# google Redirects, Antivirus doesn't work, sirefef.B trojan?



## Smasher (Jul 13, 2011)

This is awful. I noticed my PC Tools Spyware Doctor and Antivirus had stopped working. I found that Spybot tried to scan and then just disappeared from the screen - unable to start up again. Similarly with Immunet I installed. Using Google Updater I discovered that the google updater service wasn't started. I tried to manually start it but got an error "Error 1053"

I tried Windows Defender and it came up with a serious threat and called it Trojan:windows32 sirefef.B or something similar. It failed to remove it and now doesn't even pick it up.

Any search [using Chrome] to find out about it made my browser redirect to Stopzilla site. And then after a while an odd looking 'survey' about Google. Luckily I was able to use Maxthon browser to visit the actual sites behind the genuine links.

I have now tried to follow the instructions on this site about 'before you post'...

1. HijackThis. I managed to install it and run it but there was an hiccough and it disappeared! - I have no idea why and I cannot get it back and it didn't write anything to a log file. I even tried to re-install HJT but it wouldn't run. When I click on HijackThis.exe now I get the error 'Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item". [I am running this computer as a administrator.]

2. Downloaded DDS successfully and got that to produce the appropriate files - Attach.zip is attached [though I can't see it on this posting page] and the DDS is pasted below

3. I downloaded GMER and followed the instructions carefully. I unchecked the relevant boxes and letting it run and then it seemed to freeze and then nothing. I hadn't touch the mouse but I did have the Maxthon Browser open. Sorry. I've tried downloading it again and running again but nothing is happening.

I have no idea what's going on here. A previous poster seemed to have similarly described problem but I think he was able to paste a HJT file.

I really don't know what to do - I've never come across a virus like this.

Your help would be very much appreciated.

Thank you

Smash

Here's the DDS file
---
.
DDS (Ver_2011-06-23.01) - NTFSx86 
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Smash at 22:15:45 on 2011-07-13
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.1418 [GMT 1:00]
.
AV: Immunet Protect *Enabled/Updated* {E26D838D-778A-C93D-0B41-46E786995C11}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
"\\.\globalroot\Device\svchost.exe\svchost.exe"
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ClipX\clipx.exe
C:\Users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanionInfo.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Windows\system32\crypserv.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\StkCSrv.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Immunet Protect\2.0.17\iptray.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Windows\system32\msiexec.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.bing.com/?pc=AVBR
uStart Page = hxxp://www.bing.com/?pc=AVBR
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: MailBrowser Gmail BHO: {7913b734-7109-11de-a1c1-e29955d89593} - c:\users\smash\appdata\roaming\webyog\mailbrowser\extension\msie\iemailbrowser.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {52E729D7-DFFB-4011-97EE-D7E28212D901} - No File
EB: MailBrowser: {cfcd3fd2-49bd-11de-95b8-42d256d89593} - c:\users\smash\appdata\roaming\webyog\mailbrowser\extension\msie\iemailbrowser.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Sony Ericsson PC Companion] "c:\program files\sony ericsson\sony ericsson pc companion\PCCompanion.exe" /Background
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.EXE
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [M-Audio Taskbar Icon] c:\windows\system32\M-AudioTaskBarIcon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Immunet Protect] "c:\program files\immunet protect\2.0.17\iptray.exe"
StartupFolder: c:\users\smash\appdata\roaming\micros~1\windows\startm~1\programs\startup\clipx.lnk - c:\program files\clipx\clipx.exe
StartupFolder: c:\users\smash\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\smash\appdata\roaming\dropbox\bin\Dropbox.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\evernote\evernote3.5\enbar.dll
LSP: mswsock.dll
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{9C141EDE-F127-467B-A3EA-4CF0C9F8513D} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{9C141EDE-F127-467B-A3EA-4CF0C9F8513D}\A5978554C4F533832353C65647 : DhcpNameServer = 192.168.1.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
Hosts: 127.0.0.1	www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\smash\appdata\roaming\mozilla\firefox\profiles\0ixo772i.default\
FF - component: c:\users\smash\appdata\roaming\mozilla\firefox\profiles\0ixo772i.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll
FF - component: c:\users\smash\appdata\roaming\mozilla\firefox\profiles\0ixo772i.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\winnt_x86-msvc\components\WeaveCrypto.dll
FF - component: c:\users\smash\appdata\roaming\mozilla\firefox\profiles\0ixo772i.default\extensions\[email protected]\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - component: c:\users\smash\appdata\roaming\mozilla\firefox\profiles\0ixo772i.default\extensions\[email protected]\platform\winnt\components\nsTwitterFoxSign.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1970.7372\npCIDetect14.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\users\smash\appdata\roaming\mozilla\plugins\npatgpc.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-6-12 207792]
R1 ImmunetProtectDriver;ImmunetProtectDriver;c:\windows\system32\drivers\ImmunetProtect.sys [2011-7-13 41424]
R1 ImmunetSelfProtectDriver;ImmunetSelfProtectDriver;c:\windows\system32\drivers\ImmunetSelfProtect.sys [2011-7-13 31184]
R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\drivers\SABI.sys [2010-6-13 10752]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 18432]
R2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-6-12 135664]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-3-21 53248]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-3-7 135168]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-6-27 1153368]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [2010-6-13 31248]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-4-14 45736]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-6-12 135664]
R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2010-1-13 6755840]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-6-27 66080]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2010-11-8 27632]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [2010-6-13 1436560]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-9-28 315392]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 ImmunetProtect;Immunet Protect;c:\program files\immunet protect\2.0.17\agent.exe [2011-7-13 756680]
S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-6-12 359624]
S2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-6-12 1141712]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2010-10-12 13224]
S3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\drivers\MAudioFastTrackUltra.sys [2009-9-25 135816]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\sony ericsson\sony ericsson pc companion\PCCService.exe [2010-10-12 152064]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
.
=============== Created Last 30 ================
.
2011-07-13 21:11:18	388096	-c--a-r-	c:\users\smash\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-07-13 21:11:18	--------	dc----w-	c:\program files\Trend Micro
2011-07-13 20:55:44	--------	dc----w-	c:\users\smash\appdata\local\Immunet
2011-07-13 20:55:44	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55:38	31184	-c--a-w-	c:\windows\system32\drivers\ImmunetSelfProtect.sys
2011-07-13 20:55:36	41424	-c--a-w-	c:\windows\system32\drivers\ImmunetProtect.sys
2011-07-13 20:55:33	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:39:17	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-13 18:21:44	--------	dc----w-	c:\users\smash\appdata\local\Adobe
2011-07-13 18:18:22	--------	dc----w-	c:\users\smash\appdata\roaming\Malwarebytes
2011-07-13 18:18:17	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 11:07:39	2332672	----a-w-	c:\windows\system32\win32k.sys
2011-07-12 15:24:31	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-12 15:04:47	14848	-c--a-w-	c:\windows\system32\drivers\1239044146.sys
2011-06-29 13:29:07	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44:22	--------	dc----w-	c:\users\smash\appdata\roaming\NCH Software
2011-06-28 15:42:05	--------	dc----w-	c:\program files\NCH Swift Sound
2011-06-23 10:47:05	--------	dc----w-	c:\users\smash\appdata\roaming\Songbird2
2011-06-23 10:47:05	--------	dc----w-	c:\users\smash\appdata\local\Songbird2
2011-06-23 10:46:49	--------	dc----w-	c:\program files\Songbird
2011-06-23 10:00:43	--------	dc----w-	c:\users\smash\appdata\roaming\Greyfirst
2011-06-23 10:00:43	--------	dc----w-	c:\users\smash\appdata\local\Greyfirst
2011-06-22 19:44:08	2106216	-c--a-w-	c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-22 19:44:08	1998168	-c--a-w-	c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-22 19:32:48	--------	dc----w-	c:\users\smash\appdata\local\Skybound
2011-06-22 19:32:44	--------	dc----w-	c:\program files\Skybound Stylizer 5
2011-06-22 19:31:46	--------	dc----w-	c:\users\smash\appdata\roaming\KompoZer
2011-06-22 19:30:58	--------	dc----w-	c:\users\smash\appdata\roaming\Disruptive Innovations SARL
2011-06-22 19:30:58	--------	dc----w-	c:\users\smash\appdata\local\Disruptive Innovations SARL
2011-06-22 19:30:47	--------	dc----w-	c:\program files\BlueGriffon
2011-06-22 19:28:38	--------	dc----w-	c:\program files\Celtx
2011-06-22 19:23:19	--------	dc----w-	c:\users\smash\appdata\roaming\Instantbird
2011-06-22 19:23:19	--------	dc----w-	c:\users\smash\appdata\local\Instantbird
2011-06-22 19:23:01	--------	dc----w-	c:\program files\Instantbird 0.3 Beta 1
2011-06-15 12:18:19	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18:18	141104	----a-w-	c:\program files\internet explorer\sqmapi.dll
2011-06-15 12:18:17	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:09:27	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:09:25	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:09:19	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:09:19	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:09:19	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:09:18	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:09:17	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:09:17	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-06-15 12:08:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:08:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:08:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
.
==================== Find3M ====================
.
2011-07-13 13:38:01	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-09 13:16:27	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-11 10:19:10	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19:10	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49:50	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52:22	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-04-28 03:29:32	60416	-c--a-w-	c:\windows\system32\drivers\BTHUSB.SYS
2011-04-28 03:29:32	393216	-c--a-w-	c:\windows\system32\drivers\bthport.sys
2011-04-27 09:13:27	625152	-c--a-w-	c:\windows\system32\mp3tsshx.dll
2011-04-22 19:09:39	801792	----a-w-	c:\windows\system32\FntCache.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600 Disk: WDC_WD3200BEVT-35ZCT0 rev.11.01A11 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x99B98890]<< 
_asm { PUSH ECX; MOV EAX, [ESP+0x8]; PUSH EBX; PUSH EBP; PUSH ESI; PUSH EDI; CMP EAX, [0x99b9e964]; JNZ 0x22; MOV EBX, [ESP+0x1c]; CALL 0xfffffffffffffcc0; }
1 ntkrnlpa!IofCallDriver[0x82E4C428] -> \Device\Harddisk0\DR0[0x861A3030]
3 CLASSPNP[0x8B3AD59E] -> ntkrnlpa!IofCallDriver[0x82E4C428] -> [0x865E74F0]
\Driver\Disk[0x8666D930] -> IRP_MJ_CREATE -> 0x99B98890
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
user & kernel MBR OK 
.
============= FINISH: 22:19:20.99 ===============


----------



## Smasher (Jul 13, 2011)

*Bump*
*whimper*

If I had the discs I'd re-install Windows.

System Restore just hangs, no scan from any antivirus completes. And windows defender says there's a sirefef.B trojan.

Help me Obi Wan. You're my only hope.


----------



## kevinf80 (Mar 21, 2006)

Hiya Smasher,

See if you can run the following...

*Please read carefully and follow these steps.*

Download *TDSSKiller* and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on *TDSSKiller.exe* to run the application, then on *Start Scan.*










If an infected file is detected, the default action will be *Cure*, click on *Continue.*










If a suspicious file is detected, the default action will be *Skip*, click on *Continue.*










It may ask you to reboot the computer to complete the process. Click on *Reboot Now*.










If no reboot is require, click on *Report*. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "*TDSSKiller.[Version]_[Date]_[Time]_log.txt*". Please copy and paste the contents of that file here.

Kevin


----------



## Smasher (Jul 13, 2011)

About to reboot... thought I'd show what's happened so far... [attached]

And thank you for replying Kevin, I appreciate this.


----------



## Smasher (Jul 13, 2011)

After reboot, and while I was logging back on to this site, the attached message popped up from Windows Defender.

I'm still getting redirected to odd sites from search results [using Chrome].

And Windows Firewall has asked if I want to grant permissions to explorer and google updater

I have done nothing more since and am awaiting your next instructions.


----------



## kevinf80 (Mar 21, 2006)

Continue as follows please :-

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

*Link 1*
*Link 2*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

Before saving Combofix to the Desktop re-name to Gotcha.exe as below:










 Disable all security programs as they will have a negative effect on Combofix, instructions available *Here* if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)

 Instructions for running Combofix available *Here* if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read *Here* why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

I would like to see the log ftom TDSSKiller in your next reply, you will be able to locate it at the follow :-

*C:\TDSSKiller.[Version]_[Date]_[Time]_log.txt*

In your reply i`d like to see the log from Combofix and the log from TDSSKiller.....

Kevin


----------



## Smasher (Jul 13, 2011)

Again, thank you Kevin...

I ran Combofix as 'Gotcha.exe' from my desktop and it said that it was out of date so I clicked yes for it to run anyway [in 'reduced functionality mode']. Anyway, it carried on and came back with this... [TDSSKiller log to follow next]

---
ComboFix 11-07-12.04 - Smash 18/07/2011 11:55:33.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.2095 [GMT 1:00]
Running from: z:\zdesktop\Gotcha.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REDUCED FUNCTIONALITY MODE -
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\assembly\GAC_MSIL\desktop.ini
c:\windows\System3215.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-06-18 to 2011-07-18 )))))))))))))))))))))))))))))))
.
.
2011-07-18 10:57 . 2011-07-18 10:57	--------	dc----w-	c:\users\Default\AppData\Local\temp
2011-07-18 10:52 . 2011-07-18 10:53	--------	dc----w-	C:\Gotcha
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\programdata\Alwil Software
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\program files\Alwil Software
2011-07-15 13:04 . 2011-07-15 13:04	--------	dc----w-	C:\TDSSKiller_Quarantine
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\users\Smash\AppData\Local\Immunet
2011-07-13 20:55 . 2011-07-17 12:26	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:23 . 2011-06-20 07:57	7074640	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{6EF2D7B6-0F19-4C33-8EC4-FEE0B4EDD67B}\mpengine.dll
2011-07-13 18:21 . 2011-07-13 18:21	--------	dc----w-	c:\users\Smash\AppData\Local\Adobe
2011-07-13 18:18 . 2011-07-13 18:18	--------	dc----w-	c:\users\Smash\AppData\Roaming\Malwarebytes
2011-07-13 18:18 . 2011-05-29 08:11	39984	-c--a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-13 18:18 . 2011-07-17 12:25	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 18:18 . 2011-07-17 12:26	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-13 18:18 . 2011-05-29 08:11	22712	-c--a-w-	c:\windows\system32\drivers\mbam.sys
2011-07-12 15:24 . 2011-07-12 15:30	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-12 15:04 . 2011-07-12 15:04	14848	-c--a-w-	c:\windows\system32\drivers\1239044146.sys
2011-07-07 22:39 . 2011-07-07 22:39	--------	dc----w-	c:\program files\Common Files\Java
2011-06-29 13:29 . 2011-06-29 13:30	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44 . 2011-06-28 15:44	--------	dc----w-	c:\users\Smash\AppData\Roaming\NCH Software
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\programdata\NCH Swift Sound
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\program files\NCH Swift Sound
2011-06-23 10:47 . 2011-06-23 11:21	--------	dc----w-	c:\users\Smash\AppData\Local\Songbird2
2011-06-23 10:47 . 2011-06-23 10:47	--------	dc----w-	c:\users\Smash\AppData\Roaming\Songbird2
2011-06-23 10:46 . 2011-06-23 10:46	--------	dc----w-	c:\program files\Songbird
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Roaming\Greyfirst
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Local\Greyfirst
2011-06-22 19:44 . 2010-01-01 08:00	2106216	-c--a-w-	c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 19:44 . 2010-01-01 08:00	1998168	-c--a-w-	c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 19:32 . 2011-06-22 19:32	--------	dc----w-	c:\users\Smash\AppData\Local\Skybound
2011-06-22 19:32 . 2011-07-17 12:26	--------	dc----w-	c:\program files\Skybound Stylizer 5
2011-06-22 19:31 . 2011-06-22 19:31	--------	dc----w-	c:\users\Smash\AppData\Roaming\KompoZer
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Roaming\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Local\Disruptive Innovations SARL
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Roaming\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Local\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\program files\Instantbird 0.3 Beta 1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-17 12:48 . 2009-07-13 23:54	78848	----a-w-	c:\windows\system32\drivers\rasl2tp.sys
2011-07-13 13:38 . 2009-08-10 15:21	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-13 13:37 . 2011-06-15 12:09	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-07-09 13:16 . 2011-05-18 10:08	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 12:22 . 2011-06-15 12:09	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:22 . 2011-06-15 12:09	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:22 . 2011-06-15 12:09	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:21 . 2011-06-15 12:09	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:21 . 2011-06-15 12:09	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:18 . 2011-06-15 12:09	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:18 . 2011-06-15 12:18	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18 . 2011-06-15 12:18	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:18 . 2011-06-15 12:09	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:10 . 2011-06-15 12:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:10 . 2011-06-15 12:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:10 . 2011-06-15 12:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-05-11 10:19 . 2011-05-11 09:47	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19 . 2011-05-11 09:47	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49 . 2011-05-11 09:47	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52 . 2010-10-12 12:35	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-04-27 09:13 . 2011-04-27 09:13	625152	-c--a-w-	c:\windows\system32\mp3tsshx.dll
2011-04-22 19:11 . 2011-04-22 19:11	86528	----a-w-	c:\windows\system32\iesysprep.dll
2011-04-22 19:11 . 2011-04-22 19:11	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\iesetup.dll
2011-04-22 19:11 . 2011-04-22 19:11	63488	----a-w-	c:\windows\system32\tdc.ocx
2011-04-22 19:11 . 2011-04-22 19:11	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-04-22 19:11 . 2011-04-22 19:11	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-04-22 19:11 . 2011-04-22 19:11	367104	----a-w-	c:\windows\system32\html.iec
2011-04-22 19:11 . 2011-04-22 19:11	35840	----a-w-	c:\windows\system32\imgutil.dll
2011-04-22 19:11 . 2011-04-22 19:11	23552	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-22 19:11 . 2011-04-22 19:11	161792	----a-w-	c:\windows\system32\msls31.dll
2011-04-22 19:11 . 2011-04-22 19:11	152064	----a-w-	c:\windows\system32\wextract.exe
2011-04-22 19:11 . 2011-04-22 19:11	150528	----a-w-	c:\windows\system32\iexpress.exe
2011-04-22 19:11 . 2011-04-22 19:11	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2011-04-22 19:11 . 2011-04-22 19:11	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-04-22 19:11 . 2011-04-22 19:11	11776	----a-w-	c:\windows\system32\mshta.exe
2011-04-22 19:11 . 2011-04-22 19:11	1126912	----a-w-	c:\windows\system32\wininet.dll
2011-04-22 19:11 . 2011-04-22 19:11	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-04-22 19:11 . 2011-04-22 19:11	101888	----a-w-	c:\windows\system32\admparse.dll
2011-04-22 19:09 . 2011-04-22 19:09	801792	----a-w-	c:\windows\system32\FntCache.dll
2011-04-22 19:09 . 2011-04-22 19:09	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-04-22 19:09 . 2011-04-22 19:09	728448	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-04-22 19:09 . 2011-04-22 19:09	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-22 19:09 . 2011-04-22 19:09	3181568	----a-w-	c:\windows\system32\mf.dll
2011-04-22 19:09 . 2011-04-22 19:09	283648	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-04-22 19:09 . 2011-04-22 19:09	219008	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2011-04-22 19:09 . 2011-04-22 19:09	218624	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-04-22 19:09 . 2011-04-22 19:09	196608	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-04-22 19:09 . 2011-04-22 19:09	1619456	----a-w-	c:\windows\system32\WMVDECOD.DLL
2011-04-22 19:09 . 2011-04-22 19:09	161792	----a-w-	c:\windows\system32\d3d10_1.dll
2011-04-22 19:09 . 2011-04-22 19:09	1495040	----a-w-	c:\windows\system32\ExplorerFrame.dll
2011-04-22 19:09 . 2011-04-22 19:09	135168	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-04-22 19:09 . 2011-04-22 19:09	1170944	----a-w-	c:\windows\system32\d3d10warp.dll
2011-04-22 19:09 . 2011-04-22 19:09	107520	----a-w-	c:\windows\system32\cdd.dll
2011-04-22 19:09 . 2011-04-22 19:09	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-06-16 04:17 . 2011-04-05 15:56	142296	-c--a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-05-23 431616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-10 13797920]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-18 124256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-25 643592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Smash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ClipX.lnk - c:\program files\ClipX\clipx.exe [2008-7-28 199168]
Dropbox.lnk - c:\users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	-c--a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	-c--a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22	3739648	-c--a-w-	c:\users\Smash\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44	31072	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-06-12 12:14	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-03-07 135168]
R3 cpuz134;cpuz134;c:\users\Smash\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-10-12 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\DRIVERS\MAudioFastTrackUltra.sys [2009-09-25 135816]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 18432]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-03-21 53248]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2009-05-03 31248]
S3 1239044146;Virtual Bus for Microsoft ACPI-Compliant System; [x]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-11-08 27632]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2009-07-03 1436560]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
2011-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=AVBR
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Smash\AppData\Roaming\Mozilla\Firefox\Profiles\0ixo772i.default\
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
SafeBoot-44586881.sys
SafeBoot-91843844.sys
MSConfigStartUp-EBUNWVLUMV - c:\users\Smash\AppData\Local\Temp\Dd1.exe
MSConfigStartUp-Google Update - c:\users\Smash\AppData\Local\Google\Update\GoogleUpdate.exe
MSConfigStartUp-ntwhoc - c:\users\Smash\AppData\Roaming\winshfhca.exe
MSConfigStartUp-syncman - c:\users\smash\wuaucldt.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\1239044146]
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,5e,23,1a,f5,0c,bc,45,87,83,38,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,5e,23,1a,f5,0c,bc,45,87,83,38,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4,00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e,00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a,00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94,00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0,00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6,00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc,00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90,00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e,00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a,00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6,00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90,00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8,00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70,00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a,00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0,00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74,00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82,00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82,00,
 00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c,00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce,00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8,00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54,00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60,00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e,00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba,00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60,00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80,00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e,00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8,00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72,00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6,00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae,00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c,00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a,00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2,00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2,00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58,00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a,00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\Root\*PNPe617\0000]
@DACL=(02 0000)
"Service"="1239044146"
"ClassGUID"="{4D36E97D-E325-11CE-BFC1-08002BE10318}"
"Class"="System"
"DeviceDesc"="PCI bus"
"Mfg"="Technologies Inc"
"LocationInformation"="on Microsoft ACPI-Compliant System"
"ConfigFlags"=dword:00000000
"Capabilities"=dword:00000000
"ContainerID"="{00000000-0000-0000-FFFF-FFFFFFFFFFFF}"
.
Completion time: 2011-07-18 12:00:31
ComboFix-quarantined-files.txt 2011-07-18 11:00
.
Pre-Run: 6,761,422,848 bytes free
Post-Run: 6,643,740,672 bytes free
.
- - End Of File - - AC72911C79A8F7C76B5822B3840B001A
---


