Malware Removal Information

Hoofdmenu

Home
Malware info
- Malware - Securitysuites
- Waarom?
Scanners
Infecties
- Archief 0 - E
- Archief F - N
- Archief O - S
- Archief T - Z
- CLB rootkit
- DNS-hijackers
- Haxdoor - Goldun
- Sinowal
- TDL3
- TDL4
- Virut
- Vundo
- Whistler
Tools
- Hijackthis
  - Hijackthis
  - Hijackthis handleiding
- Rootkitscanners
- ComBoFix
- HaxFix
- LSPFix
- Reglooks
- Roguescanfix
- SmitfraudFix
Informatie
Preventie
- De computer is malware vrij
- Infecties voorkomen

VirusProtect

Infecties > Archief T - Z

VirusProtectPro is een spywareremover van de zwarte lijst. Het wordt geïnstalleerd op de computer via Zlob infecties.

In de systray zie je een knipperend icoontje dat je waarschuwt dat de computer geïnfecteerd is.
Het programma VirusProtectPro wordt op de computer gedropt, vindt een aantal infecties, maar geeft aan deze pas te verwijderen als je het product koopt. En daar is het de makers van deze malware om te doen.

Elke keer de computer opnieuw start, start ook VirusProtectPro en begint het te scannen.

Kenmerken in een hijackthislog zijn ondermeer deze:
O4 - HKLM\..\Run: [VirusProtectPro 3.3] "C:\Program Files\VirusProtectPro 3.3\VirusProtectPro 3.3.exe" /h
O4 - HKLM\..\Run: [VirusProtectPro 3.4] "C:\Program Files\VirusProtectPro 3.4\VirusProtectPro 3.4.exe" /h
O4 - HKLM\..\Run: [VirusProtectPro 3.5] "C:\Program Files\VirusProtectPro 3.5\VirusProtectPro 3.5.exe" /h
O4 - HKLM\..\Run: [VirusProtectPro 3.6] "C:\Program Files\VirusProtectPro 3.6\VirusProtectPro 3.6.exe" /h
O4 - HKLM\..\Run: [VirusProtectPro 3.7] "C:\Program Files\VirusProtectPro 3.7\VirusProtectPro 3.7.exe" /h
O4 - HKLM\..\Run: [VirusProtect 3.8] "C:\Program Files\VirusProtect 3.8\VirusProtect 3.8.exe" /h
O4 - HKLM\..\Run: [VirusProtect 3.9] "C:\Program Files\VirusProtect 3.9\VirusProtect 3.9.exe" /h

O22 - SharedTaskScheduler: ablator - {fce1c203-ff2b-4ec1-9983-e2900d29bbd8} - C:\WINDOWS\system32\axdpfl.dll
O22 - SharedTaskScheduler: aposiopetic - {91316323-2ad5-4794-9589-52a2eaa60a68} - C:\WINDOWS\system32\shlahsd.dll
O22 - SharedTaskScheduler: cured - {7265100a-17e1-41bf-bd08-63b95a25a9c3} - C:\WINDOWS\system32\ofcpi.dll
O22 - SharedTaskScheduler: doglike - {3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea} - C:\WINDOWS\system32\fftktmk.dll
O22 - SharedTaskScheduler: edgers - {d66c22b6-2217-4d1a-9a90-1a54de1fc706} - C:\WINDOWS\system32\zcwlnic.dll
O22 - SharedTaskScheduler: end - {aaad3a22-1c07-45f5-bfb3-e9a8c3b382fe} - C:\WINDOWS\system32\fsehfcu.dll
O22 - SharedTaskScheduler: esperantido - {67dc0736-075a-4647-95f5-d5421b838fed} - C:\WINDOWS\system32\svxmhpz.dll
O22 - SharedTaskScheduler: ficklety - {e31f5c72-8e0d-4921-8375-9573746c170c} - C:\WINDOWS\system32\ezzhjmt.dll
O22 - SharedTaskScheduler: geosphere - {c0ca766d-060c-48e1-b536-205e321bd174} - C:\WINDOWS\system32\wowlze.dll
O22 - SharedTaskScheduler: haeckel - {8373a2e0-bdd0-42bd-b4ec-ba5451eb6607} - C:\WINDOWS\system32\moywh.dll
O22 - SharedTaskScheduler: hemoglobinometries - {c7cd9e83-3bf6-47f8-b2e2-b114c96c1888} - C:\WINDOWS\system32\qhcvdw.dll

Hoe kan je VirusProtectPro en de Zlob infectie van de computer verwijderen:

Smitfraudfix (gemaakt door S!Ri)
Zie hier.

