1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Need Help On Resolving An Ad-Ware Problem

Discussion in 'Malware Removal Help' started by FloydPalmer, Nov 16, 2012.

Page 2 of 2
  1. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    Hello, FloydPalmer.

    AVG will detect Combofix as a false positive so nothing to wory about. If you quarantined, it you'll need to redownload and rename it as before.

    The log looks OK...some more Babylon remnants but we'll take care of that here. We'll also do an online scan to see if that helps.



    Step 1



    1. Close any open browsers.

    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    3. Open Notepad and copy/paste the text in the codebox below into Notepad:

    Code:
    Firefox::
FF - ProfilePath - c:\users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID= 112050
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 5a00335700000000000000234e6f9479
FF - user.js: extensions.BabylonToolbar_i.hardId - 5a00335700000000000000234e6f9479
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15449
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:03
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    Save this as CFScript.txt, in the same location as ComboFix.exe


    [​IMG]

    Refering to the picture above, drag CFScript into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

    Note: After running Combofix, you may receive an error about "illegal operation on a registry key that has been marked for deletion." If you receive this error, please reboot and it should disappear.



    Step 2

    Please pull anything out of the recycle bin that you want to save. Part of this fix will empty temp files, and that does include the recycle bin.

    Please download TFC by OldTimer and save it to your desktop.
    alternate download link


    • Save any unsaved work. TFC will close ALL open programs including your browser!
    • Double-click on TFC.exe to run it. If you are using Vista or Windows 7, right-click on the file and choose Run As Administrator.
    • Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
    • Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.




    Step 3

    I'd like us to scan your machine with ESET OnlineScan
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESET OnlineScan
    • Click the [​IMG] button.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      • Click on [​IMG] to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the [​IMG] icon on your desktop.
    • Check [​IMG]
    • Click the [​IMG] button.
    • Accept any security warnings from your browser.
    • Check [​IMG]
    • Push the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push [​IMG]
    • Push [​IMG], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Push the [​IMG] button.
    • Push [​IMG]