----------



## Smasher (Jul 13, 2011)

TDSSKiller log attached.


----------



## Smasher (Jul 13, 2011)

In addition, as I was shutting the computer down to await your next instructions I discovered the attached message box there. I've clicked OK and will now shut down.

[just in case it's important]


----------



## Smasher (Jul 13, 2011)

Again, I don't know if this helps... the machine is not shutting down. It's hanging on the spinning 'O' "Shutting Down" screen.


----------



## kevinf80 (Mar 21, 2006)

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

*Link 1*
*Link 2*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

Do not re-name it this time, leave as is.

 Disable all security programs as they will have a negative effect on Combofix, instructions available *Here* if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator) If Combofix asks to update please allow it to happen.

 Instructions for running Combofix available *Here* if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read *Here* why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Let me see the new log in next reply please, also give update on current issues.

Kevin


----------



## Smasher (Jul 13, 2011)

I got the 'ComboFix has expired' dialog box and all it said was to run in Reduced Functionality Mode <yes> or Cancel <No>

I tried to capture the dialog box for you and now the cmd box is hanging.

...OK, completely unresponsive now. Hard reboot. Try your instructions from the preceding post again.


----------



## Smasher (Jul 13, 2011)

Updating Combofix now


----------



## Smasher (Jul 13, 2011)

It looked like it had updated, but the cmd box is now hanging again.

Doing nothing.


----------



## Smasher (Jul 13, 2011)

Hard reboot.
Windows does a hard disc check [lost background image, oddly]
I try and run Combofix again
Windows Firewall asks if combofix can have access [yes]
cmd prompt says 'Connecting to ComboFix servers...'

No, it's hanging there.

Hard reboot. i'll try disabling the firewall and run again.


----------



## Smasher (Jul 13, 2011)

No. I can't get anything.

When I do a hard reboot, a black screen with the text saying that I should do a system restore.

I did a system restore back to as far as I could [obviously post infection] and after some re-running I'm making headway.

It finally ran as it was supposed to [according to the linked instructions you sent] and it said I had the Free.Access virus [the message disappeared before I could note it down properly as the machine rebooted.

It's currently 'scanning for infected files' through a cmd window and it's at "Completed_Stage_6A" - now, "Completed_Stage_7"

As soon as I find that log file I'll send it. [If it's there]

Thank you for your patience.


----------



## Smasher (Jul 13, 2011)

[Hooray! - I think]

This is what I've got out of ComboFix [managed to somehow update it and run it!]
---

ComboFix 11-07-18.01 - Smash 18/07/2011 16:19:25.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.2148 [GMT 1:00]
Running from: z:\zdesktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\c_83672.nls
c:\windows\system32\config\xadqgnnk
c:\windows\system32\drivers\1239044146.sys
.
Infected copy of c:\windows\system32\drivers\tunnel.sys was found and disinfected 
Restored copy from - The cat found it  
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_1239044146
.
.
((((((((((((((((((((((((( Files Created from 2011-06-18 to 2011-07-18 )))))))))))))))))))))))))))))))
.
.
2011-07-18 15:31 . 2011-07-18 15:40	--------	dc----w-	c:\users\Smash\AppData\Local\temp
2011-07-18 15:31 . 2011-07-18 15:31	--------	dc----w-	c:\users\Default\AppData\Local\temp
2011-07-18 15:13 . 2009-07-13 23:54	108544	-c--a-w-	c:\windows\system32\drivers\tunnel.sys
2011-07-18 10:52 . 2011-07-18 10:53	--------	dc----w-	C:\Gotcha
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\programdata\Alwil Software
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\program files\Alwil Software
2011-07-15 13:04 . 2011-07-15 13:04	--------	dc----w-	C:\TDSSKiller_Quarantine
2011-07-13 21:11 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Trend Micro
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\users\Smash\AppData\Local\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	31184	-c--a-w-	c:\windows\system32\drivers\ImmunetSelfProtect.sys
2011-07-13 20:55 . 2011-07-13 20:55	41424	-c--a-w-	c:\windows\system32\drivers\ImmunetProtect.sys
2011-07-13 20:55 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:21 . 2011-07-13 18:21	--------	dc----w-	c:\users\Smash\AppData\Local\Adobe
2011-07-13 18:18 . 2011-07-13 18:18	--------	dc----w-	c:\users\Smash\AppData\Roaming\Malwarebytes
2011-07-13 18:18 . 2011-07-17 12:25	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 18:18 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-12 15:24 . 2011-07-12 15:30	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-07 22:39 . 2011-07-07 22:39	--------	dc----w-	c:\program files\Common Files\Java
2011-06-29 13:29 . 2011-06-29 13:30	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44 . 2011-06-28 15:44	--------	dc----w-	c:\users\Smash\AppData\Roaming\NCH Software
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\programdata\NCH Swift Sound
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\program files\NCH Swift Sound
2011-06-23 10:47 . 2011-06-23 11:21	--------	dc----w-	c:\users\Smash\AppData\Local\Songbird2
2011-06-23 10:47 . 2011-06-23 10:47	--------	dc----w-	c:\users\Smash\AppData\Roaming\Songbird2
2011-06-23 10:46 . 2011-06-23 10:46	--------	dc----w-	c:\program files\Songbird
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Roaming\Greyfirst
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Local\Greyfirst
2011-06-22 19:44 . 2010-01-01 08:00	2106216	-c--a-w-	c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 19:44 . 2010-01-01 08:00	1998168	-c--a-w-	c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 19:32 . 2011-06-22 19:32	--------	dc----w-	c:\users\Smash\AppData\Local\Skybound
2011-06-22 19:32 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Skybound Stylizer 5
2011-06-22 19:31 . 2011-06-22 19:31	--------	dc----w-	c:\users\Smash\AppData\Roaming\KompoZer
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Roaming\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Local\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-07-19 00:02	--------	dc----w-	c:\program files\BlueGriffon
2011-06-22 19:28 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Celtx
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Roaming\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Local\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\program files\Instantbird 0.3 Beta 1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 13:38 . 2009-08-10 15:21	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-13 13:37 . 2011-06-15 12:09	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-07-09 13:16 . 2011-05-18 10:08	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 12:22 . 2011-06-15 12:09	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:22 . 2011-06-15 12:09	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:22 . 2011-06-15 12:09	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:21 . 2011-06-15 12:09	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:21 . 2011-06-15 12:09	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:18 . 2011-06-15 12:09	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:18 . 2011-06-15 12:18	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18 . 2011-06-15 12:18	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:18 . 2011-06-15 12:09	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:10 . 2011-06-15 12:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:10 . 2011-06-15 12:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:10 . 2011-06-15 12:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-05-11 10:19 . 2011-05-11 09:47	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19 . 2011-05-11 09:47	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49 . 2011-05-11 09:47	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52 . 2010-10-12 12:35	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-04-27 09:13 . 2011-04-27 09:13	625152	-c--a-w-	c:\windows\system32\mp3tsshx.dll
2011-04-22 19:11 . 2011-04-22 19:11	86528	----a-w-	c:\windows\system32\iesysprep.dll
2011-04-22 19:11 . 2011-04-22 19:11	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\iesetup.dll
2011-04-22 19:11 . 2011-04-22 19:11	63488	----a-w-	c:\windows\system32\tdc.ocx
2011-04-22 19:11 . 2011-04-22 19:11	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-04-22 19:11 . 2011-04-22 19:11	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-04-22 19:11 . 2011-04-22 19:11	367104	----a-w-	c:\windows\system32\html.iec
2011-04-22 19:11 . 2011-04-22 19:11	35840	----a-w-	c:\windows\system32\imgutil.dll
2011-04-22 19:11 . 2011-04-22 19:11	23552	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-22 19:11 . 2011-04-22 19:11	161792	----a-w-	c:\windows\system32\msls31.dll
2011-04-22 19:11 . 2011-04-22 19:11	152064	----a-w-	c:\windows\system32\wextract.exe
2011-04-22 19:11 . 2011-04-22 19:11	150528	----a-w-	c:\windows\system32\iexpress.exe
2011-04-22 19:11 . 2011-04-22 19:11	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2011-04-22 19:11 . 2011-04-22 19:11	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-04-22 19:11 . 2011-04-22 19:11	11776	----a-w-	c:\windows\system32\mshta.exe
2011-04-22 19:11 . 2011-04-22 19:11	1126912	----a-w-	c:\windows\system32\wininet.dll
2011-04-22 19:11 . 2011-04-22 19:11	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-04-22 19:11 . 2011-04-22 19:11	101888	----a-w-	c:\windows\system32\admparse.dll
2011-04-22 19:09 . 2011-04-22 19:09	801792	----a-w-	c:\windows\system32\FntCache.dll
2011-04-22 19:09 . 2011-04-22 19:09	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-04-22 19:09 . 2011-04-22 19:09	728448	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-04-22 19:09 . 2011-04-22 19:09	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-22 19:09 . 2011-04-22 19:09	3181568	----a-w-	c:\windows\system32\mf.dll
2011-04-22 19:09 . 2011-04-22 19:09	283648	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-04-22 19:09 . 2011-04-22 19:09	219008	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2011-04-22 19:09 . 2011-04-22 19:09	218624	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-04-22 19:09 . 2011-04-22 19:09	196608	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-04-22 19:09 . 2011-04-22 19:09	1619456	----a-w-	c:\windows\system32\WMVDECOD.DLL
2011-04-22 19:09 . 2011-04-22 19:09	161792	----a-w-	c:\windows\system32\d3d10_1.dll
2011-04-22 19:09 . 2011-04-22 19:09	1495040	----a-w-	c:\windows\system32\ExplorerFrame.dll
2011-04-22 19:09 . 2011-04-22 19:09	135168	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-04-22 19:09 . 2011-04-22 19:09	1170944	----a-w-	c:\windows\system32\d3d10warp.dll
2011-04-22 19:09 . 2011-04-22 19:09	107520	----a-w-	c:\windows\system32\cdd.dll
2011-04-22 19:09 . 2011-04-22 19:09	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-06-16 04:17 . 2011-04-05 15:56	142296	-c--a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-05-23 431616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-10 13797920]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-18 124256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-25 643592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Immunet Protect"="c:\program files\Immunet Protect\2.0.17\iptray.exe" [2011-07-13 2615624]
.
c:\users\Smash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ClipX.lnk - c:\program files\ClipX\clipx.exe [2008-7-28 199168]
Dropbox.lnk - c:\users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	-c--a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	-c--a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EBUNWVLUMV]
c:\users\Smash\AppData\Local\Temp\Dd1.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\users\Smash\AppData\Local\Google\Update\GoogleUpdate.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22	3739648	-c--a-w-	c:\users\Smash\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44	31072	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntwhoc]
c:\users\Smash\AppData\Roaming\winshfhca.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-06-12 12:14	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
c:\users\smash\wuaucldt.exe [BU]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R2 ImmunetProtect;Immunet Protect;c:\program files\Immunet Protect\2.0.17\agent.exe [2011-07-13 756680]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-10-30 359624]
R3 cpuz134;cpuz134;c:\users\Smash\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-10-12 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\DRIVERS\MAudioFastTrackUltra.sys [2009-09-25 135816]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-09 207792]
S1 ImmunetProtectDriver;ImmunetProtectDriver;c:\windows\system32\DRIVERS\ImmunetProtect.sys [2011-07-13 41424]
S1 ImmunetSelfProtectDriver;ImmunetSelfProtectDriver;c:\windows\system32\DRIVERS\ImmunetSelfProtect.sys [2011-07-13 31184]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 18432]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-03-21 53248]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-03-07 135168]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2009-05-03 31248]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-11-08 27632]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2009-07-03 1436560]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
2011-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=AVBR
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Smash\AppData\Roaming\Mozilla\Firefox\Profiles\0ixo772i.default\
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,5e,23,1a,f5,0c,bc,45,87,83,38,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,5e,23,1a,f5,0c,bc,45,87,83,38,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4,00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e,00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a,00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94,00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0,00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6,00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc,00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90,00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e,00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a,00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6,00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90,00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8,00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70,00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a,00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0,00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74,00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82,00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82,00,
00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c,00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce,00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8,00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54,00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60,00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e,00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba,00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60,00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80,00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e,00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8,00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72,00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6,00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae,00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c,00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a,00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2,00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2,00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58,00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a,00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(2124)
c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\crypserv.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\Samsung\Samsung Update Plus\SUPBackground.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\NCH Swift Sound\Switch\Switch.exe
.
**************************************************************************
.
Completion time: 2011-07-18 16:47:23 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-18 15:47
.
Pre-Run: 5,728,104,448 bytes free
Post-Run: 5,338,181,632 bytes free
.
- - End Of File - - B516E67613B565773483EDB525674886

---
Thank you for your patience, Kevin


----------



## kevinf80 (Mar 21, 2006)

OK, continue as follows please :-

*Step 1*

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the Codebox below into it:


```
KillAll::

RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01 ,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,5e,23,1a,f5,0c,bc,45,87,83,38, \
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01 ,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,5e,23,1a,f5,0c,bc,45,87,83,38, \
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

RegNull::
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d, \.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c, 00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8, 00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c, 00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4, 00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e, 00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72, 00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a, 00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66, 00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79, \
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0, 00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e, 00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64, 00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96, 00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94, 00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78, 00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0, 00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74, 00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6, 00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0, 00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98, 00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c, 00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc, 00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a, 00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90, 00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e, 00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94, 00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e, 00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68, 00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c, 00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a, 00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6, 00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64, 00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c, 00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88, 00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90, 00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74, 00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8, 00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45, \
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70, 00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a, 00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70, 00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74, 00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84, 00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92, 00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8, 00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a, 00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a, 00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66, 00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0, 00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c, 00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000oftware\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c, 00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c, 00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66, 00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74, 00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45, \
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82, 00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e, 00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68, 00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82, 00,
00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac, 00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76, 00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a, 00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c, 00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68, 00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac, 00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e, 00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e, 00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58, 00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce, 00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70, 00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a, 00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8, 00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54, 00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8, 00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60, 00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e, 00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4, 00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98, 00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94, 00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78, 00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e, 00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba, 00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60, 00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64, 00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80, 00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88, 00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96, 00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88, 00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70, 00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e, 00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a, 00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e, 00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8, 00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72, 00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a, 00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64, 00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72, 00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6, 00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86, 00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74, 00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74, 00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66, 00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74, 00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae, 00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80, 00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c, 00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88, 00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a, 00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2, 00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4, 00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84, 00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac, 00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a, 00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8, 00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2, 00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa, 00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58, 00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86, 00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a, 00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92, 00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86, 00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42, \
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94, 00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f, \
```
Save this as *CFScript.txt*, and as Type: *All Files* *(*.*)* in the same location as ComboFix.exe



















Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt* which I will require in your next reply.

*Step 2*

*Run ESET Online Scan*

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
*ESET OnlineScan*
Click the







button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on







to download the ESET Smart Installer. *Save* it to your desktop.
Double click on the







icon on your desktop.

Check








Click the







button.
Accept any security warnings from your browser.
Check








*Leave the tick out of remove found threats*
Push the *Start* button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push








Push







, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the







button.
Push








You can refer to *this animation* by *neomage* if needed.
Frequently asked questions available *Here* *Please read them before running the scan.*

Also be aware this scan can take between one and several hours to complete depending on the size of your system.

ESET log can be found here *"C:\Program Files\ESET\EsetOnlineScanner\log.txt".*

*Step 3*

Download Security Check by screen317 from *HERE* or *HERE*.
Save it to your Desktop.
Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

What i`d like in your reply :-


 Log from Combofix
 Log from ESET
 Log from Security Checks
 Update on issues/concerns

Kevin


----------



## Smasher (Jul 13, 2011)

Step 1 - I dragged the file onto the ConboFix.exe icon and ComboFix asked if I wanted to update it again... I said yes....


----------



## Smasher (Jul 13, 2011)

Dialogue box pops up... "You are infected with Rootkit.ZeroAccess! It has inserted itself into the tcp/ip stack. This is a particularly difficult infection.... etc" I click OK.

So the same, so far as yesterday. I hope that by me 'updating' ComboFix before it ran didn't nullify the CFScript.txt action.