Roguescanfix (gemaakt door Beamerke)
Zie hier.

Manueel verwijderen:
Rechtsklik op het icoontje van VirusProtectPro in de systray, en kies voor "Exit".
Bevestig de waarschuwing die je krijgt om VirusProtectPro af te sluiten door op "Ja" te klikken".
Ga naar start - Alle programma's - VirusProtectPro en kies uninstall VirusProtectPro 3.4 (of later versies) om het deïnstallatieprocess te starten.
Hernoem het verantwoordelijk bestandje, (zie hieronder) of verwijder dit bestand met behulp van Killbox.
Download Pocket KillBox.
Unzip het programma naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie “Delete on reboot”.
In het veld “Full path of file to delete" plaats je volledige pad naar het verantwoordelijke bestand.
Klik dan op de knop "Single File".
Klik op de knop met de rode cirkel en het witte kruis.
Wanneer het programma vraagt om nu te rebooten, geef je hier toestemming voor. Klik op de knop "YES".
Na herstart zou de infectie verdwenen moeten zijn.
Om wijzigingen in het register op te ruimen, kan je deze regfile nog gebruiken.

Gekende varianten:

afzdbl.dll
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler]
"{8068bf35-3711-4dce-a2f3-f008cecfe894}"="araca"

[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{8068bf35-3711-4dce-a2f3-f008cecfe894}InProcServer32]
@="C:WINDOW\\Ssystem32\\afzdbl.dll"

axdpfl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fce1c203-ff2b-4ec1-9983-e2900d29bbd8}"="ablator"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fce1c203-ff2b-4ec1-9983-e2900d29bbd8}\InProcServer32]
@="C:\\WINDOWS\\system32\\axdpfl.dll"

ayjhc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}"="cordiformis"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95a4b6d8-dcd9-453a-aedf-f5d10af2519a}\InProcServer32]
@="C:\\WINDOWS\\system32\\ayjhc.dll"

bgwttyl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cfda6372-043c-48d2-ba3c-7bfe1cf71854}"="acanthology"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cfda6372-043c-48d2-ba3c-7bfe1cf71854}\InProcServer32]
@="C:\\WINDOWS\\system32\\bgwttyl.dll"

ccyszwl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}"="arachnodacty"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}\InProcServer32]
@="C:\\WINDOWS\\system32\\ccyszwl.dll"

cefrjsh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a1c16871-b797-4ec7-bbee-83852379c390}"="formicivora"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1c16871-b797-4ec7-bbee-83852379c390}\InProcServer32]
@="C:\\Windows\\system32\\cefrjsh.dll"

cfqbw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1152a0e8-5be5-41cc-8312-556581690a61}"="amateurishly"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1152a0e8-5be5-41cc-8312-556581690a61}\InProcServer32]
@="C:\\WINDOWS\\system32\\cfqbw.dll"

cqsfk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cea2e5cd-e849-427b-80f0-59298caef1c4}"="convalescently"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cea2e5cd-e849-427b-80f0-59298caef1c4}\InProcServer32]
@="C:\\WINDOWS\\System32\\cqsfk.dll"

ddomv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9f5cb985-d4a4-49af-9185-133f956b5756}"="anthracosaurus"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9f5cb985-d4a4-49af-9185-133f956b5756}\InProcServer32]
@="C:\\WINDOWS\\System32\\ddomv.dll"

dyrwls.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"="idealise"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}\InProcServer32]
@="C:\\WINDOWS\\system32\\dyrwls.dll"

eigbbb.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c4da240e-7525-404a-b366-f50a422376d8}"="arouse"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4da240e-7525-404a-b366-f50a422376d8}\InProcServer32]
@="C:\\WINDOWS\\system32\\eigbbb.dll"

ezzhjmt.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e31f5c72-8e0d-4921-8375-9573746c170c}"="ficklety"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e31f5c72-8e0d-4921-8375-9573746c170c}\InProcServer32]
@="C:\\WINDOWS\\system32\\ezzhjmt.dll"

fdpzgi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1c6fd4e6-49ce-4178-875b-df70eac260c5}"="aguilarite"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1c6fd4e6-49ce-4178-875b-df70eac260c5}\InProcServer32]
@="C:\\WINDOWS\\System32\\fdpzgi.dll"

fftktmk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}"="doglike"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3750da11-9b0c-4a75-9c8a-bbcbfcd1ccea}\InProcServer32]
@="C:\\WINDOWS\\system32\\fftktmk.dll"

