taken from whitelist of HijackThis; Microsoft Office XP Web Components |
| Protocol | {182D0C85-206F-4103-B4FA-DCC1FB0A0A44} | L | pcl | HSPCLPRO10.dll | Autodesk_Inventor |
| Protocol | {D540F040-F3D9-11D0-95BE-00C04FD93CA5} | L | pcn | V1MK.DLL | Encompass browser (Yahoo) |
| Protocol | {A479F961-CC9E-11D0-A220-000000000000} | L | pm | PmProtocol.dll | Autodesk_Buzzsaw |
| Protocol | {4746C79A-2042-4332-8650-48966E44ABA8} | L | pure-go | puresp.dll | Smarth Home Networking |
| Protocol | {662E7FAE-5C17-491C-AD9D-98C1F66CC6A0} | L | qbpos | QBPOSProtocol.dll | QuickBook_Point_Of_Sale |
| Protocol | {FC598A64-626C-4447-85B8-53150405FD57} | L | qbwc | %SYSDIR%\mscoree.dll | QuickBooks_WebConnector |
| Protocol | {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} | L | qrev | RNetPin.dll | Quest SQL |
| Protocol | {342E73B1-027E-11D5-90A2-00105A98B327} | L | rbna | rbnaprot.dll | Reuters_Kobra_5 |
| Protocol | {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE} | X | relatedlinks | BTLINK.DLL | RelatedLinks/Huntbar |
| Protocol | {5AB65DD4-01FB-44D5-9537-3767AB80F790} | X | relatedlinks | msielink.dll | RelatedLinks/Huntbar |
| Protocol | {23C585BB-48FF-4865-8934-185F0A7EB84C} | L | rmh | mime_filter.dll | Rights Management Add-on for Internet Explorer |
| Protocol | {8125919B-9BE9-4213-A1D6-75188A22D21E} | L | SafeAuthenticate | MVNFILT3.DLL | Macrovision SafeAuthenticate |
| Protocol | {D1F8BD1E-7967-11D2-B43A-006094B9EADB} | L | saphtmlp, sapr3 | saphtmlp.dll | SAP |
| Protocol | {79E0F14C-9C52-4218-89A7-7C4B0563D121} | L | sds | ExplorerExtensions.dll | Sharpdesk |
| Protocol | {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} | L | siteadvisor | SiteAdv.dll | SiteAdvisor |
| Protocol | {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} | L | skype4com | Skype4COM.dll | Skype4COM |
| Protocol | {FA3F5003-93D4-11D2-8E48-00A0C98BD8C3} | L | smscrd | sms_mcrd.dll | Microsoft Systems Management Server
"easter egg" |
| Protocol | {3050F406-98B5-11CF-BB82-00AA00BDCE0B} | X | start | LORUX[^a.dll | CoolWebSearch parasite variant |
| Protocol (hijack) | {53B95211-7D77-11D2-9F81-00104B107C96} | X | start, about | MSXWORD.DLL, SYSTEM***.dll (*** random digits) | CoolWebSearch parasite variant |
| Protocol | {FFAD3420-6D61-44F6-BA25-293F17152D79} | L | stibo | ProtocolHandler.dll | RS Electronic |
| Protocol | {76E67A63-06E9-11D2-A840-006008059382} | L | sysimage | mshtml.dll | Item taken from whitelist of HijackThis |
| Protocol | {C6D89159-3467-4C2F-9918-3362DA57BCD2} | L | t-mobile | TMOBIL~1.DLL, | T-Mobile Hotspots |
| Protocol | {4D25FB7A-8902-4291-960E-9ADA051CFBBF} | O | tbr | %Program Files%\Crawler\ctbr.dll | Adware-CTBar |
| Filter | {DFAA31C8-A356-4313-9D95-5EDAB46C5070} | X | text/html | lmf32v.dll, qlink32.dll | Adware Hyperlinker |
| Filter | {950238FB-C706-4791-8674-4D429F85897E} | X | text/html | mfiltis.dll | Adware ISearch |