----------



## Smasher (Jul 13, 2011)

---
ComboFix 11-07-19.02 - Smash 19/07/2011 15:57:33.2.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.2122 [GMT 1:00]
Running from: z:\zdesktop\ComboFix.exe
Command switches used :: z:\zdesktop\CFScript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB17354$
c:\windows\$NtUninstallKB17354$\2103755089\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB17354$\2103755089\click.tlb
c:\windows\$NtUninstallKB17354$\2103755089\L\xadqgnnk
c:\windows\$NtUninstallKB17354$\2103755089\loader.tlb
c:\windows\$NtUninstallKB17354$\2103755089\U\@00000001
c:\windows\$NtUninstallKB17354$\2103755089\U\@000000c0
c:\windows\$NtUninstallKB17354$\2103755089\U\@000000cb
c:\windows\$NtUninstallKB17354$\2103755089\U\@000000cf
c:\windows\$NtUninstallKB17354$\2103755089\U\@80000000
c:\windows\$NtUninstallKB17354$\2103755089\U\@800000c0
c:\windows\$NtUninstallKB17354$\2103755089\U\@800000cb
c:\windows\$NtUninstallKB17354$\2103755089\U\@800000cf
c:\windows\$NtUninstallKB17354$\3361573198
.
.
((((((((((((((((((((((((( Files Created from 2011-06-19 to 2011-07-19 )))))))))))))))))))))))))))))))
.
.
2011-07-19 15:08 . 2011-07-19 15:17	--------	dc----w-	c:\users\Smash\AppData\Local\temp
2011-07-19 15:08 . 2011-07-19 15:08	--------	dc----w-	c:\users\Default\AppData\Local\temp
2011-07-18 15:13 . 2009-07-13 23:54	108544	-c--a-w-	c:\windows\system32\drivers\tunnel.sys
2011-07-18 10:52 . 2011-07-18 10:53	--------	dc----w-	C:\Gotcha
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\programdata\Alwil Software
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\program files\Alwil Software
2011-07-15 13:04 . 2011-07-15 13:04	--------	dc----w-	C:\TDSSKiller_Quarantine
2011-07-13 21:11 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Trend Micro
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\users\Smash\AppData\Local\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	31184	-c--a-w-	c:\windows\system32\drivers\ImmunetSelfProtect.sys
2011-07-13 20:55 . 2011-07-13 20:55	41424	-c--a-w-	c:\windows\system32\drivers\ImmunetProtect.sys
2011-07-13 20:55 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:21 . 2011-07-13 18:21	--------	dc----w-	c:\users\Smash\AppData\Local\Adobe
2011-07-13 18:18 . 2011-07-13 18:18	--------	dc----w-	c:\users\Smash\AppData\Roaming\Malwarebytes
2011-07-13 18:18 . 2011-07-17 12:25	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 18:18 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-12 15:24 . 2011-07-12 15:30	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-07 22:39 . 2011-07-07 22:39	--------	dc----w-	c:\program files\Common Files\Java
2011-06-29 13:29 . 2011-06-29 13:30	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44 . 2011-06-28 15:44	--------	dc----w-	c:\users\Smash\AppData\Roaming\NCH Software
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\programdata\NCH Swift Sound
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\program files\NCH Swift Sound
2011-06-23 10:47 . 2011-06-23 11:21	--------	dc----w-	c:\users\Smash\AppData\Local\Songbird2
2011-06-23 10:47 . 2011-06-23 10:47	--------	dc----w-	c:\users\Smash\AppData\Roaming\Songbird2
2011-06-23 10:46 . 2011-06-23 10:46	--------	dc----w-	c:\program files\Songbird
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Roaming\Greyfirst
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Local\Greyfirst
2011-06-22 19:44 . 2010-01-01 08:00	2106216	-c--a-w-	c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 19:44 . 2010-01-01 08:00	1998168	-c--a-w-	c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 19:32 . 2011-06-22 19:32	--------	dc----w-	c:\users\Smash\AppData\Local\Skybound
2011-06-22 19:32 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Skybound Stylizer 5
2011-06-22 19:31 . 2011-06-22 19:31	--------	dc----w-	c:\users\Smash\AppData\Roaming\KompoZer
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Roaming\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Local\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-07-19 00:02	--------	dc----w-	c:\program files\BlueGriffon
2011-06-22 19:28 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Celtx
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Roaming\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Local\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\program files\Instantbird 0.3 Beta 1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 13:38 . 2009-08-10 15:21	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-13 13:37 . 2011-06-15 12:09	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-07-09 13:16 . 2011-05-18 10:08	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 12:22 . 2011-06-15 12:09	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:22 . 2011-06-15 12:09	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:22 . 2011-06-15 12:09	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:21 . 2011-06-15 12:09	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:21 . 2011-06-15 12:09	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:18 . 2011-06-15 12:09	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:18 . 2011-06-15 12:18	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18 . 2011-06-15 12:18	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:18 . 2011-06-15 12:09	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:10 . 2011-06-15 12:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:10 . 2011-06-15 12:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:10 . 2011-06-15 12:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-05-11 10:19 . 2011-05-11 09:47	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19 . 2011-05-11 09:47	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49 . 2011-05-11 09:47	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52 . 2010-10-12 12:35	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-04-27 09:13 . 2011-04-27 09:13	625152	-c--a-w-	c:\windows\system32\mp3tsshx.dll
2011-04-22 19:11 . 2011-04-22 19:11	86528	----a-w-	c:\windows\system32\iesysprep.dll
2011-04-22 19:11 . 2011-04-22 19:11	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\iesetup.dll
2011-04-22 19:11 . 2011-04-22 19:11	63488	----a-w-	c:\windows\system32\tdc.ocx
2011-04-22 19:11 . 2011-04-22 19:11	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-04-22 19:11 . 2011-04-22 19:11	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-04-22 19:11 . 2011-04-22 19:11	367104	----a-w-	c:\windows\system32\html.iec
2011-04-22 19:11 . 2011-04-22 19:11	35840	----a-w-	c:\windows\system32\imgutil.dll
2011-04-22 19:11 . 2011-04-22 19:11	23552	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-22 19:11 . 2011-04-22 19:11	161792	----a-w-	c:\windows\system32\msls31.dll
2011-04-22 19:11 . 2011-04-22 19:11	152064	----a-w-	c:\windows\system32\wextract.exe
2011-04-22 19:11 . 2011-04-22 19:11	150528	----a-w-	c:\windows\system32\iexpress.exe
2011-04-22 19:11 . 2011-04-22 19:11	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2011-04-22 19:11 . 2011-04-22 19:11	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-04-22 19:11 . 2011-04-22 19:11	11776	----a-w-	c:\windows\system32\mshta.exe
2011-04-22 19:11 . 2011-04-22 19:11	1126912	----a-w-	c:\windows\system32\wininet.dll
2011-04-22 19:11 . 2011-04-22 19:11	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-04-22 19:11 . 2011-04-22 19:11	101888	----a-w-	c:\windows\system32\admparse.dll
2011-04-22 19:09 . 2011-04-22 19:09	801792	----a-w-	c:\windows\system32\FntCache.dll
2011-04-22 19:09 . 2011-04-22 19:09	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-04-22 19:09 . 2011-04-22 19:09	728448	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-04-22 19:09 . 2011-04-22 19:09	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-22 19:09 . 2011-04-22 19:09	3181568	----a-w-	c:\windows\system32\mf.dll
2011-04-22 19:09 . 2011-04-22 19:09	283648	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-04-22 19:09 . 2011-04-22 19:09	219008	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2011-04-22 19:09 . 2011-04-22 19:09	218624	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-04-22 19:09 . 2011-04-22 19:09	196608	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-04-22 19:09 . 2011-04-22 19:09	1619456	----a-w-	c:\windows\system32\WMVDECOD.DLL
2011-04-22 19:09 . 2011-04-22 19:09	161792	----a-w-	c:\windows\system32\d3d10_1.dll
2011-04-22 19:09 . 2011-04-22 19:09	1495040	----a-w-	c:\windows\system32\ExplorerFrame.dll
2011-04-22 19:09 . 2011-04-22 19:09	135168	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-04-22 19:09 . 2011-04-22 19:09	1170944	----a-w-	c:\windows\system32\d3d10warp.dll
2011-04-22 19:09 . 2011-04-22 19:09	107520	----a-w-	c:\windows\system32\cdd.dll
2011-04-22 19:09 . 2011-04-22 19:09	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-06-16 04:17 . 2011-04-05 15:56	142296	-c--a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-05-23 431616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-10 13797920]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-18 124256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-25 643592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Immunet Protect"="c:\program files\Immunet Protect\2.0.17\iptray.exe" [2011-07-13 2615624]
.
c:\users\Smash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ClipX.lnk - c:\program files\ClipX\clipx.exe [2008-7-28 199168]
Dropbox.lnk - c:\users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	-c--a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	-c--a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EBUNWVLUMV]
c:\users\Smash\AppData\Local\Temp\Dd1.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\users\Smash\AppData\Local\Google\Update\GoogleUpdate.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22	3739648	-c--a-w-	c:\users\Smash\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44	31072	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntwhoc]
c:\users\Smash\AppData\Roaming\winshfhca.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-06-12 12:14	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
c:\users\smash\wuaucldt.exe [BU]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R2 ImmunetProtect;Immunet Protect;c:\program files\Immunet Protect\2.0.17\agent.exe [2011-07-13 756680]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-10-30 359624]
R3 cpuz134;cpuz134;c:\users\Smash\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-10-12 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\DRIVERS\MAudioFastTrackUltra.sys [2009-09-25 135816]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-09 207792]
S1 ImmunetProtectDriver;ImmunetProtectDriver;c:\windows\system32\DRIVERS\ImmunetProtect.sys [2011-07-13 41424]
S1 ImmunetSelfProtectDriver;ImmunetSelfProtectDriver;c:\windows\system32\DRIVERS\ImmunetSelfProtect.sys [2011-07-13 31184]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 18432]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-03-21 53248]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-03-07 135168]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2009-05-03 31248]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-11-08 27632]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2009-07-03 1436560]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
2011-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=AVBR
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Smash\AppData\Roaming\Mozilla\Firefox\Profiles\0ixo772i.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4,00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e,00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a,00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94,00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0,00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6,00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc,00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90,00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e,00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a,00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6,00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90,00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8,00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70,00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a,00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0,00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74,00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82,00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82,00,
00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c,00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce,00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8,00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54,00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60,00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e,00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba,00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60,00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80,00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e,00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8,00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72,00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6,00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae,00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c,00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a,00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2,00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2,00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58,00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a,00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(2800)
c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\crypserv.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\Samsung\Samsung Update Plus\SUPBackground.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2011-07-19 16:23:35 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-19 15:23
ComboFix2.txt 2011-07-18 15:47
.
Pre-Run: 3,851,460,608 bytes free
Post-Run: 3,615,514,624 bytes free
.
- - End Of File - - FDA5104BBFA8ABB4375A25E88FDEB2E7

---

[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=8db96729a27fe94ab5b3168dbdfe7466
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-19 06:08:47
# local_time=2011-07-19 07:08:47 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=770 16774142 0 2 184243 184243 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 82 0 63556433 0 0
# compatibility_mode=8192 67108863 100 0 186 186 0 0
# scanned=281680
# found=31
# cleaned=24
# scan_time=8885
C:\Program Files\Bonjour\mDNSResponder.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\iPod\bin\iPodService.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\NCH Swift Sound\Switch\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir	a variant of Win32/Sirefef.CH trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\1239044146.sys.vir	Win32/Rootkit.Agent.NUX trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\tunnel.sys.vir	a variant of Win32/Rootkit.Agent.NUT trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Users\Smash\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Smash\MailBrowser Attachments\[email protected]\sent\attachments\infectedWithMalware.txt	JS/TrojanDownloader.HackLoad.AG trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\winsxs\x86_microsoft-windows-tunnel_31bf3856ad364e35_6.1.7600.16385_none_a3405f31e607efeb\tunnel.sys	a variant of Win32/Rootkit.Agent.NUT trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\SUPERsetup April 23.exe	Win32/OpenCandy application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\SUPERsetup.exe	Win32/OpenCandy application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\WyzoSetup-3.6.4.exe	Win32/Toolbar.Zugo application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Downloads\Adobe Audition 3.0.rar	a variant of Win32/Keygen.AF application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\Sony Vegas Pro 9 + Crack and KeyGen.rar	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\Express Burn Plus\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\Switch Sound File Converter\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\WavePad Sound Editor\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\ag-3427a.zip	a variant of Win32/Keygen.AF application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\Keygen.exe	a variant of Win32/Keygen.AF application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\Sony Vegas Movie Studio HD Platinum 10.0.179 + Keygen [RH]\SV.MST.HD.PE.10.0.179_[RH].rar	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\zDesktop\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

---

Results of screen317's Security Check version 0.99.17 
Windows 7 (UAC is enabled) 
Internet Explorer 8 
*`````````````````````````````` 
Antivirus/Firewall Check:* 
Windows Firewall Enabled! 
ESET Online Scanner v3 
WMI entry may not exist for antivirus; attempting automatic update. 
*``````````````````````````````` 
Anti-malware/Other Utilities Check:* 
Spyware Doctor 7.0 
SpywareBlaster 4.4 
Spybot - Search & Destroy 
CCleaner 
Java(TM) 6 Update 26 
*Out of date Java installed!* 
Adobe Flash Player 10.3.181.26 
Mozilla Firefox (x86 en-US..) 
*```````````````````````````````` 
Process Check: 
objlist.exe by Laurent* 
system32 OnlineScannerApp.exe -?- 
*``````````End of Log````````````*


----------



## Smasher (Jul 13, 2011)

I'm assuming you also want the text that was saved as ESETScan.txt...

---
C:\Program Files\Bonjour\mDNSResponder.exe	Win32/Patched.HN trojan	cleaned - quarantined
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe	Win32/Patched.HN trojan	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE	Win32/Patched.HN trojan	cleaned - quarantined
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE	Win32/Patched.HN trojan	cleaned - quarantined
C:\Program Files\iPod\bin\iPodService.exe	Win32/Patched.HN trojan	cleaned - quarantined
C:\Program Files\NCH Swift Sound\Switch\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan	cleaned by deleting - quarantined
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe	Win32/Patched.HN trojan	error while cleaning
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe	Win32/Patched.HN trojan	error while cleaning
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe	Win32/Patched.HN trojan	error while cleaning
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe	Win32/Patched.HN trojan	error while cleaning
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir	a variant of Win32/Sirefef.CH trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\1239044146.sys.vir	Win32/Rootkit.Agent.NUX trojan	cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\tunnel.sys.vir	a variant of Win32/Rootkit.Agent.NUT trojan	cleaned by deleting - quarantined
C:\Users\Smash\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019	multiple threats	deleted - quarantined
C:\Users\Smash\MailBrowser Attachments\[email protected]\sent\attachments\infectedWithMalware.txt	JS/TrojanDownloader.HackLoad.AG trojan	cleaned by deleting - quarantined
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan	error while cleaning
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan	error while cleaning
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan	error while cleaning
C:\Windows\winsxs\x86_microsoft-windows-tunnel_31bf3856ad364e35_6.1.7600.16385_none_a3405f31e607efeb\tunnel.sys	a variant of Win32/Rootkit.Agent.NUT trojan	cleaned by deleting - quarantined
Z:\Downloads\SUPERsetup April 23.exe	Win32/OpenCandy application	deleted - quarantined
Z:\Downloads\SUPERsetup.exe	Win32/OpenCandy application	deleted - quarantined
Z:\Downloads\WyzoSetup-3.6.4.exe	Win32/Toolbar.Zugo application	deleted - quarantined
Z:\My Downloads\Adobe Audition 3.0.rar	a variant of Win32/Keygen.AF application	deleted - quarantined
Z:\My Music\0NewDownloads\Sony Vegas Pro 9 + Crack and KeyGen.rar	multiple threats	deleted - quarantined
Z:\My Music\0NewDownloads\NCH Software\Express Burn Plus\Keygen.exe	a variant of Win32/Keygen.AT application	cleaned by deleting - quarantined
Z:\My Music\0NewDownloads\NCH Software\Switch Sound File Converter\Keygen.exe	a variant of Win32/Keygen.AT application	cleaned by deleting - quarantined
Z:\My Music\0NewDownloads\NCH Software\WavePad Sound Editor\Keygen.exe	a variant of Win32/Keygen.AT application	cleaned by deleting - quarantined
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\ag-3427a.zip	a variant of Win32/Keygen.AF application	deleted - quarantined
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\Keygen.exe	a variant of Win32/Keygen.AF application	cleaned by deleting - quarantined
Z:\My Music\0NewDownloads\Sony Vegas Movie Studio HD Platinum 10.0.179 + Keygen [RH]\SV.MST.HD.PE.10.0.179_[RH].rar	multiple threats	deleted - quarantined
Z:\zDesktop\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan	cleaned by deleting - quarantined


----------



## Smasher (Jul 13, 2011)

Thank you for your patience once more, Kevin.

There are no other issues - apart from the ones I talked you through. I've not been using the infected machine till I need to carry out your instructions. Hope that helps.


----------



## kevinf80 (Mar 21, 2006)

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

*Link 1*
*Link 2*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

Run Combofix as previously instructed, let me see the log on completion. Also tell me if any alerts happen....

Kevin.


----------



## Smasher (Jul 13, 2011)

I drag the CFScript.txt file on the newly downloaded ComboFix.exe and it unpacks and then the cmd box comes up and then a dialogue box saying 'There's a newer version of ComboFix available, Would you like to update ComboFix?'

I click yes.

The hash symbol 'progress bar' completes

Then the ComboFix Disclaimer comes up again.

I press 'I agree'

It unpacks

cmd window opens and it begins it's run...


----------



## Smasher (Jul 13, 2011)

I drag the CFScript.txt file on the newly downloaded ComboFix.exe and it unpacks and then the cmd box comes up and then a dialogue box saying 'There's a newer version of ComboFix available, Would you like to update ComboFix?'

I click yes.

The hash symbol 'progress bar' completes

Then the ComboFix Disclaimer comes up again.

I press 'I agree'

It unpacks

cmd window opens and it begins it's run...

