Eddy
4
==========================================================================
THESE ITEMS SHOULD BE REMOVED:
\windows\system32\slserv.exe
r1 - hkcu\software\microsoft\internet explorer,search = http://thenewsearch.com/search.html
r1 - hkcu\software\microsoft\internet explorer,searchurl = http://thenewsearch.com/search.html
r1 - hklm\software\microsoft\internet explorer,search = http://thenewsearch.com/search.html
r1 - hklm\software\microsoft\internet explorer,searchurl = http://thenewsearch.com/search.html
r1 - hkcu\software\microsoft\internet explorer\main,default_search_url = http://thenewsearch.com/search.html
r1 - hkcu\software\microsoft\internet explorer\main,search bar = http://thenewsearch.com/search.html
r1 - hkcu\software\microsoft\internet explorer\main,search page = http://thenewsearch.com/search.html
r0 - hkcu\software\microsoft\internet explorer\main,start page = http://thenewsearch.com/thenewsearch.html
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://thenewsearch.com/search.html
r1 - hklm\software\microsoft\internet explorer\main,search bar = http://thenewsearch.com/search.html
r1 - hklm\software\microsoft\internet explorer\main,search page = http://thenewsearch.com/search.html
r0 - hklm\software\microsoft\internet explorer\main,start page = http://thenewsearch.com/thenewsearch.html
r1 - hkcu\software\microsoft\internet explorer\search,searchassistant = http://thenewsearch.com/search.html
r1 - hkcu\software\microsoft\internet explorer\search,customizesearch = http://thenewsearch.com/search.html
r0 - hklm\software\microsoft\internet explorer\search,searchassistant = http://thenewsearch.com/search.html
r0 - hklm\software\microsoft\internet explorer\search,customizesearch = http://thenewsearch.com/search.html
o1 - hosts: 69.50.173.250 auto.search.msn.com
o1 - hosts: 69.50.173.250 auto.search.msn.com
o4 - hklm..\run: [winupd] c:\windows\system32\winupd.exe
==========================================================================
THESE ITEMS ARE NOT NEEDED TO LOAD AT BOOTTIME FOR
THE SYSTEM TO WORK, IT IS RECOMMENDED TO REMOVE THEM:
o4 - hklm..\run: [share-to-web namespace daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe
o4 - hkcu..\run: [msmsgs] “c:\program files\messenger\msmsgs.exe” /background
o4 - global startup: microsoft office.lnk = c:\program files\microsoft office\office10\osa.exe
o9 - extra button: real.com - {cd67f990-d8e9-11d2-98fe-00c0f0318afe} - c:\windows\system32\shdocvw.dll