Python 2.5.2

• slimshell.dll added to Windows Explorer under the name 'SlimShellExt' with a class of {5421BDAF-6C45-4C3A-8B4B-AE5AF31A65AF}.
• slimshell64.dll added to Windows Explorer under the name 'SlimShellExt' with a class of {5421BDAF-6C45-4C3A-8B4B-AE5AF31A65AF}.

• npflplugins.dll is loaded in the Google Chrome web browser as 'npFlPluginS.dll'.
• npvirtools.dll is loaded in the Google Chrome web browser as 'npvirtools.dll'.
• npswf32.dll is loaded in the Google Chrome web browser as 'NPSWF32.dll'.
• npdjvu.dll is loaded in the Google Chrome web browser as 'npdjvu.dll'.

• adblockplus32.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Adblock Plus for IE Browser Helper Object' with the class of {FFCB3198-32F3-4E8B-9539-4324694ED664}.
• wot.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'WOT Helper' with the class of {C920E44A-7F78-4E64-BDD7-A57026E7FEB7}.
• msneshellx.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Microsoft Live Search Toolbar Helper' with the class of {d2ce3e00-f94a-4740-988e-03dc2f38c34f}.

• wot.dll is loaded as Internet Explorer Toolbar with the name 'WOT' with the class of {71576546-354D-41c9-AAE8-31F2EC22BF0D}.
• msneshellx.dll is loaded as Internet Explorer Toolbar with the name 'Microsoft Live Search Toolbar' with the class of {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414}.

• wot.dll installs an IE Web Browser in Internet Explorer named 'WOT' with a class of {71576546-354D-41C9-AAE8-31F2EC22BF0D}.

• npswf32.dll is loaded into Mozilla Firefox under the product name 'Adobe Flash Player 10.1 Plugino' with a plugin key of '@adobe.com/FlashPlayer' for all users of the PC.
• npflplugins.dll is loaded into Mozilla Firefox under the product name 'FileLab Plugin' with a plugin key of '@ASC/FileLabPlugin;version=1.1.33' for all users of the PC.
• npvirtools.dll is loaded into Mozilla Firefox under the product name '3DVIA player 5.0' with a plugin key of '@virtools.com/3DviaPlayer' for all users of the PC.

• slimcleaner.exe is scheduled as a task with the class '{8CF669A5-0690-4EF4-8EF5-CF2E3CCAF0B7}' (runs on registration).
• hijackthis.exe is scheduled as a task with the class '{57999825-9F88-483D-978F-694602FAB3DB}' (runs on registration).
• apploc.exe is scheduled as a task with the class '{EFAE4D4B-2693-47E9-8267-477B499998B9}' (runs on registration).
• tbnotifier.exe is scheduled as a task with the class '{2A74CAE7-C98C-44C6-9E9E-155D069D857D}' (runs on registration).
• slimcomputer.exe is scheduled as a task named 'SlimComputer Scan' (runs daily at 14.00).

• tbnotifier.exe is automatically launched at startup through a scheduled task named ApnTBMon.
• slimcomputer.exe is automatically launched at startup through a scheduled task named SlimComputer Startup.
• slimcleaner.exe is automatically launched at startup through a scheduled task named SlimCleaner Startup.

• hpsupportsolutionsframeworkservice.exe runs as a service named 'HP Support Solutions Framework Service' (HPSupportSolutionsFrameworkService) "This service allows for the detection of HP products and enables identification of support solutions for detected products.".
• fitbitconnectservice.exe runs as a service named 'Fitbit Connect Service' (Fitbit Connect) "Uploads your Fitbit's data to Fitbit.com in the background".
• schedulerservice.exe runs as a service named 'US Tech Support Scheduling Service' (USTSScheduler) "Required for US Tech Support products".

• smartbar.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Browser Infrastructure Helper' and executes as C:\users\user\appdata\Local\Smartbar\Application\Smartbar.exe startup.
• fitbit connect.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Fitbit Connect' and executes as "C:\Program Files\Fitbit Connect\Fitbit Connect.exe" /autorun.
• slimcleaner.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'SlimCleaner' and executes as C:\Program Files\SlimCleaner\SlimCleaner.exe -boot.
• hijackthis.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'HijackThis startup scan' and executes as C:\Program Files\Trend Micro\HiJackThis\HijackThis.exe /startupscan.

• issch.exe is loaded in the all users (HKLM) registry as a startup file name 'ISUSScheduler' which loads as "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start.
• tbnotifier.exe is loaded in the all users (HKLM) registry as a startup file name 'ApnTBMon' which loads as "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe".
• fitbit connect.exe is loaded in the all users (HKLM) registry as a startup file name 'Fitbit Connect' which loads as "C:\Program Files\Fitbit Connect\Fitbit Connect.exe" /autorun.
• vntldr.exe is loaded in the all users (HKLM) registry as a startup file name 'VNT' which loads as C:\Program Files\VNT\vntldr.exe.

• hpdevicedetection3.exe is added as a firewall exception for 'C:\Program Files\HP\Common\HPDeviceDetection3.exe'.
• hijackthis.exe is added as a firewall exception for 'C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe'.
• tbnotifier.exe is added as a firewall exception for 'C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe'.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name