...it completes and reboots


----------



## Smasher (Jul 13, 2011)

And here's the log

---

ComboFix 11-07-20.02 - Smash 20/07/2011 11:11:35.3.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.2186 [GMT 1:00]
Running from: z:\zdesktop\ComboFix.exe
Command switches used :: z:\zdesktop\CFScript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-06-20 to 2011-07-20 )))))))))))))))))))))))))))))))
.
.
2011-07-20 10:22 . 2011-07-20 10:22	--------	dc----w-	c:\users\Default\AppData\Local\temp
2011-07-19 15:37 . 2011-07-19 15:37	--------	dc----w-	c:\program files\ESET
2011-07-19 15:08 . 2011-07-20 10:35	--------	dc----w-	c:\users\Smash\AppData\Local\temp
2011-07-18 15:13 . 2009-07-13 23:54	108544	-c--a-w-	c:\windows\system32\drivers\tunnel.sys
2011-07-18 10:52 . 2011-07-18 10:53	--------	dc----w-	C:\Gotcha
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\programdata\Alwil Software
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\program files\Alwil Software
2011-07-15 13:04 . 2011-07-15 13:04	--------	dc----w-	C:\TDSSKiller_Quarantine
2011-07-13 21:11 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Trend Micro
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\users\Smash\AppData\Local\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	31184	-c--a-w-	c:\windows\system32\drivers\ImmunetSelfProtect.sys
2011-07-13 20:55 . 2011-07-13 20:55	41424	-c--a-w-	c:\windows\system32\drivers\ImmunetProtect.sys
2011-07-13 20:55 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:21 . 2011-07-13 18:21	--------	dc----w-	c:\users\Smash\AppData\Local\Adobe
2011-07-13 18:18 . 2011-07-13 18:18	--------	dc----w-	c:\users\Smash\AppData\Roaming\Malwarebytes
2011-07-13 18:18 . 2011-07-17 12:25	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 18:18 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-12 15:24 . 2011-07-12 15:30	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-07 22:39 . 2011-07-07 22:39	--------	dc----w-	c:\program files\Common Files\Java
2011-06-29 13:29 . 2011-06-29 13:30	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44 . 2011-06-28 15:44	--------	dc----w-	c:\users\Smash\AppData\Roaming\NCH Software
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\programdata\NCH Swift Sound
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\program files\NCH Swift Sound
2011-06-23 10:47 . 2011-06-23 11:21	--------	dc----w-	c:\users\Smash\AppData\Local\Songbird2
2011-06-23 10:47 . 2011-06-23 10:47	--------	dc----w-	c:\users\Smash\AppData\Roaming\Songbird2
2011-06-23 10:46 . 2011-06-23 10:46	--------	dc----w-	c:\program files\Songbird
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Roaming\Greyfirst
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Local\Greyfirst
2011-06-22 19:44 . 2010-01-01 08:00	2106216	-c--a-w-	c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 19:44 . 2010-01-01 08:00	1998168	-c--a-w-	c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 19:32 . 2011-06-22 19:32	--------	dc----w-	c:\users\Smash\AppData\Local\Skybound
2011-06-22 19:32 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Skybound Stylizer 5
2011-06-22 19:31 . 2011-06-22 19:31	--------	dc----w-	c:\users\Smash\AppData\Roaming\KompoZer
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Roaming\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Local\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-07-19 00:02	--------	dc----w-	c:\program files\BlueGriffon
2011-06-22 19:28 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Celtx
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Roaming\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Local\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\program files\Instantbird 0.3 Beta 1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 13:38 . 2009-08-10 15:21	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-13 13:37 . 2011-06-15 12:09	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-07-09 13:16 . 2011-05-18 10:08	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 12:22 . 2011-06-15 12:09	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:22 . 2011-06-15 12:09	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:22 . 2011-06-15 12:09	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:21 . 2011-06-15 12:09	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:21 . 2011-06-15 12:09	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:18 . 2011-06-15 12:09	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:18 . 2011-06-15 12:18	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18 . 2011-06-15 12:18	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:18 . 2011-06-15 12:09	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:10 . 2011-06-15 12:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:10 . 2011-06-15 12:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:10 . 2011-06-15 12:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-05-11 10:19 . 2011-05-11 09:47	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19 . 2011-05-11 09:47	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49 . 2011-05-11 09:47	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52 . 2010-10-12 12:35	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-04-27 09:13 . 2011-04-27 09:13	625152	-c--a-w-	c:\windows\system32\mp3tsshx.dll
2011-04-22 19:11 . 2011-04-22 19:11	86528	----a-w-	c:\windows\system32\iesysprep.dll
2011-04-22 19:11 . 2011-04-22 19:11	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\iesetup.dll
2011-04-22 19:11 . 2011-04-22 19:11	63488	----a-w-	c:\windows\system32\tdc.ocx
2011-04-22 19:11 . 2011-04-22 19:11	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-04-22 19:11 . 2011-04-22 19:11	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-04-22 19:11 . 2011-04-22 19:11	367104	----a-w-	c:\windows\system32\html.iec
2011-04-22 19:11 . 2011-04-22 19:11	35840	----a-w-	c:\windows\system32\imgutil.dll
2011-04-22 19:11 . 2011-04-22 19:11	23552	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-22 19:11 . 2011-04-22 19:11	161792	----a-w-	c:\windows\system32\msls31.dll
2011-04-22 19:11 . 2011-04-22 19:11	152064	----a-w-	c:\windows\system32\wextract.exe
2011-04-22 19:11 . 2011-04-22 19:11	150528	----a-w-	c:\windows\system32\iexpress.exe
2011-04-22 19:11 . 2011-04-22 19:11	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2011-04-22 19:11 . 2011-04-22 19:11	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-04-22 19:11 . 2011-04-22 19:11	11776	----a-w-	c:\windows\system32\mshta.exe
2011-04-22 19:11 . 2011-04-22 19:11	1126912	----a-w-	c:\windows\system32\wininet.dll
2011-04-22 19:11 . 2011-04-22 19:11	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-04-22 19:11 . 2011-04-22 19:11	101888	----a-w-	c:\windows\system32\admparse.dll
2011-04-22 19:09 . 2011-04-22 19:09	801792	----a-w-	c:\windows\system32\FntCache.dll
2011-04-22 19:09 . 2011-04-22 19:09	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-04-22 19:09 . 2011-04-22 19:09	728448	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-04-22 19:09 . 2011-04-22 19:09	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-22 19:09 . 2011-04-22 19:09	3181568	----a-w-	c:\windows\system32\mf.dll
2011-04-22 19:09 . 2011-04-22 19:09	283648	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-04-22 19:09 . 2011-04-22 19:09	219008	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2011-04-22 19:09 . 2011-04-22 19:09	218624	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-04-22 19:09 . 2011-04-22 19:09	196608	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-04-22 19:09 . 2011-04-22 19:09	1619456	----a-w-	c:\windows\system32\WMVDECOD.DLL
2011-04-22 19:09 . 2011-04-22 19:09	161792	----a-w-	c:\windows\system32\d3d10_1.dll
2011-04-22 19:09 . 2011-04-22 19:09	1495040	----a-w-	c:\windows\system32\ExplorerFrame.dll
2011-04-22 19:09 . 2011-04-22 19:09	135168	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-04-22 19:09 . 2011-04-22 19:09	1170944	----a-w-	c:\windows\system32\d3d10warp.dll
2011-04-22 19:09 . 2011-04-22 19:09	107520	----a-w-	c:\windows\system32\cdd.dll
2011-04-22 19:09 . 2011-04-22 19:09	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-06-16 04:17 . 2011-04-05 15:56	142296	-c--a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-05-23 431616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-10 13797920]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-18 124256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-25 643592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Immunet Protect"="c:\program files\Immunet Protect\2.0.17\iptray.exe" [2011-07-13 2615624]
.
c:\users\Smash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ClipX.lnk - c:\program files\ClipX\clipx.exe [2008-7-28 199168]
Dropbox.lnk - c:\users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	-c--a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	-c--a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EBUNWVLUMV]
c:\users\Smash\AppData\Local\Temp\Dd1.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\users\Smash\AppData\Local\Google\Update\GoogleUpdate.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22	3739648	-c--a-w-	c:\users\Smash\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44	31072	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntwhoc]
c:\users\Smash\AppData\Roaming\winshfhca.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-06-12 12:14	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
c:\users\smash\wuaucldt.exe [BU]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R2 ImmunetProtect;Immunet Protect;c:\program files\Immunet Protect\2.0.17\agent.exe [2011-07-13 756680]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-10-30 359624]
R3 cpuz134;cpuz134;c:\users\Smash\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-10-12 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\DRIVERS\MAudioFastTrackUltra.sys [2009-09-25 135816]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-09 207792]
S1 ImmunetProtectDriver;ImmunetProtectDriver;c:\windows\system32\DRIVERS\ImmunetProtect.sys [2011-07-13 41424]
S1 ImmunetSelfProtectDriver;ImmunetSelfProtectDriver;c:\windows\system32\DRIVERS\ImmunetSelfProtect.sys [2011-07-13 31184]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 18432]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-03-21 53248]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-03-07 135168]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2009-05-03 31248]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-11-08 27632]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2009-07-03 1436560]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
2011-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=AVBR
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Smash\AppData\Roaming\Mozilla\Firefox\Profiles\0ixo772i.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4,00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e,00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a,00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94,00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0,00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6,00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc,00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90,00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e,00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a,00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6,00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90,00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8,00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70,00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a,00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0,00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74,00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82,00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82,00,
00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c,00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce,00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8,00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54,00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60,00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e,00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba,00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60,00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80,00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e,00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8,00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72,00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6,00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae,00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c,00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a,00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2,00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2,00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58,00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a,00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(3932)
c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\Samsung\Samsung Update Plus\SUPBackground.exe
c:\windows\system32\conhost.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2011-07-20 11:41:13 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-20 10:41
ComboFix2.txt 2011-07-19 15:23
ComboFix3.txt 2011-07-18 15:47
.
Pre-Run: 2,766,229,504 bytes free
Post-Run: 2,601,611,264 bytes free
.
- - End Of File - - C08C3DF57F1D2D3DB72EA2AC610A12E0


----------



## kevinf80 (Mar 21, 2006)

Maybe a bit of confusion with the instructions. I asked you to delete Combofix from our Desktop, then download a fresh version from the links I provided and save to the Desktop.

When you have the new version inplace double click on the icon to run Combofix (Windows 7 or Vista user right click and select "Run as Administartor"), do not drag any script to the icon. If you have any script on desktop, just delete it


----------



## Smasher (Jul 13, 2011)

I understand now. Executing ComboFix.exe... Currently unpacking... cmd window opens... no need to update this time [I used Link2 instead of Link1 to download it]... 'Completeing Stages'...


----------



## Smasher (Jul 13, 2011)

And here it is, no complications... Hope this is what you're expecting, sir.
---
ComboFix 11-07-21.02 - Smash 21/07/2011 13:00:19.4.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.2078 [GMT 1:00]
Running from: z:\zdesktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-06-21 to 2011-07-21 )))))))))))))))))))))))))))))))
.
.
2011-07-21 12:11 . 2011-07-21 12:11	--------	dc----w-	c:\users\Default\AppData\Local\temp
2011-07-19 15:37 . 2011-07-19 15:37	--------	dc----w-	c:\program files\ESET
2011-07-19 15:08 . 2011-07-21 12:11	--------	dc----w-	c:\users\Smash\AppData\Local\temp
2011-07-18 15:13 . 2009-07-13 23:54	108544	-c--a-w-	c:\windows\system32\drivers\tunnel.sys
2011-07-18 10:52 . 2011-07-18 10:53	--------	dc----w-	C:\Gotcha
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\programdata\Alwil Software
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\program files\Alwil Software
2011-07-15 13:04 . 2011-07-15 13:04	--------	dc----w-	C:\TDSSKiller_Quarantine
2011-07-13 21:11 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Trend Micro
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\users\Smash\AppData\Local\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	31184	-c--a-w-	c:\windows\system32\drivers\ImmunetSelfProtect.sys
2011-07-13 20:55 . 2011-07-13 20:55	41424	-c--a-w-	c:\windows\system32\drivers\ImmunetProtect.sys
2011-07-13 20:55 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:21 . 2011-07-13 18:21	--------	dc----w-	c:\users\Smash\AppData\Local\Adobe
2011-07-13 18:18 . 2011-07-13 18:18	--------	dc----w-	c:\users\Smash\AppData\Roaming\Malwarebytes
2011-07-13 18:18 . 2011-07-17 12:25	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 18:18 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-12 15:24 . 2011-07-12 15:30	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-07 22:39 . 2011-07-07 22:39	--------	dc----w-	c:\program files\Common Files\Java
2011-06-29 13:29 . 2011-06-29 13:30	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44 . 2011-06-28 15:44	--------	dc----w-	c:\users\Smash\AppData\Roaming\NCH Software
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\programdata\NCH Swift Sound
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\program files\NCH Swift Sound
2011-06-23 10:47 . 2011-06-23 11:21	--------	dc----w-	c:\users\Smash\AppData\Local\Songbird2
2011-06-23 10:47 . 2011-06-23 10:47	--------	dc----w-	c:\users\Smash\AppData\Roaming\Songbird2
2011-06-23 10:46 . 2011-06-23 10:46	--------	dc----w-	c:\program files\Songbird
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Roaming\Greyfirst
2011-06-23 10:00 . 2011-06-23 10:00	--------	dc----w-	c:\users\Smash\AppData\Local\Greyfirst
2011-06-22 19:44 . 2010-01-01 08:00	2106216	-c--a-w-	c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 19:44 . 2010-01-01 08:00	1998168	-c--a-w-	c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 19:32 . 2011-06-22 19:32	--------	dc----w-	c:\users\Smash\AppData\Local\Skybound
2011-06-22 19:32 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Skybound Stylizer 5
2011-06-22 19:31 . 2011-06-22 19:31	--------	dc----w-	c:\users\Smash\AppData\Roaming\KompoZer
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Roaming\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-06-22 19:30	--------	dc----w-	c:\users\Smash\AppData\Local\Disruptive Innovations SARL
2011-06-22 19:30 . 2011-07-19 00:02	--------	dc----w-	c:\program files\BlueGriffon
2011-06-22 19:28 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Celtx
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Roaming\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\users\Smash\AppData\Local\Instantbird
2011-06-22 19:23 . 2011-06-22 19:23	--------	dc----w-	c:\program files\Instantbird 0.3 Beta 1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 13:38 . 2009-08-10 15:21	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-13 13:37 . 2011-06-15 12:09	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-07-09 13:16 . 2011-05-18 10:08	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 12:22 . 2011-06-15 12:09	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:22 . 2011-06-15 12:09	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:22 . 2011-06-15 12:09	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:21 . 2011-06-15 12:09	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:21 . 2011-06-15 12:09	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:18 . 2011-06-15 12:09	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:18 . 2011-06-15 12:18	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18 . 2011-06-15 12:18	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:18 . 2011-06-15 12:09	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:10 . 2011-06-15 12:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:10 . 2011-06-15 12:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:10 . 2011-06-15 12:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-05-11 10:19 . 2011-05-11 09:47	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19 . 2011-05-11 09:47	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49 . 2011-05-11 09:47	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52 . 2010-10-12 12:35	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-04-27 09:13 . 2011-04-27 09:13	625152	-c--a-w-	c:\windows\system32\mp3tsshx.dll
2011-04-22 19:11 . 2011-04-22 19:11	86528	----a-w-	c:\windows\system32\iesysprep.dll
2011-04-22 19:11 . 2011-04-22 19:11	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-04-22 19:11 . 2011-04-22 19:11	74752	----a-w-	c:\windows\system32\iesetup.dll
2011-04-22 19:11 . 2011-04-22 19:11	63488	----a-w-	c:\windows\system32\tdc.ocx
2011-04-22 19:11 . 2011-04-22 19:11	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-04-22 19:11 . 2011-04-22 19:11	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-04-22 19:11 . 2011-04-22 19:11	367104	----a-w-	c:\windows\system32\html.iec
2011-04-22 19:11 . 2011-04-22 19:11	35840	----a-w-	c:\windows\system32\imgutil.dll
2011-04-22 19:11 . 2011-04-22 19:11	23552	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-22 19:11 . 2011-04-22 19:11	161792	----a-w-	c:\windows\system32\msls31.dll
2011-04-22 19:11 . 2011-04-22 19:11	152064	----a-w-	c:\windows\system32\wextract.exe
2011-04-22 19:11 . 2011-04-22 19:11	150528	----a-w-	c:\windows\system32\iexpress.exe
2011-04-22 19:11 . 2011-04-22 19:11	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2011-04-22 19:11 . 2011-04-22 19:11	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-04-22 19:11 . 2011-04-22 19:11	11776	----a-w-	c:\windows\system32\mshta.exe
2011-04-22 19:11 . 2011-04-22 19:11	1126912	----a-w-	c:\windows\system32\wininet.dll
2011-04-22 19:11 . 2011-04-22 19:11	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-04-22 19:11 . 2011-04-22 19:11	101888	----a-w-	c:\windows\system32\admparse.dll
2011-04-22 19:09 . 2011-04-22 19:09	801792	----a-w-	c:\windows\system32\FntCache.dll
2011-04-22 19:09 . 2011-04-22 19:09	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-04-22 19:09 . 2011-04-22 19:09	728448	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-04-22 19:09 . 2011-04-22 19:09	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-22 19:09 . 2011-04-22 19:09	3181568	----a-w-	c:\windows\system32\mf.dll
2011-04-22 19:09 . 2011-04-22 19:09	283648	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-04-22 19:09 . 2011-04-22 19:09	219008	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2011-04-22 19:09 . 2011-04-22 19:09	218624	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-04-22 19:09 . 2011-04-22 19:09	196608	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-04-22 19:09 . 2011-04-22 19:09	1619456	----a-w-	c:\windows\system32\WMVDECOD.DLL
2011-04-22 19:09 . 2011-04-22 19:09	161792	----a-w-	c:\windows\system32\d3d10_1.dll
2011-04-22 19:09 . 2011-04-22 19:09	1495040	----a-w-	c:\windows\system32\ExplorerFrame.dll
2011-04-22 19:09 . 2011-04-22 19:09	135168	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-04-22 19:09 . 2011-04-22 19:09	1170944	----a-w-	c:\windows\system32\d3d10warp.dll
2011-04-22 19:09 . 2011-04-22 19:09	107520	----a-w-	c:\windows\system32\cdd.dll
2011-04-22 19:09 . 2011-04-22 19:09	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-06-16 04:17 . 2011-04-05 15:56	142296	-c--a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 11:06	163328	-csha-r-	c:\windows\System32\flvDX.dll
2007-02-21 12:47	31232	-csha-r-	c:\windows\System32\msfDX.dll
2008-03-16 14:30	216064	-csha-r-	c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-05-23 431616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-10 13797920]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-18 124256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-25 643592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Immunet Protect"="c:\program files\Immunet Protect\2.0.17\iptray.exe" [2011-07-13 2615624]
.
c:\users\Smash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ClipX.lnk - c:\program files\ClipX\clipx.exe [2008-7-28 199168]
Dropbox.lnk - c:\users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	-c--a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	-c--a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EBUNWVLUMV]
c:\users\Smash\AppData\Local\Temp\Dd1.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\users\Smash\AppData\Local\Google\Update\GoogleUpdate.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22	3739648	-c--a-w-	c:\users\Smash\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44	31072	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntwhoc]
c:\users\Smash\AppData\Roaming\winshfhca.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-06-12 12:14	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
c:\users\smash\wuaucldt.exe [BU]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R2 ImmunetProtect;Immunet Protect;c:\program files\Immunet Protect\2.0.17\agent.exe [2011-07-13 756680]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-03-07 135168]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-10-30 359624]
R3 cpuz134;cpuz134;c:\users\Smash\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-10-12 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\DRIVERS\MAudioFastTrackUltra.sys [2009-09-25 135816]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-09 207792]
S1 ImmunetProtectDriver;ImmunetProtectDriver;c:\windows\system32\DRIVERS\ImmunetProtect.sys [2011-07-13 41424]
S1 ImmunetSelfProtectDriver;ImmunetSelfProtectDriver;c:\windows\system32\DRIVERS\ImmunetSelfProtect.sys [2011-07-13 31184]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 18432]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-03-21 53248]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2009-05-03 31248]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-11-08 27632]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2009-07-03 1436560]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
2011-07-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=AVBR
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Smash\AppData\Roaming\Mozilla\Firefox\Profiles\0ixo772i.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4,00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e,00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a,00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94,00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0,00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6,00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc,00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90,00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e,00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a,00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6,00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90,00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8,00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70,00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a,00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0,00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74,00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82,00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82,00,
00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c,00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce,00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8,00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54,00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60,00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e,00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba,00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60,00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80,00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e,00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8,00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72,00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6,00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae,00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c,00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a,00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2,00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2,00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58,00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a,00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(2396)
c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2011-07-21 13:15:13
ComboFix-quarantined-files.txt 2011-07-21 12:15
ComboFix2.txt 2011-07-20 10:41
ComboFix3.txt 2011-07-19 15:23
ComboFix4.txt 2011-07-18 15:47
.
Pre-Run: 3,714,576,384 bytes free
Post-Run: 3,703,775,232 bytes free
.
- - End Of File - - 4C7386F798B05B34EC6979DA837ABF4F


----------



## kevinf80 (Mar 21, 2006)

We need to upload three files for analysis, as follows please :-

*Upload a File to Virustotal*
Please visit *Virustotal*

 Click the *Browse...* button
 Navigate to the file *C:\Windows\System32\Crypserv.exe*
 Click the *Open* button
 Click the *Send* button
 If you get a message saying File has already been analyzed: click Reanalyze file now
 Copy and paste the results back here please.
 Repeat the above steps for the following files

*C:\Windows\System32\nvvsvc.exe
C:\Windows\System32\StkCSrv.exe*

Next,

Uninstall the following:

*NewTech Infosystems

Spybot - Search & Destroy*

Let me see the results from VirusTotal in your reply, also give an update on current issues/concerns....