fqdqs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}"="heterostyly"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd0e4a1a-dbc2-48f7-9a6a-a41cac20bddc}\InProcServer32]
@="C:\\WINDOWS\\System32\\fqdqs.dll"

fsehfcu.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aaad3a22-1c07-45f5-bfb3-e9a8c3b382fe}"="end"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aaad3a22-1c07-45f5-bfb3-e9a8c3b382fe}\InProcServer32]
@="C:\\WINDOWS\\system32\\fsehfcu.dll"

fshqaln.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4a9e875b-d032-45e4-8294-789fe3be5b19}"="atrichia"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}\InProcServer32]
@="C:\\WINDOWS\\system32\\fshqaln.dll"

fwjgtk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6747456b-cea8-463d-ad2a-50d67ae73d30}"="cakewalks"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6747456b-cea8-463d-ad2a-50d67ae73d30}\InProcServer32]
@="C:\\WINDOWS\\system32\\fwjgtk.dll"

fwrkqfl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6e886df7-914d-48f0-86b3-a5cf24385361}"="falsism"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6e886df7-914d-48f0-86b3-a5cf24385361}\InProcServer32]
@="C:\\WINDOWS\\system32\\fwrkqfl.dll"

fyhwfc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}"="biltongs"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc7cbb1b-2da6-4e7d-a1ea-bf6705dd0f8c}\InProcServer32]
@="C:\\WINDOWS\\system32\\fyhwfc.dll"

gkymhk.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{903902a8-0691-460e-8351-24df3d425e9c}"="apdu"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{903902a8-0691-460e-8351-24df3d425e9c}\InProcServer32]
@="C:\\WINDOWS\\system32\\gkymhk.dll"

gtawclv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e71aba09-d81a-4876-baa3-df133c1dfc48}"="enjoyment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}\InProcServer32]
@="C:\\WINDOWS\\system32\\gtawclv.dll"

gusur.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4f5f16ef-af9d-4fe6-8410-f0670b58979d}"="exultet"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f5f16ef-af9d-4fe6-8410-f0670b58979d}\InProcServer32]
@="C:\\WINDOWS\\system32\\gusur.dll"

guxmhcd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fedff4ae-1302-4b8a-bda9-43b9f67b9749}"="astronomically"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fedff4ae-1302-4b8a-bda9-43b9f67b9749}\InProcServer32]
@="C:\\WINDOWS\\system32\\guxmhcd.dll"

igzxwrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{18a8f76b-804b-4981-b87c-460699971a4b}"="dataria"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18a8f76b-804b-4981-b87c-460699971a4b}\InProcServer32]
@="C:\\WINDOWS\\system32\\igzxwrl.dll"

iklqcx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{de5ede53-9db0-422d-b32d-5c41c96d6f52}"="heterotroph"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}\InProcServer32]
@="C:\\Windows\\system32\\iklqcx.dll"

khtbpdl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c82e1789-207a-4b8a-806f-76b62dfac2a2}"="hutlet"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c82e1789-207a-4b8a-806f-76b62dfac2a2}\InProcServer32]
@="C:\\WINDOWS\\system32\\khtbpdl.dll"

ktrxe.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}"="hemprich"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af8bca8b-a9f1-471d-bdcd-caa14be2bdd9}\InProcServer32]
@="C:\\WINDOWS\\system32\\ktrxe.dll"

kvfvw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}"="glauke"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc824bb2-d4b3-41f1-bba0-f8240e4cc495}\InProcServer32]
@="C:\\WINDOWS\\system32\\kvfvw.dll"

kzpkwj.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f39d0dee-b2f0-4591-9187-1cc39c1df98a}"="biisk"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f39d0dee-b2f0-4591-9187-1cc39c1df98a}\InProcServer32]
@="C:\\WINDOWS\\system32\\kzpkwj.dll"

lapmvzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fde1bd72-ca80-443f-9526-595337b73878}"="hieroglyphist"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fde1bd72-ca80-443f-9526-595337b73878}\InProcServer32]
@="C:\\WINDOWS\\system32\\lapmvzf.dll"

lrnjnzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e4c46558-da01-4637-a85e-f1ccb1c7436a}"="hyams"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e4c46558-da01-4637-a85e-f1ccb1c7436a}\InProcServer32]
@="C:\\WINDOWS\\system32\\lrnjnzf.dll"

mivmv.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{6625fc6c-731c-443a-b3f0-2c8c520a1766}"="anhydrase"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6625fc6c-731c-443a-b3f0-2c8c520a1766}\InProcServer32]
@="C:\\WINDOWS\\system32\\mivmv.dll"

