Data taken from Windows Vista ... Google App CLSIDs ; {9465B4B4-5216-4042-9A2C-754D3BCDC410} {61E28BF8-C02B-499F-8E7A-34C1E4A1C649} {96FBC13C-8214-4100-88E0-FF74D7A1CB4D} {A97CA128-6998-4F8E-807E-8ED05FADAFB0} C:\Program Files\Google\ C:\Documents and Settings\User\Application Data\Google\ Remote SIDs ; CREATOR OWNER, Power Users, Everyone, RESTRICTED, SALES and S-1-5-21 Keeps Google spyware up to date. HKEY_CLASSES_ROOT\AppID\{E225E692-4B47-4777-9BED-4FD7FE257F0E} HKEY_CLASSES_ROOT\AppID\GoogleUpdate.exe HKEY_CLASSES_ROOT\AppID\GoogleUpdaterService.exe HKEY_CLASSES_ROOT\CLSID\{1CA2AE94-61B4-4BDC-B36F-CB1854F509AB} Google Toolbar HKEY_CLASSES_ROOT\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F} GoogleUpdate CredentialDialog HKEY_CLASSES_ROOT\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53} HKEY_CLASSES_ROOT\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8} HKEY_CLASSES_ROOT\CLSID\{457BC604-48ED-451E-8051-A46EA7B611C4} HKEY_CLASSES_ROOT\CLSID\{4AD5D8BA-976D-42BE-A47F-ADBC15F82D3C} GoogleUpdate.Update3COMClassService.1.0 HKEY_CLASSES_ROOT\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69} GoogleUpdate Update3Web HKEY_CLASSES_ROOT\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6} HKEY_CLASSES_ROOT\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42} HKEY_CLASSES_ROOT\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7} HKEY_CLASSES_ROOT\CLSID\{6C74860B-C674-4E54-9A67-AE8513488D52} Google Update Broker Class Factory HKEY_CLASSES_ROOT\CLSID\{6F8BD55B-E83D-4A47-85BE-81FFA8057A69} HKEY_CLASSES_ROOT\CLSID\{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E} HKEY_CLASSES_ROOT\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7} Google Silent Updater class HKEY_CLASSES_ROOT\CLSID\{89DAE4CD-9F17-4980-902A-99BA84A8F5C8} HKEY_CLASSES_ROOT\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4} Google Update Legacy On Demand HKEY_CLASSES_ROOT\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410} HKEY_CLASSES_ROOT\CLSID\{B3D28DBD-0DFA-40E4-8071-520767BADC7E} HKEY_CLASSES_ROOT\CLSID\{956376A1-DFBA-411B-89E4-A9D51CA55248} HKEY_CLASSES_ROOT\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D} HKEY_CLASSES_ROOT\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928} Google Toolbar Helper HKEY_CLASSES_ROOT\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7} Google.OneClickProcessLauncher HKEY_CLASSES_ROOT\CLSID\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B} HKEY_CLASSES_ROOT\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82} Google Toolbar Notifier BHO HKEY_CLASSES_ROOT\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} HKEY_CLASSES_ROOT\CLSID\{B53B7061-6584-46AA-A033-D610EB10BD9B} HKEY_CLASSES_ROOT\CLSID\{B6827B84-2F5E-41CF-A11B-50A0BE741815} Google Update Plugin HKEY_CLASSES_ROOT\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D} HKEY_CLASSES_ROOT\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55} HKEY_CLASSES_ROOT\CLSID\{CE671C81-A2EE-4E26-B63C-C1601E8E2236} HKEY_CLASSES_ROOT\CLSID\{E0730E95-4D82-4716-BF23-4F3AB3EF790D} HKEY_CLASSES_ROOT\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E} ProtectorHost Class (for Google Toolbar) HKEY_CLASSES_ROOT\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD} HKEY_CLASSES_ROOT\Google.OneClickCtrl.9 HKEY_CLASSES_ROOT\Google.OneClickProcessLauncherMachine HKEY_CLASSES_ROOT\Google.Update3WebControl.3 HKEY_CLASSES_ROOT\GoogleUpdate.CoCreateAsync HKEY_CLASSES_ROOT\GoogleUpdate.CoreClass HKEY_CLASSES_ROOT\GoogleUpdate.CoreMachineClass HKEY_CLASSES_ROOT\GoogleUpdate.CredentialDialogMachine HKEY_CLASSES_ROOT\GoogleUpdate.OnDemandCOMClassMachine HKEY_CLASSES_ROOT\GoogleUpdate.OnDemandCOMClassMachineFallback HKEY_CLASSES_ROOT\GoogleUpdate.OnDemandCOMClassSvc HKEY_CLASSES_ROOT\GoogleUpdate.ProcessLauncher HKEY_CLASSES_ROOT\GoogleUpdate.Update3COMClassService HKEY_CLASSES_ROOT\GoogleUpdate.Update3WebMachine HKEY_CLASSES_ROOT\GoogleUpdate.Update3WebMachineFallback HKEY_CLASSES_ROOT\GoogleUpdate.Update3WebSvc