Kevin


----------



## Smasher (Jul 13, 2011)

File name: Crypserv.exe
Submission date: 2011-07-24 14:25:20 (UTC)
Current status: finished
Result: 35/ 43 (81.4%)
VT Community

not reviewed
Safety score: - 
Compact
Print results 
Antivirus	Version	Last Update	Result
AhnLab-V3	2011.07.25.00	2011.07.24	Win-Trojan/Patched.DD
AntiVir	7.11.12.65	2011.07.23	TR/Spy.ZBot.122880.2
Antiy-AVL	2.0.3.7	2011.07.24	Trojan/Win32.Zbot.gen
Avast	4.8.1351.0	2011.07.24	Win32atched-WQ [Trj]
Avast5	5.0.677.0	2011.07.24	Win32atched-WQ [Trj]
AVG	10.0.0.1190	2011.07.24	Win32/Agent.CB
BitDefender	7.2	2011.07.24	Trojan.Patched.HC
CAT-QuickHeal	11.00	2011.07.24	W32.Patchload.O
ClamAV	0.97.0.0	2011.07.24	-
Commtouch	5.3.2.6	2011.07.23	W32/Patched.G
Comodo	9494	2011.07.24	TrojWare.Win32.Patched.HN
DrWeb	5.0.2.03300	2011.07.24	Trojan.Starter.1695
Emsisoft	5.1.0.8	2011.07.24	Trojan-Spy.Win32.Zbot!IK
eSafe	7.0.17.0	2011.07.21	-
eTrust-Vet	36.1.8459	2011.07.22	Win32/Patchload.U
F-Prot	4.6.2.117	2011.07.23	W32/Patched.G
F-Secure	9.0.16440.0	2011.07.24	Trojan.Patched.HC
Fortinet	4.2.257.0	2011.07.24	-
GData	22	2011.07.24	Trojan.Patched.HC
Ikarus	T3.1.1.104.0	2011.07.24	Trojan-Spy.Win32.Zbot
Jiangmin	13.0.900	2011.07.23	TrojanSpy.Zbot.adxr
K7AntiVirus	9.108.4937	2011.07.22	Trojan
Kaspersky	9.0.0.837	2011.07.24	Trojan.Win32.Patched.mf
McAfee	5.400.0.1158	2011.07.24	W32/Katusha
McAfee-GW-Edition	2010.1D	2011.07.24	Heuristic.LooksLike.Win32.SuspiciousPE.J!88
Microsoft	1.7104	2011.07.24	Virus:Win32/Patchload.O
NOD32	6320	2011.07.24	Win32/Patched.HN
Norman	6.07.10	2011.07.23	W32/Patched.BH
nProtect	2011-07-24.01	2011.07.24	-
Panda	10.0.3.5	2011.07.23	W32/Katusha.BN
PCTools	8.0.0.5	2011.07.24	Trojan.Katusha
Prevx	3.0	2011.07.24	-
Rising	23.67.04.03	2011.07.22	-
Sophos	4.67.0	2011.07.24	Mal/Generic-L
SUPERAntiSpyware	4.40.0.1006	2011.07.23	-
Symantec	20111.1.0.186	2011.07.24	Trojan.Katusha.A!inf
TheHacker	6.7.0.1.261	2011.07.23	-
TrendMicro	9.200.0.1012	2011.07.24	PTCH_KATUSHA.W
TrendMicro-HouseCall	9.200.0.1012	2011.07.24	PTCH_KATUSHA.W
VBA32	3.12.16.4	2011.07.22	Trojan-Spy.Zbot.gen
VIPRE	9950	2011.07.24	Virus.Win32.Agent.mpq (v)
ViRobot	2011.7.23.4585	2011.07.24	Win32.Patched.BE
VirusBuster	14.0.136.0	2011.07.24	Win32.Katusha.Gen
Additional informationShow all
MD5 : f18232eccad5d98d9950f9f7a86ffb0b
SHA1 : 82644382c15b7bf9129134ae19261ad2e2ff4198
SHA256: fdccbf5d8c8cfde269d0f6f262da3bc8ee56b96601e9847e3659d02f3dca5230


----------



## Smasher (Jul 13, 2011)

File name: nvvsvc.exe
Submission date: 2011-07-24 14:20:16 (UTC)
Current status: finished
Result: 33/ 43 (76.7%)
VT Community

not reviewed
Safety score: - 
Compact
Print results 
Antivirus	Version	Last Update	Result
AhnLab-V3	2011.07.25.00	2011.07.24	Win-Trojan/Patched.DD
AntiVir	7.11.12.65	2011.07.23	W32/PatchLoad.A
Antiy-AVL	2.0.3.7	2011.07.24	-
Avast	4.8.1351.0	2011.07.24	Win32atched-WQ [Trj]
Avast5	5.0.677.0	2011.07.24	Win32atched-WQ [Trj]
AVG	10.0.0.1190	2011.07.24	Win32/Agent.CB
BitDefender	7.2	2011.07.24	Trojan.Patched.HC
CAT-QuickHeal	11.00	2011.07.24	W32.Patchload.O
ClamAV	0.97.0.0	2011.07.24	-
Commtouch	5.3.2.6	2011.07.23	W32/Patched.G
Comodo	9494	2011.07.24	TrojWare.Win32.Patched.HN
DrWeb	5.0.2.03300	2011.07.24	Trojan.Starter.1695
Emsisoft	5.1.0.8	2011.07.24	Trojan-Spy.Win32.Zbot!IK
eSafe	7.0.17.0	2011.07.21	-
eTrust-Vet	36.1.8459	2011.07.22	Win32/Patchload.U
F-Prot	4.6.2.117	2011.07.23	W32/Patched.G
F-Secure	9.0.16440.0	2011.07.24	Trojan.Patched.HC
Fortinet	4.2.257.0	2011.07.24	-
GData	22	2011.07.24	Trojan.Patched.HC
Ikarus	T3.1.1.104.0	2011.07.24	Trojan-Spy.Win32.Zbot
Jiangmin	13.0.900	2011.07.23	TrojanSpy.Zbot.adxr
K7AntiVirus	9.108.4937	2011.07.22	Trojan
Kaspersky	9.0.0.837	2011.07.24	Trojan.Win32.Patched.mf
McAfee	5.400.0.1158	2011.07.24	W32/Katusha
McAfee-GW-Edition	2010.1D	2011.07.24	W32/Katusha
Microsoft	1.7104	2011.07.24	Virus:Win32/Patchload.O
NOD32	6320	2011.07.24	Win32/Patched.HN
Norman	6.07.10	2011.07.23	W32/Patched.BH
nProtect	2011-07-24.01	2011.07.24	-
Panda	10.0.3.5	2011.07.23	W32/Katusha.BN
PCTools	8.0.0.5	2011.07.24	Trojan.Katusha
Prevx	3.0	2011.07.24	-
Rising	23.67.04.03	2011.07.22	-
Sophos	4.67.0	2011.07.24	-
SUPERAntiSpyware	4.40.0.1006	2011.07.23	-
Symantec	20111.1.0.186	2011.07.24	Trojan.Katusha.A!inf
TheHacker	6.7.0.1.261	2011.07.23	-
TrendMicro	9.200.0.1012	2011.07.24	PTCH_KATUSHA.W
TrendMicro-HouseCall	9.200.0.1012	2011.07.24	PTCH_KATUSHA.W
VBA32	3.12.16.4	2011.07.22	Trojan-Spy.Zbot.gen
VIPRE	9951	2011.07.24	Virus.Win32.Agent.mpq (v)
ViRobot	2011.7.23.4585	2011.07.24	Win32.Patched.BE
VirusBuster	14.0.136.0	2011.07.24	Win32.Katusha.Gen
Additional informationShow all
MD5 : bc4016fd88572990be63a5c2a8fd70a4
SHA1 : 609f50c65892c2d14034dc66cb54c55347a9f6fb
SHA256: 58ced749804d6c566d3d7d62ef1a3f8d4b59bb05853530d475d21ccaf3bbf0ce


----------



## Smasher (Jul 13, 2011)

File name: StkCSrv.exe
Submission date: 2011-07-24 14:31:18 (UTC)
Current status: finished
Result: 33/ 43 (76.7%)
VT Community

not reviewed
Safety score: - 
Compact
Print results 
Antivirus	Version	Last Update	Result
AhnLab-V3	2011.07.25.00	2011.07.24	Win-Trojan/Patched.DD
AntiVir	7.11.12.65	2011.07.23	W32/PatchLoad.A
Antiy-AVL	2.0.3.7	2011.07.24	-
Avast	4.8.1351.0	2011.07.24	Win32atched-WQ [Trj]
Avast5	5.0.677.0	2011.07.24	Win32atched-WQ [Trj]
AVG	10.0.0.1190	2011.07.24	Win32/Agent.CB
BitDefender	7.2	2011.07.24	Trojan.Patched.HC
CAT-QuickHeal	11.00	2011.07.24	W32.Patchload.O
ClamAV	0.97.0.0	2011.07.24	-
Commtouch	5.3.2.6	2011.07.23	W32/Patched.G
Comodo	9494	2011.07.24	TrojWare.Win32.Patched.HN
DrWeb	5.0.2.03300	2011.07.24	Trojan.Starter.1695
Emsisoft	5.1.0.8	2011.07.24	Trojan-Spy.Win32.Zbot!IK
eSafe	7.0.17.0	2011.07.21	-
eTrust-Vet	36.1.8459	2011.07.22	Win32/Patchload.U
F-Prot	4.6.2.117	2011.07.23	W32/Patched.G
F-Secure	9.0.16440.0	2011.07.24	Trojan.Patched.HC
Fortinet	4.2.257.0	2011.07.24	-
GData	22	2011.07.24	Trojan.Patched.HC
Ikarus	T3.1.1.104.0	2011.07.24	Trojan-Spy.Win32.Zbot
Jiangmin	13.0.900	2011.07.23	TrojanSpy.Zbot.adxr
K7AntiVirus	9.108.4937	2011.07.22	Trojan
Kaspersky	9.0.0.837	2011.07.24	Trojan.Win32.Patched.mf
McAfee	5.400.0.1158	2011.07.24	W32/Katusha
McAfee-GW-Edition	2010.1D	2011.07.24	W32/Katusha
Microsoft	1.7104	2011.07.24	Virus:Win32/Patchload.O
NOD32	6320	2011.07.24	Win32/Patched.HN
Norman	6.07.10	2011.07.23	W32/Patched.BH
nProtect	2011-07-24.01	2011.07.24	-
Panda	10.0.3.5	2011.07.23	W32/Katusha.BN
PCTools	8.0.0.5	2011.07.24	Trojan.Katusha
Prevx	3.0	2011.07.24	-
Rising	23.67.04.03	2011.07.22	-
Sophos	4.67.0	2011.07.24	-
SUPERAntiSpyware	4.40.0.1006	2011.07.23	-
Symantec	20111.1.0.186	2011.07.24	Trojan.Katusha.A!inf
TheHacker	6.7.0.1.261	2011.07.23	-
TrendMicro	9.200.0.1012	2011.07.24	PTCH_KATUSHA.W
TrendMicro-HouseCall	9.200.0.1012	2011.07.24	PTCH_KATUSHA.W
VBA32	3.12.16.4	2011.07.22	Trojan-Spy.Zbot.gen
VIPRE	9951	2011.07.24	Virus.Win32.Agent.mpq (v)
ViRobot	2011.7.23.4585	2011.07.24	Win32.Patched.BE
VirusBuster	14.0.136.0	2011.07.24	Win32.Katusha.Gen
Additional informationShow all
MD5 : 0281d16e254c1679a950ad931f963a1c
SHA1 : 1350fb794abc25dc299e38bdeff8a88028499cc2
SHA256: b5e2d115403ce70dc5c9dcc04084c91775d414b1a4337c8fe1c6d22986c95d20


----------



## Smasher (Jul 13, 2011)

Now trying to uninstall NTI Backup - its struggling as in it's just not happening - the uninstall icon is on the task bar but i can't get it to do anything. will reboot and try again.


----------



## Smasher (Jul 13, 2011)

reboot, uninstall NTI Media, this looks like it worked will reboot in a moment.
tried to uninstall spybot but it came up with a message saying a file was missing and that I should install again - so that I can uninstall it,


----------



## Smasher (Jul 13, 2011)

OK. Spybot now uninstalled. All NTI progs uninstalled.
I hope you got those VirusTotal Results OK.
I just copied and pasted from the resultant web page.

Thank you again.


----------



## kevinf80 (Mar 21, 2006)

I want you to re-run ESET, this time leave the tick *in* "remove found threats" re-boot after eset scan.

*Run ESET Online Scan*

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
*ESET OnlineScan*
Click the







button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on







to download the ESET Smart Installer. *Save* it to your desktop.
Double click on the







icon on your desktop.

Check








Click the







button.
Accept any security warnings from your browser.
Check








*Leave the tick in remove found threats*
Push the *Start* button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push








Push







, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the







button.
Push








You can refer to *this animation* by *neomage* if needed.
Frequently asked questions available *Here* *Please read them before running the scan.*

Also be aware this scan can take between one and several hours to complete depending on the size of your system.

ESET log can be found here *"C:\Program Files\ESET\EsetOnlineScanner\log.txt".*

Kevin


----------



## Smasher (Jul 13, 2011)

OK, this seemed to go smoothly and here are the results...
ESETScan.txt
---
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan	error while cleaning
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan	error while cleaning
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan	error while cleaning

---

And here is the log file
---

[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=8db96729a27fe94ab5b3168dbdfe7466
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-19 06:08:47
# local_time=2011-07-19 07:08:47 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=770 16774142 0 2 184243 184243 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 82 0 63556433 0 0
# compatibility_mode=8192 67108863 100 0 186 186 0 0
# scanned=281680
# found=31
# cleaned=24
# scan_time=8885
C:\Program Files\Bonjour\mDNSResponder.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\iPod\bin\iPodService.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\NCH Swift Sound\Switch\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir	a variant of Win32/Sirefef.CH trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\1239044146.sys.vir	Win32/Rootkit.Agent.NUX trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\tunnel.sys.vir	a variant of Win32/Rootkit.Agent.NUT trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Users\Smash\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Smash\MailBrowser Attachments\[email protected]\sent\attachments\infectedWithMalware.txt	JS/TrojanDownloader.HackLoad.AG trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\winsxs\x86_microsoft-windows-tunnel_31bf3856ad364e35_6.1.7600.16385_none_a3405f31e607efeb\tunnel.sys	a variant of Win32/Rootkit.Agent.NUT trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\SUPERsetup April 23.exe	Win32/OpenCandy application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\SUPERsetup.exe	Win32/OpenCandy application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\WyzoSetup-3.6.4.exe	Win32/Toolbar.Zugo application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Downloads\Adobe Audition 3.0.rar	a variant of Win32/Keygen.AF application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\Sony Vegas Pro 9 + Crack and KeyGen.rar	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\Express Burn Plus\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\Switch Sound File Converter\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\WavePad Sound Editor\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\ag-3427a.zip	a variant of Win32/Keygen.AF application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\Keygen.exe	a variant of Win32/Keygen.AF application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\Sony Vegas Movie Studio HD Platinum 10.0.179 + Keygen [RH]\SV.MST.HD.PE.10.0.179_[RH].rar	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\zDesktop\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=8db96729a27fe94ab5b3168dbdfe7466
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-25 01:19:11
# local_time=2011-07-25 02:19:11 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=770 16774142 0 2 685800 685800 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 82 0 64057990 0 0
# compatibility_mode=8192 67108863 100 0 501743 501743 0 0
# scanned=280110
# found=3
# cleaned=0
# scan_time=8352
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I


----------



## kevinf80 (Mar 21, 2006)

Continue as follows :-

Please download *OTM by OldTimer*.
*Alternative Mirror 1*
*Alternative Mirror 2* 
Save it to your desktop. 
Double click *OTM.exe* to start the tool. Vista or Windows 7 users right click and select Run as Administrator

*Copy* the text between the dotted lines below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):

-------------------------------------------------------------------
* 
:Files
ipconfig /flushdns /c
C:\Windows\System32\Crypserv.exe
C:\Windows\System32\nvvsvc.exe
C:\Windows\System32\StkCSrv.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5
C:\Program Files\Spybot - Search & Destroy
:Commands
[EmptyTemp]
[Reboot]
*
---------------------------------------------------------------------

 Return to OTMoveIt3, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red







button.
*Copy* everything in the Results window (under the green bar) to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close *OTM*
*Note:* If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose *Yes.*

If the machine reboots, the Results log can be found here:

*c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log*

Where mmddyyyy_hhmmss is the date of the tool run.

Re-run ESET again, leave the tick *OUT /B] of "Remove Found Threats"

let me see the log from OTM and ESET in next reply......

Kevin*


----------



## Smasher (Jul 13, 2011)

It did have to reboot and this popped up [I now shall run ESET]
---
All processes killed
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
Z:\zDesktop\cmd.bat deleted successfully.
Z:\zDesktop\cmd.txt deleted successfully.
File move failed. C:\Windows\System32\Crypserv.exe scheduled to be moved on reboot.
C:\Windows\System32\nvvsvc.exe moved successfully.
File move failed. C:\Windows\System32\StkCSrv.exe scheduled to be moved on reboot.
File/Folder C:\Program Files\NewTech Infosystems\NTI Backup Now 5 not found.
C:\Program Files\Spybot - Search & Destroy\Skins folder moved successfully.
C:\Program Files\Spybot - Search & Destroy\Plugins folder moved successfully.
C:\Program Files\Spybot - Search & Destroy\Dummies folder moved successfully.
Folder move failed. C:\Program Files\Spybot - Search & Destroy scheduled to be moved on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Smash
->Temp folder emptied: 43112630 bytes
->Temporary Internet Files folder emptied: 19003723 bytes
->Java cache emptied: 883710 bytes
->FireFox cache emptied: 71648970 bytes
->Google Chrome cache emptied: 7555949 bytes
->Flash cache emptied: 62420 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 4587520 bytes

Total Files Cleaned = 140.00 mb

OTM by OldTimer - Version 3.1.18.0 log created on 07252011_201046

Files moved on Reboot...
File move failed. C:\Windows\System32\Crypserv.exe scheduled to be moved on reboot.
File move failed. C:\Windows\System32\StkCSrv.exe scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Spybot - Search & Destroy scheduled to be moved on reboot.

Registry entries deleted on Reboot...

