27

O18 - Protocol hijack: tv - {9E754710-6158-11D5-B6CE-0050DAAEA668}

This entry should be {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E}

http://www.castlecops.com/o18list-65.html

The entry you have could be Wareout malware:

http://www.castlecops.com/o18list-99.html

There’s a removal tool here:

http://downloads.subratam.org/Fixwareout.exe

The HijackThis! analysis shows the other 018 entries as safe, except for this one:

O18 - Protocol hijack: mctp - {D7B95390-B1C5-11D0-B111-0080C712FE82}

I can’t find any information on this.

HijackThis! could just be indicating that the other entries have been changed. To check, I suggest you upload mshtml.dll to VirusTotal.

So you need to:

  1. Run FixWareout and see what it says.
  2. Edit this key in regedit as described above if FixWareout doesn’t fix it:
    O18 - Protocol hijack: tv - {9E754710-6158-11D5-B6CE-0050DAAEA668}
  3. Check mshtml.dll at VirusTotal
  4. Find out what this entry is and if it’s bad:
    O18 - Protocol hijack: mctp - {D7B95390-B1C5-11D0-B111-0080C712FE82}

Maybe somebody else can help with the last one. ???