moywh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"="haeckel"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}\InProcServer32]
@="C:\\WINDOWS\\system32\\moywh.dll"

muvdjo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTas
kScheduler]
"{46f5a8b0-0b73-48c5-9e40-3c443a43c161}"="aht"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}\InProcServer32]
@="C:\\WINDOWS\\system32\\muvdjo.dll"

myqlejy.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{98ca7898-6029-41ab-8f67-ea4f5e1afc22}"="biocomputing"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98ca7898-6029-41ab-8f67-ea4f5e1afc22}\InProcServer32]
@="C:\\WINDOWS\\system32\\myqlejy.dll"

nexpegp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}"="electroosmoses"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb86b46a-d6db-4478-8f5f-06cb2ebc1b35}\InProcServer32]
@="C:\\Windows\\system32\\nexpegp.dll"

nuqjici.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{94524218-9af3-4643-9687-cbc2880e54da}"="fagging"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94524218-9af3-4643-9687-cbc2880e54da}\InProcServer32]
@="C:\\WINDOWS\\system32\\nuqjici.dll"

ofcpi.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{7265100a-17e1-41bf-bd08-63b95a25a9c3}"="cured"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7265100a-17e1-41bf-bd08-63b95a25a9c3}\InProcServer32]
@="C:\\WINDOWS\\system32\\ofcpi.dll"

onljweo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{33b8d257-07f6-4c06-8605-94bc21728635}"="discommodiousness"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}\InProcServer32]
@="C:\\WINDOWS\\system32\\onljweo.dll"

osdjhjc.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}"="disenfranchising"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2b8cea1-c8a7-48e2-b2fd-89ae5c608fb8}\InProcServer32]
@="C:\\WINDOWS\\system32\\osdjhjc.dll"

psndz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fa55d551-9698-48ac-b639-9b00cf1a6ea0}"="grazable"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fa55d551-9698-48ac-b639-9b00cf1a6ea0}\InProcServer32]
@="C:\\WINDOWS\\system32\\psndz.dll"

qhcvdw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c7cd9e83-3bf6-47f8-b2e2-b114c96c1888}"="hemoglobinometries"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7cd9e83-3bf6-47f8-b2e2-b114c96c1888}\InProcServer32]
@="C:\\WINDOWS\\system32\\qhcvdw.dll"

ryxrho.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}"="archiblast"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bd1299cd-b98a-4ee1-9ae3-d3cb3da41d0d}\InProcServer32]
@="C:\\WINDOWS\\system32\\ryxrho.dll"

shlahsd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{91316323-2ad5-4794-9589-52a2eaa60a68}"="aposiopetic"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91316323-2ad5-4794-9589-52a2eaa60a68}\InProcServer32]
@="C:\\WINDOWS\\system32\\shlahsd.dll"

svxmhpz.dll
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler]
"{67dc0736-075a-4647-95f5-d5421b838fed}"="esperantido"
[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{67dc0736-075a-4647-95f5-d5421b838fed}InProcServer32]
@="C:WINDOW\\Ssystem32\\afzdbl.dll"

surzzh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{cfda6372-043c-48d2-ba3c-7bfe1cf71854}"="inscenation"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cfda6372-043c-48d2-ba3c-7bfe1cf71854}\InProcServer32]
@="C:\\Windows\\system32\\surzzh.dll"

tiqmcx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTasScheduler]
"{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}"="athermancies"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ced7d5f3-74cc-4c2f-8d60-62ebcdda0a22}\InProcServer32]
@="C:\\WINDOWS\\system32\\tiqmcx.dll"

tkrsw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}\InProcServer32]
@="H:\\WINDOWS\\system32\\tkrsw.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b8b3850e-a22e-43ab-a15e-63f6e47db7e6}"="clamourers"

tmxxxh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{70d17a5f-ef27-4295-90f5-20ad6f24834f}"="dizening"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70d17a5f-ef27-4295-90f5-20ad6f24834f}\InProcServer32]
@="C:\\WINDOWS\\system32\\tmxxxh.dll"

tqcwm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2bb2b2d6-8b86-412e-acca-d656a8979b3e}"="fraternalism"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bb2b2d6-8b86-412e-acca-d656a8979b3e}\InProcServer32]
@="C:\\WINDOWS\\system32\\tqcwm.dll"

tvtpwp.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}"="eaton"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d8b937a4-cdad-497b-a872-8da7c4c3ef6f}\InProcServer32]
@="C:\\WINDOWS\\system32\\tvtpwp.dll"