HKEY_CLASSES_ROOT\GoogleUpdateProcessLauncher HKEY_CLASSES_ROOT\GUSchedulerCtl.UpdaterScheduler HKEY_CLASSES_ROOT\GUServiceCtl.SilentUpdater Google Toolbar for Internet Explorer HKEY_CLASSES_ROOT\Installer\Products\ 18555481990E8AB4CBB63FB4F26006C0 Google Update Helper HKEY_CLASSES_ROOT\Installer\Products\ 93BAD29AC2E44034A96BCB446EB8552E IGoogleUpdate3WebSecurity HKEY_CLASSES_ROOT\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A} IGoogleUpdate HKEY_CLASSES_ROOT\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B} IGoogleUpdate3Web HKEY_CLASSES_ROOT\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E} HKEY_CLASSES_ROOT\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF} HKEY_CLASSES_ROOT\Interface\{909489C2-85A6-4322-AA56-D25278649D67} HKEY_CLASSES_ROOT\MIME\Database\Content Type\ application/x-vnd.google.oneclickctrl.9 HKEY_CLASSES_ROOT\MIME\Database\Content Type\ application/x-vnd.google.update3webcontrol.3 HKEY_CLASSES_ROOT\TypeLib\{5924C60B-6D7F-4AD6-8084-24A59431C967} HKEY_CLASSES_ROOT\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40} HKEY_CURRENT_USER\Software\Google HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ AppID\GoogleUpdate.exe HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ AppID\GoogleUpdaterService.exe HKLM\Google.OneClickProcessLauncherMachine HKLM\Google.Update3WebControl.3 HKLM\GoogleUpdate.CoCreateAsync HKLM\GoogleUpdate.CoreClass HKLM\GoogleUpdate.CoreMachineClass HKLM\GoogleUpdate.CredentialDialogMachine HKLM\GoogleUpdate.OnDemandCOMClassMachine HKLM\GoogleUpdate.OnDemandCOMClassMachineFallback HKLM\GoogleUpdate.OnDemandCOMClassSvc HKLM\GoogleUpdate.ProcessLauncher HKLM\GoogleUpdate.Update3COMClassService HKLM\GoogleUpdate.Update3WebMachine HKLM\GoogleUpdate.Update3WebMachineFallback HKLM\GoogleUpdate.Update3WebSvc HKLM\GoogleUpdateProcessLauncher HKLM\GUSchedulerCtl.UpdaterScheduler HKLM\GUServiceCtl.SilentUpdater HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\ Database\Content Type\application/ x-vnd.google.oneclickctrl.9 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\ Database\Content Type\application/ x-vnd.google.update3webcontrol.3 HKEY_LOCAL_MACHINE\SOFTWARE\Google go.microsoft.com backdoor HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Extension Compatibility\ {2318C2B1-4965-11D4-9B18-009027A5CD4F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Extension Compatibility\ {AA58ED58-01DD-4D91-8333-CF10577473F7} GoogleToolbarUser_32.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Low Rights\ElevationPolicy\ {1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F} GoogleToolbarNotifier.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Low Rights\ElevationPolicy\ {80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5} GoogleUpdateBroker.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Low Rights\ElevationPolicy\ {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D} GoogleUpdate.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Low Rights\ElevationPolicy\ {C442AC41-9200-4770-8CC0-7CDB4F245C55} GoogleToolbarUser_64.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\Low Rights\ElevationPolicy\ {EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1} clients5.google.com and google.com backdoors HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Internet Explorer\SearchScopes\ {CFA87FF2-A9B3-4EB8-9F59-942858187B1A} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Installer\UserData\S-1-5-18\ Components\5BFB0305F3F68B04BAB8C647D818B9C1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Installer\UserData\S-1-5-18\ Components\9507B717889AF294FAB1CD7FB08E90BA Google Toolbar for Internet Explorer HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Installer\UserData\S-1-5-18\ Products\18555481990E8AB4CBB63FB4F26006C0 Google Update Helper HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Installer\UserData\S-1-5-18\ Products\93BAD29AC2E44034A96BCB446EB8552E