| Filter | {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} | X | text/html | xplugin.dll | Adware TMKSoft |
| Filter | {E64E4E60-EF13-4C79-A159-119762E18181} | X | text/html | lmf32.dll | Adware Hyperlinker |
| Filter | {2DE94081-9FE6-4227-BC59-B7A80CC8308C} | X | text/html | searchrep***.dll, taggerbh***.dll, trackurl***.dll, urlcli***.dll, msvrfy***.dll, gstylebho***.dll, dnsrep***.dll, 2in1***.dll | Clientman parasite |
| Filter | {EE7A946E-61FA-4979-87B8-A6C462E6FA62} | X | text/html | httpfilter.dll, digfilt.dll | TROJ_SCAGENT.B |
| Filter | {CC905FF6-B553-496C-9DFA-CFF65ADCD0FC} | X | text/html | ms****.dll, searchrep***.dll (*** random digits) | Parasite Clientman |
| Filter | {3846F57F-F837-47D0-A93B-C8FC85A70D70} | X | text/html | V0.15.dat | Dialui-A |
| Filter | {********-****-****-****-************} | X | text/html | V0.26.dat | Dialui-C |
| Filter | {8293D547-38DD-4325-B35A-F1817EDFA5FC} | X | text/html | CASMF.DLL, cmappmf.dll | Adware.CasinoClient |
| Filter | {2AB289AE-4B90-4281-B2AE-1F4BB034B647} | X | text/html | sfcont.dll | RXToolbar |
| Filter | {8253D547-38DD-4325-B35A-F1817EDFA5F5} | X | text/html | plugin.dll | Adware.CasinoClient |
| Filter | {8D42AD12-D7A1-4797-BCB7-AD89E5FCE4F7} | L | text/html | PhoneFilter.dll | PBNext |
| Filter | {6793D547-38DD-4325-B35A-F1817EDFA567} | X | text/html | mfhlp.dll | Adware.CasinoClient |
| Filter | {F79B2338-A6E7-46D4-9201-422AA6E74F43} | L | text/html | EagleFlt.dll | tuEagles_Anti-Porn_parental_controls |
| Filter | {0FA7FD6B-47C3-425B-AE30-36383F1C4503} | X | text/html | ejrwx8drl.dll | QuickLinks/LinkMaker adware variant |
| Filter | {CEA53356-C414-4331-A35E-AA4CE9D8DFA2} | X | text/html | w9seq.dll | AdWare.Win32.Suggestor |
| Filter | {994D478A-45D0-4DB4-AE77-288B1E346E99} | X | text/html | FCAdvice.dll | FCADVICE |
| Filter | {2F6E85DC-8D2D-4896-8A4F-7DF8A7B1749D} | X | text/html | jalmp.dll | Adware-LinkMaker |
| Filter | {D332110E-3EDB-417B-B8E2-297B61C074C6} | X | text/html | OUGHYA~1.DLL | Adware-FFinder |
| Filter | {DA28E0DB-229C-4003-827E-96AE15AD90FB} | X | text/html | x3cqp0.dll | Adware.Suggestor |
| Filter | {65CBAF77-19CA-4B81-86D5-7835D59BEA85} | X | text/html | INTEL.dll, SoMP3.dll, so.dll | Adware-TargetAD |
| Filter | {B5F86455-BF18-4E12-965A-6642A0AC0549} | X | text/html | xeymi.dll | WinFixer |
| Filter | {994D478A-45D0-4DB4-AE27-738B1E346F99} | X | text/html | Batty2.dll | FullContext Pshope |
| Filter | {AE3B25B6-4C21-4038-BD35-99A05B5EF3EB} | X | text/html | s9ndzm6.dll | Quicklinks |
| Filter | {889A88EA-6A7A-44A8-86B6-A568EB90F243} | X | text/html | p2jlseh8.dll | Adware.Suggestor/Quicklinks |
| Filter | {994D478A-45D0-4DB4-AE28-738B1E346F99} | X | text/html | Exolon.dll | CasClient |
| Filter | {99FEA1B2-7881-11D1-A9E2-00403320FCF2} | L | text/html | %Program Files%\Desktop Armor\GeekSuperheroX.dll | Desktop_Armor |