uglgs.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{76fbb79c-2ec6-4962-a324-fd4362588e1c}"="graphologists"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76fbb79c-2ec6-4962-a324-fd4362588e1c}\InProcServer32]
@="C:\\WINDOWS\\system32\\uglgs.dll"

ugofuq.dll
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler]
"{c704547b-26c0-4222-a034-81653c07b494}"="eperdument"
[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{c704547b-26c0-4222-a034-81653c07b494}InProcServer32]
@="C:WINDOWS\\system32\\ugofuq.dll"

vgibz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
{4a9e875b-d032-45e4-8294-789fe3be5b19}"="dustuck"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a9e875b-d032-45e4-8294-789fe3be5b19}\InProcServer32]
@="C:\\WINDOWS\\system32\\vgibz.dll"

vjxwnn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{bd2948f8-c949-464f-824a-6272608c739e}"="criticalness"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{bd2948f8-c949-464f-824a-6272608c739e}InProcServer32]
@="C:\\WINDOWS\\system32\\vjxwnn.dll"

vophqmn.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e71aba09-d81a-4876-baa3-df133c1dfc48}"="helicoid"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e71aba09-d81a-4876-baa3-df133c1dfc48}\InProcServer32]
@="C:\\WINDOWS\\System32\\vophqmn.dll"

vpccw.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{e758745e-b8aa-47ac-a652-6307ff5f3ebf}"="counterclaim"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e758745e-b8aa-47ac-a652-6307ff5f3ebf}\InProcServer32]
@="C:\\WINDOWS\\system32\\vpccw.dll"

vvihh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b36d60c8-e1ce-464e-b74c-8128a627ef56}"="hyracina"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b36d60c8-e1ce-464e-b74c-8128a627ef56}\InProcServer32]
@="C:\\WINDOWS\\system32\\vvihh.dll"

wfcof.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}"="firstlings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9af8f31b-b778-4413-b8ed-ae63a62e1f7d}\InProcServer32]
@="C:\\WINDOWS\\system32\\wfcof.dll"

wowlze.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c0ca766d-060c-48e1-b536-205e321bd174}"="geosphere"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c0ca766d-060c-48e1-b536-205e321bd174}\InProcServer32]
@="C:\\WINDOWS\\system32\\wowlze.dll"

wpchz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{5889f7b0-3277-4266-b4bd-1bf2d394aee6}"="hydronephrosises"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5889f7b0-3277-4266-b4bd-1bf2d394aee6}\InProcServer32]
@="C:\\WINDOWS\\system32\\wpchz.dll"

wzhtjqo.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}"="enlodgement"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}\InProcServer32]
@="D:\\WINDOWS\\system32\\wzhtjqo.dll"

xnvaogd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}"="coronally"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1b17f1db-790e-4d42-8e0c-d4d19123ee5b}\InProcServer32]
@="C:\\WINDOWS\\system32\\xnvaogd.dll"

xtsyynm.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{a4029063-4fe3-422c-ac72-12905c09642a}"="clinker"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4029063-4fe3-422c-ac72-12905c09642a}\InProcServer32]
@="C:\\WINDOWS\\system32\\xtsyynm.dll"

yhjbbzf.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{49f29a27-2451-4314-a480-8d2481ce6c81}"="cyk"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49f29a27-2451-4314-a480-8d2481ce6c81}\InProcServer32]
@="C:\\WINDOWS\\system32\\yhjbbzf.dll"

zcwlnic.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d66c22b6-2217-4d1a-9a90-1a54de1fc706}"="edgers"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d66c22b6-2217-4d1a-9a90-1a54de1fc706}\InProcServer32]
@="C:\\WINDOWS\\system32\\zcwlnic.dll"

zdwii.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2fdde73c-273e-4e55-84dc-455de06e4866}"="amaretti"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fdde73c-273e-4e55-84dc-455de06e4866}\InProcServer32]
@="C:\\WINDOWS\\system32\\zdwii.dll"

zkpssqa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}"="bosken"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d1e5ca97-235e-4ff0-9b92-7543c9d61ff4}\InProcServer32]
@="C:\\WINDOWS\\system32\\zkpssqa.dll"

zpeolvh.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4688f900-0d0c-4788-b297-59cc10e70ccc}"="amberoids"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}\InProcServer32]
@="C:\\WINDOWS\\system32\\zpeolvh.dll"

zpuwriz.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{547aaa89-7e6b-42b4-b112-a64955f86a2a}"="adirondack"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{547aaa89-7e6b-42b4-b112-a64955f86a2a}\InProcServer32]
@="C:\\WINDOWS\\system32\\zpuwriz.dll"