---

Eset log
---

[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=8db96729a27fe94ab5b3168dbdfe7466
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-19 06:08:47
# local_time=2011-07-19 07:08:47 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=770 16774142 0 2 184243 184243 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 82 0 63556433 0 0
# compatibility_mode=8192 67108863 100 0 186 186 0 0
# scanned=281680
# found=31
# cleaned=24
# scan_time=8885
C:\Program Files\Bonjour\mDNSResponder.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\iPod\bin\iPodService.exe	Win32/Patched.HN trojan (cleaned - quarantined)	00000000000000000000000000000000	C
C:\Program Files\NCH Swift Sound\Switch\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir	a variant of Win32/Sirefef.CH trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\1239044146.sys.vir	Win32/Rootkit.Agent.NUX trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\tunnel.sys.vir	a variant of Win32/Rootkit.Agent.NUT trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Users\Smash\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Smash\MailBrowser Attachments\[email protected]\sent\attachments\infectedWithMalware.txt	JS/TrojanDownloader.HackLoad.AG trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\winsxs\x86_microsoft-windows-tunnel_31bf3856ad364e35_6.1.7600.16385_none_a3405f31e607efeb\tunnel.sys	a variant of Win32/Rootkit.Agent.NUT trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\SUPERsetup April 23.exe	Win32/OpenCandy application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\SUPERsetup.exe	Win32/OpenCandy application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Downloads\WyzoSetup-3.6.4.exe	Win32/Toolbar.Zugo application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Downloads\Adobe Audition 3.0.rar	a variant of Win32/Keygen.AF application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\Sony Vegas Pro 9 + Crack and KeyGen.rar	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\Express Burn Plus\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\Switch Sound File Converter\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\NCH Software\WavePad Sound Editor\Keygen.exe	a variant of Win32/Keygen.AT application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\ag-3427a.zip	a variant of Win32/Keygen.AF application (deleted - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\PowerISO.v4.1.Incl.Keymaker-AGAiN\Keygen.exe	a variant of Win32/Keygen.AF application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\My Music\0NewDownloads\Sony Vegas Movie Studio HD Platinum 10.0.179 + Keygen [RH]\SV.MST.HD.PE.10.0.179_[RH].rar	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\zDesktop\Switch.Audio.File.Converter.4.crack.exe	Win32/Agent.SVV trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=8db96729a27fe94ab5b3168dbdfe7466
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-25 01:19:11
# local_time=2011-07-25 02:19:11 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=770 16774142 0 2 685800 685800 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 82 0 64057990 0 0
# compatibility_mode=8192 67108863 100 0 501743 501743 0 0
# scanned=280110
# found=3
# cleaned=0
# scan_time=8352
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan (error while cleaning)	00000000000000000000000000000000	I
[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=8db96729a27fe94ab5b3168dbdfe7466
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-25 09:41:20
# local_time=2011-07-25 10:41:20 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=770 16774142 0 2 715853 715853 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776574 100 82 0 64088043 0 0
# compatibility_mode=8192 67108863 100 0 531796 531796 0 0
# scanned=279604
# found=3
# cleaned=0
# scan_time=8428
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan (unable to clean)	00000000000000000000000000000000	I
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan (unable to clean)	00000000000000000000000000000000	I
Z:\_OTM\MovedFiles\07252011_201046\C_Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan (unable to clean)	00000000000000000000000000000000	I


----------



## Smasher (Jul 13, 2011)

ESETScan.txt
---
C:\Windows\System32\Crypserv.exe	Win32/Patched.HN trojan
C:\Windows\System32\StkCSrv.exe	Win32/Patched.HN trojan
Z:\_OTM\MovedFiles\07252011_201046\C_Windows\System32\nvvsvc.exe	Win32/Patched.HN trojan


----------



## kevinf80 (Mar 21, 2006)

We are definitely losing this one for sure, you are constantly being reinfected. I see from the logs that you are/have been using cracks and Key gens, not good my friend, not good at all.

OK one last try with Combofix to see if we can get a foothold, if this fails you will be better off reformatting your HD and reinstalling windows.....

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

*Link 1*
*Link 2*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

 Do not re-name it this time, leave as is....

 Disable all security programs as they will have a negative effect on Combofix, instructions available *Here* if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)

 Instructions for running Combofix available *Here* if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read *Here* why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin


----------



## Smasher (Jul 13, 2011)

Let's just say that i have learnt my lesson. And I'm hoping you don't feel you've been wasting your time. I really appreciate all your help.

OK, I'm going to download ComboFix again


----------



## kevinf80 (Mar 21, 2006)

I dont give up that easily, Run CF and let me see the log.
If you still have any cracks key gens etc on your system, just delete them. We have a better chance of cleaning your system if they are gone, get rid of them then run CF....