| Filter | {0EB00690-8FA1-11D3-96C7-829E3EA50C29} | X | text/html | Maxthonz.dll, IeFilter.dll, ftpsconfig.dll, QTProxy.dll, mfc313u.dll | WOW chinese malware |
| Protocol | {0EB00690-8FA1-11D3-96C7-829E3EA50C29} | X | text/html | Maxthonz.dll, mfc313u.dll | WOW chinese malware |
| Filter hijack | {0EB00690-8FA1-11D3-96C7-829E3EA50C29} | X | text/html | mimefilte.dll | WOW chinese malware |
| Filter hijack | {07851C6A-1C43-41d9-8319-BC89154A8C00} | X | text/html | httpdchk.dll | TROJ_AGENT.TQZ |
| Filter hijack | {53B95211-7D77-11D2-9F80-00104B107C96} | X | text/html | %WINDIR%\twain_16.dll , %WINDIR%\xmlmimefilter.dll | Use SDFix under supervision, http://andymanchesta.com/SDFix_Changelog.htm |
| Filter | {63B95211-7D77-11D2-9F80-00104B107C96} | X | text/html, text/plain | LORUX[^a.dll | CoolWebSearch parasite variant |
| Filter | {55A83695-84E2-49E2-AB1C-6E6733ECD8B4} | X | text/plain | madopew.dll | CoolWebSearch parasite variant |
| Filter | {C51721BE-858B-4A66-A8BF-D2882FF49820} | L | text/x-mrml | MidRadio.ocx | MidRadio Player from Yamaha |
| Filter hijack | {807563E5-5146-11D5-A672-00B0D022E945} | L | text/xml | MSOXMLMF.DLL | Microsoft Office XML Filter |
| Protocol | {CE5CD329-1650-414A-8DB0-4CBF72FAED87} | L | textwareilluminatorbase | textwareilluminatorbaseProtocol.dll | TextWare Illuminator (programming tool) |
| Protocol | {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} | X | tpro | toolbar.dll | IBIS toolbar |
| Protocol | {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} | L | tv | msvidctl.dll | Item taken from whitelist of HijackThis |
| Protocol hijack | {9E754710-6158-11D5-B6CE-0050DAAEA668} | ? | tv | [none listed] | As yet unidentified. Probably WareOut malware |
| Protocol | {CBD30859-AF45-11d2-B6D6-00C04FBBDE6E} | L | tve-trigger | ~none listed~ | TV enhancement HTML trigger |
| Protocol | {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} | L | vnd.ms.radio | msdxm.ocx | Item taken from whitelist of HijackThis |
| Protocol | {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} | L | wia | wiascr.dll | Item taken from whitelist of HijackThis |
| Protocol | {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} | L | widimg | btxppanel.dll | WIDCOMM Bluetooth |
| Protocol | {03C514A3-1EFB-4856-9F99-10D7BE1653C0} | L | wlmailhtml | mailcomm.dll | Windows_Live_Mail_Desktop |
| Protocol | {7E8717B0-D862-11D5-8C9E-00010304F989} | L | x-atng | atngprot.dll | Active Trader Protocol |
| Protocol | {9D6CC632-1337-4A33-9214-2DA092E776F4} | L | x-excid | mimectl.dll | Microsoft Exchange Server 2003 |
| Protocol | {C3719F83-7EF8-4BA0-89B0-3360C7AFB7CC} | L | x-mem1 | wowctl2.dll | EzTools WOW
|
| Protocol | {4F6D06DD-44AB-4F89-BF13-9027B505B15A} | L | x-mem3 | eztoolslib2.dll | eztools-software |
Engine Version 2.0 by CastleCops