Kevin


----------



## Smasher (Jul 13, 2011)

Fingers crossed
---
ComboFix 11-07-27.02 - Smash 27/07/2011 20:29:44.5.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3067.2282 [GMT 1:00]
Running from: z:\zdesktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-06-27 to 2011-07-27 )))))))))))))))))))))))))))))))
.
.
2011-07-27 19:39 . 2011-07-27 19:39	--------	dc----w-	c:\users\Default\AppData\Local\temp
2011-07-19 15:37 . 2011-07-19 15:37	--------	dc----w-	c:\program files\ESET
2011-07-19 15:08 . 2011-07-27 19:39	--------	dc----w-	c:\users\Smash\AppData\Local\temp
2011-07-18 15:13 . 2009-07-13 23:54	108544	-c--a-w-	c:\windows\system32\drivers\tunnel.sys
2011-07-18 10:52 . 2011-07-18 10:53	--------	dc----w-	C:\Gotcha
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\programdata\Alwil Software
2011-07-15 13:57 . 2011-07-15 13:57	--------	dc----w-	c:\program files\Alwil Software
2011-07-15 13:04 . 2011-07-15 13:04	--------	dc----w-	C:\TDSSKiller_Quarantine
2011-07-13 21:11 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Trend Micro
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\programdata\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	--------	dc----w-	c:\users\Smash\AppData\Local\Immunet
2011-07-13 20:55 . 2011-07-13 20:55	31184	-c--a-w-	c:\windows\system32\drivers\ImmunetSelfProtect.sys
2011-07-13 20:55 . 2011-07-13 20:55	41424	-c--a-w-	c:\windows\system32\drivers\ImmunetProtect.sys
2011-07-13 20:55 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Immunet Protect
2011-07-13 18:21 . 2011-07-13 18:21	--------	dc----w-	c:\users\Smash\AppData\Local\Adobe
2011-07-13 18:18 . 2011-07-13 18:18	--------	dc----w-	c:\users\Smash\AppData\Roaming\Malwarebytes
2011-07-13 18:18 . 2011-07-17 12:25	--------	dc----w-	c:\programdata\Malwarebytes
2011-07-13 18:18 . 2011-07-19 00:02	--------	dc----w-	c:\program files\Malwarebytes' Anti-Malware
2011-07-12 15:24 . 2011-07-12 15:30	285688990	-c--a-w-	C:\20110712backup.reg
2011-07-07 22:39 . 2011-07-07 22:39	--------	dc----w-	c:\program files\Common Files\Java
2011-06-29 13:29 . 2011-06-29 13:30	294912	----a-w-	c:\windows\system32\umpnpmgr.dll
2011-06-28 15:44 . 2011-06-28 15:44	--------	dc----w-	c:\users\Smash\AppData\Roaming\NCH Software
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\programdata\NCH Swift Sound
2011-06-28 15:42 . 2011-06-28 15:42	--------	dc----w-	c:\program files\NCH Swift Sound
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-13 13:38 . 2009-08-10 15:21	19648832	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2011-07-13 13:37 . 2011-06-15 12:09	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2011-07-09 13:16 . 2011-05-18 10:08	404640	-c--a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-15 12:22 . 2011-06-15 12:09	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-15 12:22 . 2011-06-15 12:09	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-15 12:22 . 2011-06-15 12:09	114176	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-15 12:21 . 2011-06-15 12:09	1286016	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-15 12:21 . 2011-06-15 12:09	571904	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-15 12:18 . 2011-06-15 12:09	78336	----a-w-	c:\windows\system32\drivers\dfsc.sys
2011-06-15 12:18 . 2011-06-15 12:18	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-06-15 12:18 . 2011-06-15 12:18	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-06-15 12:18 . 2011-06-15 12:09	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-15 12:10 . 2011-06-15 12:08	96256	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 12:10 . 2011-06-15 12:08	222720	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 12:10 . 2011-06-15 12:08	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-05-11 10:19 . 2011-05-11 09:47	3957632	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-05-11 10:19 . 2011-05-11 09:47	3901824	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-05-11 09:49 . 2011-05-11 09:47	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-04 03:52 . 2010-10-12 12:35	472808	-c--a-w-	c:\windows\system32\deployJava1.dll
2011-06-16 04:17 . 2011-04-05 15:56	142296	-c--a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 11:06	163328	-csha-r-	c:\windows\System32\flvDX.dll
2007-02-21 12:47	31232	-csha-r-	c:\windows\System32\msfDX.dll
2008-03-16 14:30	216064	-csha-r-	c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	-c--a-w-	c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-05-23 431616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-10 13797920]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-18 124256]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-25 643592]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Immunet Protect"="c:\program files\Immunet Protect\2.0.17\iptray.exe" [2011-07-13 2615624]
.
c:\users\Smash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ClipX.lnk - c:\program files\ClipX\clipx.exe [2008-7-28 199168]
Dropbox.lnk - c:\users\Smash\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	-c--a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	-c--a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EBUNWVLUMV]
c:\users\Smash\AppData\Local\Temp\Dd1.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\users\Smash\AppData\Local\Google\Update\GoogleUpdate.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22	3739648	-c--a-w-	c:\users\Smash\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44	31072	----a-w-	c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntwhoc]
c:\users\Smash\AppData\Roaming\winshfhca.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-06-12 12:14	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
c:\users\smash\wuaucldt.exe [BU]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R2 ImmunetProtect;Immunet Protect;c:\program files\Immunet Protect\2.0.17\agent.exe [2011-07-13 756680]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-10-30 359624]
R3 cpuz134;cpuz134;c:\users\Smash\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-10-12 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 135664]
R3 MAUSBFASTTRACKULTRA;Service for M-Audio Fast Track Ultra;c:\windows\system32\DRIVERS\MAudioFastTrackUltra.sys [2009-09-25 135816]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-09 207792]
S1 ImmunetProtectDriver;ImmunetProtectDriver;c:\windows\system32\DRIVERS\ImmunetProtect.sys [2011-07-13 41424]
S1 ImmunetSelfProtectDriver;ImmunetSelfProtectDriver;c:\windows\system32\DRIVERS\ImmunetSelfProtect.sys [2011-07-13 31184]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2009-05-03 31248]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736]
S3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-11-08 27632]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2009-07-03 1436560]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ scan sysagent
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
2011-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-12 12:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=AVBR
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Smash\AppData\Roaming\Mozilla\Firefox\Profiles\0ixo772i.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,39,d4,39,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Bookmarks bar\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,93,dc,e2,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,0b,00,00,00,ea,00,32,00,84,00,00,00,00,55,3f,57,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\SmashTV\Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,f4,75,78,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Emsworth]
"Order"=hex:08,00,00,00,02,00,00,00,aa,06,00,00,01,00,00,00,0a,00,00,00,c4,00,
00,00,00,00,00,00,b6,00,32,00,84,00,00,00,00,0e,01,a9,20,00,43,48,49,43,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites]
"Order"=hex:08,00,00,00,02,00,00,00,6e,0c,00,00,01,00,00,00,17,00,00,00,5e,00,
00,00,03,00,00,00,50,00,31,00,00,00,00,00,00,30,68,16,10,00,47,6f,6f,67,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Google]
"Order"=hex:08,00,00,00,02,00,00,00,82,01,00,00,01,00,00,00,03,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,6c,be,90,20,00,47,21,4e,4f,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\LittleSmasher]
"Order"=hex:08,00,00,00,02,00,00,00,10,03,00,00,01,00,00,00,06,00,00,00,7a,00,
00,00,03,00,00,00,6c,00,32,00,84,00,00,00,00,de,c9,88,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\Loopy]
"Order"=hex:08,00,00,00,02,00,00,00,7e,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,02,00,00,00,58,00,32,00,84,00,00,00,00,4a,1f,a8,20,00,4c,6f,6f,70,79,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\My Email]
"Order"=hex:08,00,00,00,02,00,00,00,bc,04,00,00,01,00,00,00,09,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,32,00,84,00,00,00,00,7a,ea,0b,20,00,47,4d,58,2d,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \My Websites\TwitterTools]
"Order"=hex:08,00,00,00,02,00,00,00,b6,0e,00,00,01,00,00,00,17,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,38,14,1d,20,00,42,49,54,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,9e,0f,00,00,01,00,00,00,1b,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,0a,e4,80,10,00,41,75,64,61,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Audacity]
"Order"=hex:08,00,00,00,02,00,00,00,36,01,00,00,01,00,00,00,02,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,7c,06,43,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast]
"Order"=hex:08,00,00,00,02,00,00,00,ca,01,00,00,01,00,00,00,03,00,00,00,94,00,
00,00,01,00,00,00,86,00,31,00,00,00,00,00,00,5b,c1,7d,10,00,42,52,55,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Brunel University Podcast\Brunel Episode Urls for checking]
"Order"=hex:08,00,00,00,02,00,00,00,f2,01,00,00,01,00,00,00,04,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,61,68,2e,20,00,32,30,30,37,30,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Contract Templates]
"Order"=hex:08,00,00,00,02,00,00,00,7c,01,00,00,01,00,00,00,02,00,00,00,c0,00,
00,00,00,00,00,00,b2,00,32,00,84,00,00,00,00,d0,fd,76,20,00,50,52,4f,46,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\My Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,86,d6,e6,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Reading]
"Order"=hex:08,00,00,00,02,00,00,00,82,09,00,00,01,00,00,00,0d,00,00,00,e6,00,
00,00,00,00,00,00,d8,00,32,00,84,00,00,00,00,12,a5,34,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcast Tool]
"Order"=hex:08,00,00,00,02,00,00,00,d8,0c,00,00,01,00,00,00,12,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,5a,51,fd,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts]
"Order"=hex:08,00,00,00,02,00,00,00,bc,00,00,00,01,00,00,00,01,00,00,00,b0,00,
00,00,00,00,00,00,a2,00,31,00,00,00,00,00,00,36,4a,95,10,00,47,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Podcasts\Great Examples on how podcasting is being used]
"Order"=hex:08,00,00,00,02,00,00,00,a4,00,00,00,01,00,00,00,01,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,4a,52,57,20,00,53,54,41,46,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Sales Leads]
"Order"=hex:08,00,00,00,02,00,00,00,de,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,24,b7,75,20,00,4c,49,42,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\South Africa]
"Order"=hex:08,00,00,00,02,00,00,00,30,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,d1,a9,b7,20,00,53,4f,55,54,48,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Training]
"Order"=hex:08,00,00,00,02,00,00,00,f4,05,00,00,01,00,00,00,08,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,9d,d1,37,20,00,41,55,44,41,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Podcasting\Webpage Players]
"Order"=hex:08,00,00,00,02,00,00,00,b0,04,00,00,01,00,00,00,05,00,00,00,dc,00,
00,00,00,00,00,00,ce,00,32,00,84,00,00,00,00,d9,b7,f4,20,00,42,49,47,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks]
"Order"=hex:08,00,00,00,02,00,00,00,be,03,00,00,01,00,00,00,09,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,fc,bf,38,10,00,44,4f,57,4e,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Downloading]
"Order"=hex:08,00,00,00,02,00,00,00,1a,0a,00,00,01,00,00,00,11,00,00,00,90,00,
00,00,01,00,00,00,82,00,32,00,84,00,00,00,00,3e,33,84,20,00,44,45,4d,4f,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography]
"Order"=hex:08,00,00,00,02,00,00,00,80,05,00,00,01,00,00,00,0b,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,60,08,81,10,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Accommodation]
"Order"=hex:08,00,00,00,02,00,00,00,ae,05,00,00,01,00,00,00,08,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,e1,03,25,20,00,43,4f,55,4e,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries]
"Order"=hex:08,00,00,00,02,00,00,00,e8,01,00,00,01,00,00,00,04,00,00,00,5e,00,
00,00,01,00,00,00,50,00,31,00,00,00,00,00,00,dd,ea,8a,10,00,54,72,61,76,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,e6,04,00,00,01,00,00,00,08,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,fb,eb,bc,10,00,43,41,52,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes]
"Order"=hex:08,00,00,00,02,00,00,00,9a,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,01,00,00,00,6e,00,31,00,00,00,00,00,00,cc,cd,ab,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness]
"Order"=hex:08,00,00,00,02,00,00,00,aa,11,00,00,01,00,00,00,1d,00,00,00,7a,00,
00,00,14,00,00,00,6c,00,31,00,00,00,00,00,00,e2,9c,c3,10,00,4d,4f,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\Travel\Cars&Bikes\Motorcycle Emptiness\Motorcycle Security]
"Order"=hex:08,00,00,00,02,00,00,00,b2,00,00,00,01,00,00,00,01,00,00,00,a6,00,
00,00,00,00,00,00,98,00,32,00,84,00,00,00,00,40,14,0d,20,00,44,41,54,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK]
"Order"=hex:08,00,00,00,02,00,00,00,bc,02,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,02,00,00,00,56,00,31,00,00,00,00,00,00,a1,8d,15,10,00,47,75,65,72,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\UK\Guernsey]
"Order"=hex:08,00,00,00,02,00,00,00,c0,03,00,00,01,00,00,00,05,00,00,00,8c,00,
00,00,00,00,00,00,7e,00,32,00,84,00,00,00,00,bd,07,a2,20,00,43,4f,4e,44,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Countries\USA]
"Order"=hex:08,00,00,00,02,00,00,00,94,00,00,00,01,00,00,00,01,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,80,28,3d,20,00,42,52,49,54,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Oxford]
"Order"=hex:08,00,00,00,02,00,00,00,5c,07,00,00,01,00,00,00,0d,00,00,00,90,00,
00,00,00,00,00,00,82,00,32,00,84,00,00,00,00,69,7d,71,20,00,42,4c,41,43,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Southsea]
"Order"=hex:08,00,00,00,02,00,00,00,80,00,00,00,01,00,00,00,01,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,dc,f5,9e,20,00,49,4e,53,4f,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Swindon]
"Order"=hex:08,00,00,00,02,00,00,00,be,02,00,00,01,00,00,00,04,00,00,00,b8,00,
00,00,00,00,00,00,aa,00,32,00,84,00,00,00,00,cd,52,de,20,00,53,57,49,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Geography\Travel]
"Order"=hex:08,00,00,00,02,00,00,00,d8,04,00,00,01,00,00,00,06,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,76,08,51,20,00,42,55,44,47,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\History]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,09,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,bb,76,d5,20,00,38,30,26,23,33,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money]
"Order"=hex:08,00,00,00,02,00,00,00,30,05,00,00,01,00,00,00,0c,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,58,27,2d,10,00,42,61,6e,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Banks]
"Order"=hex:08,00,00,00,02,00,00,00,50,05,00,00,01,00,00,00,0a,00,00,00,70,00,
00,00,08,00,00,00,62,00,32,00,84,00,00,00,00,d6,be,a8,20,00,7b,4c,4f,47,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Business Homepages]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,7c,f3,4c,20,00,42,4c,55,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Energy]
"Order"=hex:08,00,00,00,02,00,00,00,8e,0a,00,00,01,00,00,00,0c,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,53,ca,c8,20,00,43,48,45,41,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance]
"Order"=hex:08,00,00,00,02,00,00,00,5a,03,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,02,00,00,00,76,00,31,00,00,00,00,00,00,59,40,1b,10,00,49,4e,53,55,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Insurance\Insurance Searches Motor]
"Order"=hex:08,00,00,00,02,00,00,00,ec,0c,00,00,01,00,00,00,0e,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,fd,9e,ef,20,00,31,4d,4f,4e,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Jobs]
"Order"=hex:08,00,00,00,02,00,00,00,20,0c,00,00,01,00,00,00,13,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,6e,b1,48,20,00,43,55,52,52,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Property]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,02,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,3a,cf,91,20,00,4e,45,57,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shares]
"Order"=hex:08,00,00,00,02,00,00,00,6a,02,00,00,01,00,00,00,04,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,71,67,f2,20,00,48,45,4d,53,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,1e,23,00,00,01,00,00,00,32,00,00,00,6a,00,
00,00,16,00,00,00,5c,00,31,00,00,00,00,00,00,f4,2d,6c,10,00,48,49,47,48,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\High Street]
"Order"=hex:08,00,00,00,02,00,00,00,72,02,00,00,01,00,00,00,05,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,0a,eb,c5,20,00,42,6f,6f,74,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Laptops]
"Order"=hex:08,00,00,00,02,00,00,00,b6,13,00,00,01,00,00,00,18,00,00,00,a0,00,
00,00,00,00,00,00,92,00,32,00,84,00,00,00,00,85,31,87,20,00,41,43,45,52,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,e9,29,31,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,2b,43,25,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\Shopping\Search]
"Order"=hex:08,00,00,00,02,00,00,00,dc,01,00,00,01,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,55,a0,26,20,00,47,4f,4c,44,46,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mobile phone deals]
"Order"=hex:08,00,00,00,02,00,00,00,be,10,00,00,01,00,00,00,13,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,7c,24,d9,20,00,44,49,41,4c,2d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Money\S*h*o*p*p*i*n*g* \mp3 players]
"Order"=hex:08,00,00,00,02,00,00,00,9e,09,00,00,01,00,00,00,0b,00,00,00,8c,00,
00,00,01,00,00,00,7e,00,32,00,84,00,00,00,00,f2,a6,72,20,00,41,44,56,41,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,e0,02,00,00,01,00,00,00,06,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,ac,0d,bf,10,00,45,44,55,43,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education]
"Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0a,00,00,00,74,00,
00,00,08,00,00,00,66,00,31,00,00,00,00,00,00,17,dc,dd,10,00,55,4e,49,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Education\University Pages]
"Order"=hex:08,00,00,00,02,00,00,00,d0,04,00,00,01,00,00,00,08,00,00,00,82,00,
00,00,01,00,00,00,74,00,32,00,84,00,00,00,00,23,0d,8f,20,00,49,4e,53,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Magazines]
"Order"=hex:08,00,00,00,02,00,00,00,9c,02,00,00,01,00,00,00,04,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,84,00,00,00,00,4c,16,eb,20,00,4e,4d,45,43,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News]
"Order"=hex:08,00,00,00,02,00,00,00,88,05,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,06,00,00,00,5a,00,31,00,00,00,00,00,00,6d,7e,20,10,00,4e,45,57,53,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\News\Newspapers]
"Order"=hex:08,00,00,00,02,00,00,00,4a,08,00,00,01,00,00,00,10,00,00,00,82,00,
00,00,00,00,00,00,74,00,32,00,84,00,00,00,00,a4,38,84,20,00,41,4e,4f,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\The Establishment]
"Order"=hex:08,00,00,00,02,00,00,00,3a,03,00,00,01,00,00,00,05,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,04,07,da,20,00,43,4f,4d,4d,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\News & Entertainment\Weather]
"Order"=hex:08,00,00,00,02,00,00,00,1a,03,00,00,01,00,00,00,06,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,a6,53,02,20,00,53,4b,59,57,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal]
"Order"=hex:08,00,00,00,02,00,00,00,48,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,53,75,74,10,00,43,68,75,6d,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Chums]
"Order"=hex:08,00,00,00,02,00,00,00,4a,02,00,00,01,00,00,00,04,00,00,00,9c,00,
00,00,00,00,00,00,8e,00,32,00,84,00,00,00,00,7e,97,68,20,00,4c,49,54,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01,00,00,00,0b,00,00,00,68,00,
00,00,01,00,00,00,5a,00,31,00,00,00,00,00,00,76,be,46,10,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Alphaville]
"Order"=hex:08,00,00,00,02,00,00,00,5e,06,00,00,01,00,00,00,0a,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,84,71,00,20,00,41,4c,50,48,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Hero Worship_Gallery\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,8a,00,00,00,01,00,00,00,01,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,0e,80,59,20,00,54,48,45,42,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Personal\Non Chums]
"Order"=hex:08,00,00,00,02,00,00,00,80,02,00,00,01,00,00,00,04,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,43,28,74,20,00,44,41,56,45,27,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature]
"Order"=hex:08,00,00,00,02,00,00,00,e0,00,00,00,01,00,00,00,02,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,ab,a4,66,10,00,50,61,6c,6d,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Science and Nature\Palm]
"Order"=hex:08,00,00,00,02,00,00,00,5a,01,00,00,01,00,00,00,02,00,00,00,ce,00,
00,00,00,00,00,00,c0,00,32,00,84,00,00,00,00,de,47,69,20,00,48,41,4e,44,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure]
"Order"=hex:08,00,00,00,02,00,00,00,02,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,00,00,00,00,62,00,31,00,00,00,00,00,00,e6,da,f6,10,00,41,52,54,26,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature]
"Order"=hex:08,00,00,00,02,00,00,00,2a,01,00,00,01,00,00,00,03,00,00,00,5a,00,
00,00,00,00,00,00,4c,00,31,00,00,00,00,00,00,28,ed,c6,10,00,42,6f,6f,6b,73,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Books]
"Order"=hex:08,00,00,00,02,00,00,00,48,02,00,00,01,00,00,00,03,00,00,00,d8,00,
00,00,02,00,00,00,ca,00,32,00,84,00,00,00,00,da,35,e2,20,00,5f,5f,44,49,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music]
"Order"=hex:08,00,00,00,02,00,00,00,6a,08,00,00,01,00,00,00,10,00,00,00,54,00,
00,00,00,00,00,00,46,00,31,00,00,00,00,00,00,80,9f,00,10,00,38,30,73,00,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\80s]
"Order"=hex:08,00,00,00,02,00,00,00,90,02,00,00,01,00,00,00,04,00,00,00,c8,00,
00,00,00,00,00,00,ba,00,32,00,84,00,00,00,00,fe,9a,e7,20,00,45,41,52,4c,59,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands]
"Order"=hex:08,00,00,00,02,00,00,00,f8,02,00,00,01,00,00,00,05,00,00,00,60,00,
00,00,00,00,00,00,52,00,31,00,00,00,00,00,00,9e,2e,b3,10,00,42,65,61,74,6c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Bands\Beatles]
"Order"=hex:08,00,00,00,02,00,00,00,9c,01,00,00,01,00,00,00,03,00,00,00,7e,00,
00,00,00,00,00,00,70,00,32,00,84,00,00,00,00,f6,1e,42,20,00,42,45,41,54,4c,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Festivals]
"Order"=hex:08,00,00,00,02,00,00,00,c0,00,00,00,01,00,00,00,01,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,65,3b,0e,20,00,47,4c,41,53,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Lyrics]
"Order"=hex:08,00,00,00,02,00,00,00,e2,02,00,00,01,00,00,00,05,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,1b,46,de,20,00,44,45,4e,4e,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Mashups]
"Order"=hex:08,00,00,00,02,00,00,00,98,02,00,00,01,00,00,00,04,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,4e,be,9b,20,00,4d,41,53,48,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\Music\Sounds]
"Order"=hex:08,00,00,00,02,00,00,00,ac,01,00,00,01,00,00,00,03,00,00,00,78,00,
00,00,00,00,00,00,6a,00,32,00,84,00,00,00,00,fa,16,12,20,00,53,4f,55,4e,44,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,42,04,00,00,01,00,00,00,08,00,00,00,5e,00,
00,00,02,00,00,00,50,00,31,00,00,00,00,00,00,c3,f6,40,10,00,48,65,72,6f,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Heroes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Art&Literature\The Gallery\Most Attractive Ladies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Kayakattack]
"Order"=hex:08,00,00,00,02,00,00,00,04,03,00,00,01,00,00,00,05,00,00,00,ba,00,
00,00,00,00,00,00,ac,00,32,00,84,00,00,00,00,7b,9a,ac,20,00,41,43,43,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music]
"Order"=hex:08,00,00,00,02,00,00,00,dc,0c,00,00,01,00,00,00,16,00,00,00,60,00,
00,00,0f,00,00,00,52,00,31,00,00,00,00,00,00,60,84,cb,10,00,55,6b,75,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Music\Ukulele]
"Order"=hex:08,00,00,00,02,00,00,00,fe,01,00,00,01,00,00,00,02,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,51,fa,91,20,00,54,48,45,55,4b,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport]
"Order"=hex:08,00,00,00,02,00,00,00,ee,01,00,00,01,00,00,00,04,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,f3,81,76,10,00,46,6f,6f,74,62,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football]
"Order"=hex:08,00,00,00,02,00,00,00,aa,03,00,00,01,00,00,00,07,00,00,00,80,00,
00,00,01,00,00,00,72,00,31,00,00,00,00,00,00,fb,8d,f1,10,00,45,55,52,4f,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\European Championships]
"Order"=hex:08,00,00,00,02,00,00,00,0c,01,00,00,01,00,00,00,02,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,07,b1,36,20,00,43,48,41,4d,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Fantasy Football]
"Order"=hex:08,00,00,00,02,00,00,00,a2,00,00,00,01,00,00,00,01,00,00,00,96,00,
00,00,00,00,00,00,88,00,32,00,84,00,00,00,00,a1,9d,bc,20,00,54,48,45,4f,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\FC]
"Order"=hex:08,00,00,00,02,00,00,00,72,04,00,00,01,00,00,00,08,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,8c,35,2c,20,00,43,45,4c,54,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Football Latest]
"Order"=hex:08,00,00,00,02,00,00,00,1a,07,00,00,01,00,00,00,0d,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,8e,bb,67,20,00,43,6c,75,62,63,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information]
"Order"=hex:08,00,00,00,02,00,00,00,38,0f,00,00,01,00,00,00,1b,00,00,00,5e,00,
00,00,05,00,00,00,50,00,31,00,00,00,00,00,00,ae,1e,de,10,00,45,75,72,6f,39,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Football\Information\Euro96]
"Order"=hex:08,00,00,00,02,00,00,00,40,05,00,00,01,00,00,00,09,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,83,54,c3,20,00,23,53,4f,43,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\Motor Racing]
"Order"=hex:08,00,00,00,02,00,00,00,90,0b,00,00,01,00,00,00,15,00,00,00,8e,00,
00,00,00,00,00,00,80,00,32,00,84,00,00,00,00,1e,fb,5e,20,00,42,4c,4f,4f,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\Sport\OtherSport]
"Order"=hex:08,00,00,00,02,00,00,00,e4,00,00,00,01,00,00,00,01,00,00,00,d8,00,
00,00,00,00,00,00,ca,00,32,00,84,00,00,00,00,b4,55,2f,20,00,44,41,52,54,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio]
"Order"=hex:08,00,00,00,02,00,00,00,84,0b,00,00,01,00,00,00,14,00,00,00,72,00,
00,00,09,00,00,00,64,00,31,00,00,00,00,00,00,0e,4d,1a,10,00,50,41,53,54,50,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\Past Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,be,04,00,00,01,00,00,00,08,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,8d,95,69,20,00,44,55,4b,45,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide]
"Order"=hex:08,00,00,00,02,00,00,00,7e,04,00,00,01,00,00,00,08,00,00,00,64,00,
00,00,00,00,00,00,56,00,31,00,00,00,00,00,00,bd,e2,7b,10,00,43,68,61,6e,6e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Channels]
"Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,4f,4a,fe,20,00,43,48,41,4e,4e,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Movies]
"Order"=hex:08,00,00,00,02,00,00,00,d0,03,00,00,01,00,00,00,06,00,00,00,b6,00,
00,00,00,00,00,00,a8,00,32,00,84,00,00,00,00,17,c9,4a,20,00,42,45,41,56,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Programmes]
"Order"=hex:08,00,00,00,02,00,00,00,d2,02,00,00,01,00,00,00,05,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,1e,68,3f,20,00,53,4b,59,31,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Satellite]
"Order"=hex:08,00,00,00,02,00,00,00,0c,07,00,00,01,00,00,00,0e,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,32,42,c2,20,00,50,41,42,52,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Sport & Leisure\TV & Radio\TV Guide\Soaps]
"Order"=hex:08,00,00,00,02,00,00,00,4e,02,00,00,01,00,00,00,04,00,00,00,74,00,
00,00,01,00,00,00,66,00,32,00,84,00,00,00,00,eb,e7,a0,20,00,45,41,53,54,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia]
"Order"=hex:08,00,00,00,02,00,00,00,08,07,00,00,01,00,00,00,0c,00,00,00,66,00,
00,00,02,00,00,00,58,00,31,00,00,00,00,00,00,1b,35,77,10,00,46,55,4e,26,47,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Fun&Games]
"Order"=hex:08,00,00,00,02,00,00,00,c2,03,00,00,01,00,00,00,06,00,00,00,74,00,
00,00,00,00,00,00,66,00,32,00,84,00,00,00,00,df,cf,2b,20,00,43,52,45,41,54,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Gallery]
"Order"=hex:08,00,00,00,02,00,00,00,76,08,00,00,01,00,00,00,0e,00,00,00,ae,00,
00,00,00,00,00,00,a0,00,32,00,84,00,00,00,00,04,aa,4f,20,00,41,4c,27,53,26,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Jokes]
"Order"=hex:08,00,00,00,02,00,00,00,8c,00,00,00,01,00,00,00,01,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,d7,0c,a9,20,00,49,4e,53,54,52,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling]
"Order"=hex:08,00,00,00,02,00,00,00,08,05,00,00,01,00,00,00,09,00,00,00,6c,00,
00,00,07,00,00,00,5e,00,31,00,00,00,00,00,00,0e,87,ae,10,00,56,49,52,55,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Smashmarks\Trivia\Net Trawling\Virus Hoaxes]
"Order"=hex:08,00,00,00,02,00,00,00,ca,03,00,00,01,00,00,00,06,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,c7,cf,65,20,00,43,49,41,43,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support]
"Order"=hex:08,00,00,00,02,00,00,00,74,13,00,00,01,00,00,00,20,00,00,00,5a,00,
00,00,01,00,00,00,4c,00,31,00,00,00,00,00,00,20,a8,6b,10,00,41,70,70,6c,65,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Apple]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0d,00,00,00,d2,00,
00,00,00,00,00,00,c4,00,32,00,84,00,00,00,00,60,26,9f,20,00,41,4d,41,5a,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Converting movie files]
"Order"=hex:08,00,00,00,02,00,00,00,cc,02,00,00,01,00,00,00,04,00,00,00,b4,00,
00,00,00,00,00,00,a6,00,32,00,84,00,00,00,00,04,b9,92,20,00,43,4f,4e,56,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\eBay]
"Order"=hex:08,00,00,00,02,00,00,00,c8,01,00,00,01,00,00,00,03,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,84,00,00,00,00,48,a0,e0,20,00,4b,4e,4f,57,49,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Free Web Hosting]
"Order"=hex:08,00,00,00,02,00,00,00,56,08,00,00,01,00,00,00,0b,00,00,00,ac,00,
00,00,00,00,00,00,9e,00,32,00,84,00,00,00,00,06,f1,79,20,00,46,52,45,45,57,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Humax]
"Order"=hex:08,00,00,00,02,00,00,00,4a,05,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,37,a0,d8,20,00,43,4f,4d,50,55,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\netgear]
"Order"=hex:08,00,00,00,02,00,00,00,a4,04,00,00,01,00,00,00,07,00,00,00,9a,00,
00,00,00,00,00,00,8c,00,32,00,84,00,00,00,00,2a,ee,c9,20,00,4e,45,38,45,34,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Open Source Software]
"Order"=hex:08,00,00,00,02,00,00,00,fe,06,00,00,01,00,00,00,08,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,9c,19,dd,20,00,41,53,48,41,4d,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Support\Training]
"Order"=hex:08,00,00,00,02,00,00,00,be,00,00,00,01,00,00,00,01,00,00,00,b2,00,
00,00,00,00,00,00,a4,00,32,00,84,00,00,00,00,e4,84,12,20,00,44,55,4c,45,41,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \TV]
"Order"=hex:08,00,00,00,02,00,00,00,02,07,00,00,01,00,00,00,0f,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,6a,39,f4,20,00,41,54,44,48,45,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful]
"Order"=hex:08,00,00,00,02,00,00,00,fe,29,00,00,01,00,00,00,3f,00,00,00,58,00,
00,00,12,00,00,00,4a,00,31,00,00,00,00,00,00,a1,7a,44,10,00,48,54,4d,4c,00,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\HTML]
"Order"=hex:08,00,00,00,02,00,00,00,e6,0e,00,00,01,00,00,00,17,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,f8,f5,28,20,00,43,4f,4d,50,4f,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search]
"Order"=hex:08,00,00,00,02,00,00,00,fa,06,00,00,01,00,00,00,0f,00,00,00,6a,00,
00,00,02,00,00,00,5c,00,31,00,00,00,00,00,00,ef,be,e5,10,00,44,49,52,45,43,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Search\Directories]
"Order"=hex:08,00,00,00,02,00,00,00,16,0a,00,00,01,00,00,00,14,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,4a,8c,b5,20,00,42,45,4c,4c,53,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\Solver]
"Order"=hex:08,00,00,00,02,00,00,00,1e,01,00,00,01,00,00,00,02,00,00,00,86,00,
00,00,00,00,00,00,78,00,32,00,84,00,00,00,00,bb,41,e3,20,00,53,43,52,41,42,\
.
[HKEY_USERS\S-1-5-21-3601973650-2986336825-1597242432-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\S*m*a*s*h*T*V* \Useful\URL redirectors]
"Order"=hex:08,00,00,00,02,00,00,00,8e,11,00,00,01,00,00,00,16,00,00,00,94,00,
00,00,00,00,00,00,86,00,32,00,84,00,00,00,00,55,d3,79,20,00,41,4c,49,53,4f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(1284)
c:\users\Smash\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2011-07-27 20:42:12
ComboFix-quarantined-files.txt 2011-07-27 19:42
ComboFix2.txt 2011-07-21 12:15
ComboFix3.txt 2011-07-20 10:41
ComboFix4.txt 2011-07-19 15:23
ComboFix5.txt 2011-07-27 19:28
.
Pre-Run: 5,343,727,616 bytes free
Post-Run: 5,194,002,432 bytes free
.
- - End Of File - - 90D9C7753BD71CEF5C02DC04996559AB


----------



## Smasher (Jul 13, 2011)

Damn, I ran it before I saw this post... what shall I do? Check for cracks and keygens and run it again?

And thank you so much for your tirelessness.


----------



## kevinf80 (Mar 21, 2006)

Continue as follows please :-

*Upload a File to Virustotal*
Please visit *Virustotal*

 Click the *Browse...* button
 Navigate to the file *c:\windows\System32\flvDX.dll*
 Click the *Open* button
 Click the *Send* button
 If you get a message saying File has already been analyzed: click Reanalyze file now
 Copy and paste the results back here please.
 Repeat the above steps for the following files

*c:\windows\System32\msfDX.dll
c:\windows\System32\nbDX.dll*

Post back with the results from VirusTotal, also tell me are you using an Anti-Virus program?

Kevin


----------



## Smasher (Jul 13, 2011)

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: flvDX.dll
Submission date: 2011-07-28 17:17:00 (UTC)
Current status: finished
Result: 6/ 43 (14.0%)
VT Community

not reviewed
Safety score: - 
Compact
Print results 
Antivirus	Version	Last Update	Result
AhnLab-V3	2011.07.28.00	2011.07.27	-
AntiVir	7.11.12.159	2011.07.28	-
Antiy-AVL	2.0.3.7	2011.07.28	-
Avast	4.8.1351.0	2011.07.28	-
Avast5	5.0.677.0	2011.07.28	-
AVG	10.0.0.1190	2011.07.28	Suspicion: unknown virus
BitDefender	7.2	2011.07.28	-
CAT-QuickHeal	11.00	2011.07.28	-
ClamAV	0.97.0.0	2011.07.28	-
Commtouch	5.3.2.6	2011.07.28	W32/Heuristic-MU2!Eldorado
Comodo	9544	2011.07.28	Heur.Corrupt.PE
DrWeb	5.0.2.03300	2011.07.28	-
Emsisoft	5.1.0.8	2011.07.28	-
eSafe	7.0.17.0	2011.07.27	-
eTrust-Vet	36.1.8469	2011.07.28	-
F-Prot	4.6.2.117	2011.07.28	W32/Heuristic-MU2!Eldorado
F-Secure	9.0.16440.0	2011.07.28	-
Fortinet	4.2.257.0	2011.07.28	-
GData	22	2011.07.28	-
Ikarus	T3.1.1.104.0	2011.07.28	-
Jiangmin	13.0.900	2011.07.28	-
K7AntiVirus	9.109.4957	2011.07.28	-
Kaspersky	9.0.0.837	2011.07.28	-
McAfee	5.400.0.1158	2011.07.28	Corrupt-AG!67929D45455F
McAfee-GW-Edition	2010.1D	2011.07.28	-
Microsoft	1.7104	2011.07.28	-
NOD32	6332	2011.07.28	-
Norman	6.07.10	2011.07.28	-
nProtect	2011-07-28.04	2011.07.28	-
Panda	10.0.3.5	2011.07.28	-
PCTools	8.0.0.5	2011.07.28	-
Prevx	3.0	2011.07.28	-
Rising	23.68.02.03	2011.07.27	-
Sophos	4.67.0	2011.07.28	-
SUPERAntiSpyware	4.40.0.1006	2011.07.28	-
Symantec	20111.1.0.186	2011.07.28	-
TheHacker	6.7.0.1.264	2011.07.28	W32/Behav-Heuristic-CorruptFile-EP
TrendMicro	9.200.0.1012	2011.07.28	-
TrendMicro-HouseCall	9.200.0.1012	2011.07.28	-
VBA32	3.12.16.4	2011.07.28	-
VIPRE	9992	2011.07.28	-
ViRobot	2011.7.28.4593	2011.07.28	-
VirusBuster	14.0.144.0	2011.07.28	-
Additional informationShow all
MD5 : 8453687a045c926f0291301ebaf50370
SHA1 : 8d756345c945b75ef63314fa8992f1b582067ff3
SHA256: 151afe783864d2fcbe6f954d1aef0cb1a157ae41848e2f0478217cddaad61967
ssdeep: 3072:91gwAEW0tqtON2BemdVhxcFtNSrL70RU5PK:9CwvW0tqtONy0t4/7B5K
File size : 163328 bytes
First seen: 2007-04-15 23:30:53
Last seen : 2011-07-28 17:17:00
TrID: 
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck: 
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x6BF60
timedatestamp....: 0x445872AE (Wed May 03 09:06:54 2006)
machinetype......: 0x14c (I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
UPX0, 0x1000, 0x44000, 0x0, 0.00, d41d8cd98f00b204e9800998ecf8427e
UPX1, 0x45000, 0x28000, 0x27200, 7.91, 04726340e86271cf5dade6fe1f2bf870
.rsrc, 0x6D000, 0x1000, 0x800, 0.00, d41d8cd98f00b204e9800998ecf8427e
ExifTool: 
file metadata
CodeSize: 163840
EntryPoint: 0x6bf60
FileSize: 100 kB
FileType: Win32 DLL
ImageVersion: 0.0
InitializedDataSize: 4096
LinkerVersion: 8.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2006:05:03 11:06:54+02:00
UninitializedDataSize: 278528
Warning: Error processing PE data dictionary
Symantec reputation:Suspicious.Insight
VT Community
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team


----------



## Smasher (Jul 13, 2011)

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: msfDX.dll
Submission date: 2011-07-28 17:19:58 (UTC)
Current status: finished
Result: 2/ 43 (4.7%)
VT Community

not reviewed
Safety score: - 
Compact
Print results 
Antivirus	Version	Last Update	Result
AhnLab-V3	2011.07.28.00	2011.07.27	-
AntiVir	7.11.12.159	2011.07.28	-
Antiy-AVL	2.0.3.7	2011.07.28	-
Avast	4.8.1351.0	2011.07.28	-
Avast5	5.0.677.0	2011.07.28	-
AVG	10.0.0.1190	2011.07.28	-
BitDefender	7.2	2011.07.28	-
CAT-QuickHeal	11.00	2011.07.28	-
ClamAV	0.97.0.0	2011.07.28	PUA.Packed.PECompact-1
Commtouch	5.3.2.6	2011.07.28	-
Comodo	9544	2011.07.28	-
DrWeb	5.0.2.03300	2011.07.28	-
Emsisoft	5.1.0.8	2011.07.28	-
eSafe	7.0.17.0	2011.07.27	Suspicious File
eTrust-Vet	36.1.8469	2011.07.28	-
F-Prot	4.6.2.117	2011.07.28	-
F-Secure	9.0.16440.0	2011.07.28	-
Fortinet	4.2.257.0	2011.07.28	-
GData	22	2011.07.28	-
Ikarus	T3.1.1.104.0	2011.07.28	-
Jiangmin	13.0.900	2011.07.28	-
K7AntiVirus	9.109.4957	2011.07.28	-
Kaspersky	9.0.0.837	2011.07.28	-
McAfee	5.400.0.1158	2011.07.28	-
McAfee-GW-Edition	2010.1D	2011.07.28	-
Microsoft	1.7104	2011.07.28	-
NOD32	6332	2011.07.28	-
Norman	6.07.10	2011.07.28	-
nProtect	2011-07-28.04	2011.07.28	-
Panda	10.0.3.5	2011.07.28	-
PCTools	8.0.0.5	2011.07.28	-
Prevx	3.0	2011.07.28	-
Rising	23.68.02.03	2011.07.27	-
Sophos	4.67.0	2011.07.28	-
SUPERAntiSpyware	4.40.0.1006	2011.07.28	-
Symantec	20111.1.0.186	2011.07.28	-
TheHacker	6.7.0.1.264	2011.07.28	-
TrendMicro	9.200.0.1012	2011.07.28	-
TrendMicro-HouseCall	9.200.0.1012	2011.07.28	-
VBA32	3.12.16.4	2011.07.28	-
VIPRE	9992	2011.07.28	-
ViRobot	2011.7.28.4593	2011.07.28	-
VirusBuster	14.0.144.0	2011.07.28	-
Additional informationShow all
MD5 : 21d8f42d54598b73c2e1a9571399113b
SHA1 : ed711faa61fdd6d53eacc7a99d60d95dd9137a7d
SHA256: 992e23bddfa1eaaf66cc7ccbef23596be5d2b47aa6a8272028092b4829bde784
ssdeep: 768:Cn1nHSwfnflO/a7ubx6dIN5OKVfNqW190LwiuO:C5yAf6a7EuKtN990L
File size : 31232 bytes
First seen: 2007-06-18 18:39:15
Last seen : 2011-07-28 17:19:58
TrID: 
Win32 EXE PECompact compressed (v2.x) (48.9%)
Win32 EXE PECompact compressed (generic) (34.4%)
Win32 Executable Generic (7.0%)
Win32 Dynamic Link Library (generic) (6.2%)
Generic Win/DOS Executable (1.6%)
sigcheck: 
publisher....: Hans Mayerl
copyright....: n/a
product......: msfDX.dll
description..: msfDX.dll
original name: msfDX.dll
internal name: msfDX.dll
file version.: 2.02.2113
comments.....: MOV Source Filter
signers......: -
signing date.: -
verified.....: Unsigned
PEiD: PECompact 2.xx --> BitSum Technologies
packers (F-Prot): PecBundle, PECompact
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x47C0
timedatestamp....: 0x3F8E4348 (Thu Oct 16 07:05:44 2003)
machinetype......: 0x14c (I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x14000, 0x5E00, 7.96, 2c3b58f66566a8e664c8ea4a5a891296
.rsrc, 0x15000, 0x2000, 0x1600, 6.84, 345310e90c13175c817748d5d69715bf
.reloc, 0x17000, 0x1000, 0x200, 0.22, 3bea04e909f4f9d16cc848d4a6c601f5

[[ 6 import(s) ]]
kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
MSVCRT.dll: _CxxThrowException
ADVAPI32.dll: RegCreateKeyExA
USER32.dll: SetRectEmpty
GDI32.dll: CreateDCA
ole32.dll: CoInitialize

[[ 4 export(s) ]]
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
ExifTool: 
file metadata
CharacterSet: Unicode
CodeSize: 40960
Comments: MOV Source Filter
CompanyName: Hans Mayerl
EntryPoint: 0x47c0
FileDescription: msfDX.dll
FileFlagsMask: 0x003f
FileOS: Windows NT 32-bit
FileSize: 30 kB
FileSubtype: 0
FileType: Win32 DLL
FileVersion: 2.02.2113
FileVersionNumber: 2.0.2.2113
ImageVersion: 0.0
InitializedDataSize: 40960
InternalName: msfDX.dll
LanguageCode: English (U.S.)
LegalTrademarks: 
LinkerVersion: 6.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
ObjectFileType: Dynamic link library
OriginalFilename: msfDX.dll
PEType: PE32
PrivateBuild: 
ProductName: msfDX.dll
ProductVersion: 2.02.2113
ProductVersionNumber: 2.0.2.2113
SpecialBuild: built for SUPER 
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2003:10:16 09:05:44+02:00
UninitializedDataSize: 0
Symantec reputation:Suspicious.Insight
VT Community
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team


----------



## Smasher (Jul 13, 2011)

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: nbDX.dll
Submission date: 2011-07-28 17:32:16 (UTC)
Current status: finished
Result: 4/ 43 (9.3%)
VT Community

not reviewed
Safety score: - 
Compact
Print results 
Antivirus	Version	Last Update	Result
AhnLab-V3	2011.07.28.00	2011.07.27	-
AntiVir	7.11.12.159	2011.07.28	-
Antiy-AVL	2.0.3.7	2011.07.28	-
Avast	4.8.1351.0	2011.07.28	-
Avast5	5.0.677.0	2011.07.28	-
AVG	10.0.0.1190	2011.07.28	Suspicion: unknown virus
BitDefender	7.2	2011.07.28	-
CAT-QuickHeal	11.00	2011.07.28	-
ClamAV	0.97.0.0	2011.07.28	PUA.Packed.PECompact-1
Commtouch	5.3.2.6	2011.07.28	-
Comodo	9544	2011.07.28	-
DrWeb	5.0.2.03300	2011.07.28	-
Emsisoft	5.1.0.8	2011.07.28	-
eSafe	7.0.17.0	2011.07.27	-
eTrust-Vet	36.1.8469	2011.07.28	-
F-Prot	4.6.2.117	2011.07.28	-
F-Secure	9.0.16440.0	2011.07.28	-
Fortinet	4.2.257.0	2011.07.28	-
GData	22	2011.07.28	-
Ikarus	T3.1.1.104.0	2011.07.28	-
Jiangmin	13.0.900	2011.07.28	-
K7AntiVirus	9.109.4957	2011.07.28	-
Kaspersky	9.0.0.837	2011.07.28	-
McAfee	5.400.0.1158	2011.07.28	-
McAfee-GW-Edition	2010.1D	2011.07.28	Heuristic.LooksLike.Win32.Suspicious.C!81
Microsoft	1.7104	2011.07.28	-
NOD32	6332	2011.07.28	-
Norman	6.07.10	2011.07.28	-
nProtect	2011-07-28.04	2011.07.28	-
Panda	10.0.3.5	2011.07.28	-
PCTools	8.0.0.5	2011.07.28	-
Prevx	3.0	2011.07.28	-
Rising	23.68.02.03	2011.07.27	Suspicious
Sophos	4.67.0	2011.07.28	-
SUPERAntiSpyware	4.40.0.1006	2011.07.28	-
Symantec	20111.1.0.186	2011.07.28	-
TheHacker	6.7.0.1.264	2011.07.28	-
TrendMicro	9.200.0.1012	2011.07.28	-
TrendMicro-HouseCall	9.200.0.1012	2011.07.28	-
VBA32	3.12.16.4	2011.07.28	-
VIPRE	9992	2011.07.28	-
ViRobot	2011.7.28.4593	2011.07.28	-
VirusBuster	14.0.144.0	2011.07.28	-
Additional informationShow all
MD5 : e4b6b932b6e5ce386627ceea2a0a0f4c
SHA1 : b9bcaae7bb27161148e1301fc8d8cd3f568c6e22
SHA256: a0f6231d8f48d8579be4275b95425f80cc5f703730f5f5e9f5b8748a813282f6
ssdeep: 3072:nEDLgZHv3oCeq/1ogvzUyfy7fG9dwENibN4:auoML/fwfGnrNibN4
File size : 216064 bytes
First seen: 2009-02-08 12:12:18
Last seen : 2011-07-28 17:32:16
TrID: 
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck: 
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0xE540
timedatestamp....: 0x47DD210D (Sun Mar 16 13:30:53 2008)
machinetype......: 0x14c (I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0xAB000, 0x32E00, 8.00, 58e8261bba3ccc25b2ea394d31653cb6
.rsrc, 0xAC000, 0x2000, 0x1800, 0.00, d41d8cd98f00b204e9800998ecf8427e
.reloc, 0xAE000, 0x1000, 0x200, 0.00, d41d8cd98f00b204e9800998ecf8427e
ExifTool: 
file metadata
CodeSize: 286720
EntryPoint: 0xe540
FileSize: 100 kB
FileType: Win32 DLL
ImageVersion: 0.0
InitializedDataSize: 397312
LinkerVersion: 8.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2008:03:16 14:30:53+01:00
UninitializedDataSize: 0
Warning: Error processing PE data dictionary
Symantec reputation:Suspicious.Insight
VT Community
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team


----------



## Smasher (Jul 13, 2011)

I am not currently using an antivirus program. I think I have windows defender but I switched off the real time protection, as per one set of instructions. I have the icon for Immunet Protect [from google pack] but when I did the last ComboFix I definitely killed the process for it.

I did have PC Tools Spyware and Anti Virus but this virus just killed it so i tried to uninstall it to install something else but it went horribly wrong. I then tried to install Immunet but it was such a mess by then I just keep killing it if I think it starts.

As far as I am aware I am not running anything - so I've not been using this computer other than to try and sort out this problem with you.

I hope that makes sense. You probaby know more than me about it from all these log files!


----------



## kevinf80 (Mar 21, 2006)

Continue as follows :-

*Step 1*

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the Codebox below into it:


```
KillAll::
File::
c:\windows\System32\flvDX.dll
c:\windows\System32\msfDX.dll
c:\windows\System32\nbDX.dll
c:\users\smash\wuaucldt.exe
c:\users\Smash\AppData\Roaming\winshfhca.exe
c:\users\Smash\AppData\Local\Temp\Dd1.exe
c:\windows\system32\drivers\PCTCore.sys
c:\windows\system32\DRIVERS\ImmunetProtect.sys
c:\windows\system32\DRIVE RS\ImmunetSelfProtect.sys
Driver::
PCTCore
ImmunetProtectDriver
ImmunetSelfProtectDriver
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\syncman]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntwhoc]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EBUNWVLUMV]
```
Save this as *CFScript.txt*, and as Type: *All Files* *(*.*)* in the same location as ComboFix.exe



















Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt* which I will require in your next reply.

*Step 2*

To keep safe when online you need a good *Antivirus/Antspyware/Antimalware/Anti-Rootkit* combination application. *Microsoft Security Essentials* covers all of those bases, but better still it is free. Go *Here* and hit the "Download it free today" tab, follow the prompts. Once installed it will want to update and carry out a quick scan, allow that to happen. Let me know if it finds anything.

Go *Here* for information that will show you how to install and use MSE.

Let me see the log from Combofix in your reply, also tell me if MSE finds anything, it does not produce a log as such, you can check under the history tab from the main interface...

Kevin


----------



## kevinf80 (Mar 21, 2006)

You still with us smasher?


----------



## Smasher (Jul 13, 2011)

Step 1. Uninstalled Immunet properly and I used the copy of ComboFix on my desktop this time. I created the *.* text file 'CFScript.txt'. Closed everything. Went into processes and shut down everything that wasn't essential.

Dragged the txt file onto ComboFix.

ComboFix needed to get itself updated.

I clicked yes and carried on.

Currently going through the 'Completed Stage_1,2,3,etc etc'
...


----------



## Smasher (Jul 13, 2011)

Rebooting Windows... please wait


----------



## Smasher (Jul 13, 2011)

Sorry. Just saw your 'Still With Us?' message...  Apologies.

The reboot took me to some start up recovery options, so I cancelled it and then it asked if I wanted to reboot, so I said yes.

But it just brings me back to the Launch Start Up repair [recommended]

So this second time I've selected to start windows 'Normally'

Not sure if that was the right thing to do?


----------



## Smasher (Jul 13, 2011)

No it wont let me. It gives me to two options to boot up.

Launch Startup Repair [recommended]
Start Windows Normally

And if I select the second option it takes me back to this screen. So I select Startup Repair...

...and it brings me back to the System Recovery Options dialogue box - I know have to select a keyboard input method.

United Kingdom <Next>

I now have to choose a user name - only two available...
HomeGroupUser$
Smash

I select 'Smash'

I input my desktop password
<OK>

Choose a recovery tool?!


----------



## Smasher (Jul 13, 2011)

My options are:
Startup Repair
System Restore
System Image Recovery
Windows Memory Diagnostic
Command Prompt


----------



## Smasher (Jul 13, 2011)

I'll await your instructions before trying anything and going on to Step 2


----------



## kevinf80 (Mar 21, 2006)

Use startup repair, let me know how it goes. Also do you have your installation DVD?

kEVIN


----------



## Smasher (Jul 13, 2011)

No I don't. I do have one to hand but it's not for the infected machine - I used it to install the original OS and it flagged up as non-genuine. A friend of mine then installed the OS and I don't have access to his discs.

This isn't looking good is it?


----------



## Smasher (Jul 13, 2011)

Startup repair seems to have got me going again...


----------



## Smasher (Jul 13, 2011)

Bolx. I've just rung my friend - who installed the laptop [the infected one] with the OS to ask about the DVD he used to install it. Apparently, he did use the disc that came with this other laptop I'm using but he said that he had to 'tweak' it to get it working!!! Whatever that really means[?] But what I now am horribly coming to realise is that, while I have the discs and own the OS, it is not a 'genuine' installation on the infected laptop.

I am so sorry, I can only imagine that this is the reason I've been infected and probably invalidates everything you've been doing?

Does this mean I should stop wasting your precious time and find a genuine copy and start again? I feel like such an idiot. Such an idiot.

Mea culpa


----------



## kevinf80 (Mar 21, 2006)

Forum policy is no help with none genuine systems......Mea maxima culpa


----------



## Smasher (Jul 13, 2011)

Kevin, I am so sorry. Thank you for taking me this far. I am partly relieved cos I know exactly what I have to do now. Buy the cheapest copy of W7 I can afford!

Or dig out my old XP discs.

Again, thank you so much for your help. I am so sorry to have wasted your time.


----------



## Smasher (Jul 13, 2011)

If you know of any where that does a good deal on W7 please do forward. Thanks Kevin.


----------



## kevinf80 (Mar 21, 2006)

It was never a waste of time for me, shame it was a cracked version of windows. Not sure where to get the cheapest version of W7, maybe Google will have the answer for you.

Take care,

Kevin


----------



## Smasher (Jul 13, 2011)

Well, thank you for everything. I'm going to class the machine as temporarily dead for the moment. I'm so disappointed. Thought everything was OK and didn't even think. Lesson's learned.

Thank you for your patience and I think I have to press 'Mark Solved' so I shall do that to close this off.

Kevin, you've been wonderful.

Smash


----------