    etavares
     
    etavares, Nov 25, 2012
    #21
  3. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    ComboFix 12-11-23.02 - Aky 25/11/2012 18:49:03.4.2 - x86
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.2814.1908 [GMT 0:00]
    Running from: c:\users\Aky\Desktop\etavaresCF.exe
    Command switches used :: C:\CFScript.txt
    AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Aky\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-10-25 to 2012-11-25 )))))))))))))))))))))))))))))))
    .
    .
    2012-11-25 18:58 . 2012-11-25 18:58 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-11-24 21:13 . 2012-11-25 19:02 -------- d-----w- c:\users\Aky\AppData\Local\temp
    2012-11-24 00:15 . 2012-11-24 00:44 -------- d-----w- C:\etavaresCF
    2012-11-18 20:57 . 2012-11-18 20:57 -------- d-----w- C:\_OTL
    2012-11-17 21:49 . 2012-11-17 21:49 -------- d-----w- c:\program files\ERUNT
    2012-11-16 01:19 . 2012-09-25 16:19 75776 ----a-w- c:\windows\system32\synceng.dll
    2012-11-16 01:12 . 2012-10-12 14:29 2047488 ----a-w- c:\windows\system32\win32k.sys
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-11-08 20:26 . 2012-09-04 15:01 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2012-10-22 13:02 . 2012-10-22 13:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
    2012-10-15 03:48 . 2012-10-15 03:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys
    2012-10-05 03:32 . 2012-10-05 03:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2012-10-02 02:30 . 2012-10-02 02:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2012-09-29 18:54 . 2011-04-23 20:49 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-09-21 02:46 . 2012-09-21 02:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2012-09-21 02:46 . 2012-09-21 02:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys
    2012-09-21 02:45 . 2012-09-21 02:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
    2012-09-14 02:05 . 2012-09-14 02:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
    2012-09-13 13:28 . 2012-10-10 20:57 2048 ----a-w- c:\windows\system32\tzres.dll
    2012-08-29 11:27 . 2012-10-10 20:56 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2012-08-29 11:27 . 2012-10-10 20:56 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-01-12 22:55 . 2011-04-23 20:00 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
    2012-11-08 20:26 1796552 ----a-w- c:\program files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll" [2012-11-08 1796552]
    .
    [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
    [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
    [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
    .
    c:\users\Aky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    Orion.lnk - c:\program files\Convesoft\Orion\Messenger.exe [N/A]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-22 16:29]
    .
    2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-22 16:29]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page =
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0411&m=aspire_5535
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.0.1
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll
    FF - ProfilePath - c:\users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoomail.com/
    FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid=%7B0a71d742-943a-41f3-8505-07e337de002e%7D&mid=9392a15da3f947d19832d1543433a099-1b62730cc3bb4bcb36306e4f0b52005d1a2cf034&ds=AVG&v=12.2.5.34&lang=en&pr=fr&d=2012-09-29%2020%3A34%3A59&sap=ku&q=
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-11-25 19:01
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NETFramework]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ACPI]
    "ImagePath"="system32\drivers\acpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdobeARMservice]
    "ImagePath"="\"c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adp94xx]
    "ImagePath"="\SystemRoot\system32\drivers\adp94xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adpahci]
    "ImagePath"="\SystemRoot\system32\drivers\adpahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adpu160m]
    "ImagePath"="\SystemRoot\system32\drivers\adpu160m.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adpu320]
    "ImagePath"="\SystemRoot\system32\drivers\adpu320.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adsi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AeLookupSvc]
    "ServiceDll"="%SystemRoot%\System32\aelupsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AFD]
    "ImagePath"="\SystemRoot\system32\drivers\afd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\agp440]
    "ImagePath"="\SystemRoot\system32\drivers\agp440.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ahcix86s]
    "ImagePath"="system32\DRIVERS\ahcix86s.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78xx]
    "ImagePath"="\SystemRoot\system32\drivers\djsvs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ALG]
    "ImagePath"="%SystemRoot%\System32\alg.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aliide]
    "ImagePath"="\SystemRoot\system32\drivers\aliide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amdagp]
    "ImagePath"="\SystemRoot\system32\drivers\amdagp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amdide]
    "ImagePath"="\SystemRoot\system32\drivers\amdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AmdK7]
    "ImagePath"="\SystemRoot\system32\drivers\amdk7.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AmdK8]
    "ImagePath"="\SystemRoot\system32\drivers\amdk8.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\androidusb]
    "ImagePath"="System32\Drivers\ssadadb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Appinfo]
    "ServiceDll"="%SystemRoot%\System32\appinfo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Apple Mobile Device]
    "ImagePath"="\"c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppMgmt]
    "ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\arc]
    "ImagePath"="\SystemRoot\system32\drivers\arc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\arcsas]
    "ImagePath"="\SystemRoot\system32\drivers\arcsas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AsyncMac]
    "ImagePath"="system32\DRIVERS\asyncmac.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi]
    "ImagePath"="system32\drivers\atapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\athr]
    "ImagePath"="system32\DRIVERS\athr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ati External Event Utility]
    "ImagePath"="%SystemRoot%\system32\Ati2evxx.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Atierecord]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atikmdag]
    "ImagePath"="system32\DRIVERS\atikmdag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AtiPcie]
    "ImagePath"="system32\DRIVERS\AtiPcie.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AudioEndpointBuilder]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Audiosrv]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avg]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVG Security Toolbar Service]
    "ImagePath"="c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSAgent]
    "ImagePath"="\"c:\program files\AVG\AVG2013\avgidsagent.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdriverx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSHX]
    "ImagePath"="system32\DRIVERS\avgidshx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSShim]
    "ImagePath"="system32\DRIVERS\avgidsshimx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgldx86]
    "ImagePath"="system32\DRIVERS\avgldx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avglogx]
    "ImagePath"="system32\DRIVERS\avglogx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgmfx86]
    "ImagePath"="system32\DRIVERS\avgmfx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgrkx86]
    "ImagePath"="system32\DRIVERS\avgrkx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgtdix]
    "ImagePath"="system32\DRIVERS\avgtdix.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avgtp]
    "ImagePath"="\??\c:\windows\system32\drivers\avgtpx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avgwd]
    "ImagePath"="\"c:\program files\AVG\AVG2013\avgwdsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\b57nd60x]
    "ImagePath"="system32\DRIVERS\b57nd60x.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BattC]
    "MofImagePath"="system32\drivers\battc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Beep]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BFE]
    "ServiceDll"="%SystemRoot%\System32\bfe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]
    "ServiceDll"="%systemroot%\system32\qmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\blbdrive]
    "ImagePath"="\SystemRoot\system32\drivers\blbdrive.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bonjour Service]
    "ImagePath"="\"c:\program files\Bonjour\mDNSResponder.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bowser]
    "ImagePath"="system32\DRIVERS\bowser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrFiltLo]
    "ImagePath"="\SystemRoot\system32\drivers\brfiltlo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrFiltUp]
    "ImagePath"="\SystemRoot\system32\drivers\brfiltup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Browser]
    "ServiceDll"="%SystemRoot%\System32\browser.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Brserid]
    "ImagePath"="\SystemRoot\system32\drivers\brserid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrSerWdm]
    "ImagePath"="\SystemRoot\system32\drivers\brserwdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrUsbMdm]
    "ImagePath"="\SystemRoot\system32\drivers\brusbmdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrUsbSer]
    "ImagePath"="\SystemRoot\system32\drivers\brusbser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHMODEM]
    "ImagePath"="\SystemRoot\system32\drivers\bthmodem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BUNAgentSvc]
    "ImagePath"="\"c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BVRPMPR5]
    "ImagePath"="\??\c:\windows\system32\drivers\BVRPMPR5.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\catchme]
    "ImagePath"="\??\c:\users\Aky\AppData\Local\Temp\catchme.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdfs]
    "ImagePath"="system32\DRIVERS\cdfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdrom]
    "ImagePath"="system32\DRIVERS\cdrom.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CertPropSvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\circlass]
    "ImagePath"="\SystemRoot\system32\drivers\circlass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CLFS]
    "ImagePath"="System32\CLFS.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CLHNService]
    "ImagePath"="c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\clr_optimization_v2.0.50727_32]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\clr_optimization_v4.0.30319_32]
    "ImagePath"="c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CmBatt]
    "ImagePath"="system32\DRIVERS\CmBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdide]
    "ImagePath"="\SystemRoot\system32\drivers\cmdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Compbatt]
    "ImagePath"="system32\DRIVERS\compbatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\COMSysApp]
    "ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crcdisk]
    "ImagePath"="system32\drivers\crcdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Crusoe]
    "ImagePath"="\SystemRoot\system32\drivers\crusoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CryptSvc]
    "ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CSC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DCLocator]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DcomLaunch]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DfsC]
    "ImagePath"="System32\Drivers\dfsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DFSR]
    "ImagePath"="%SystemRoot%\system32\DFSR.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp]
    "ServiceDll"="%SystemRoot%\system32\dhcpcsvc.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk]
    "ImagePath"="system32\drivers\disk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DKbFltr]
    "ImagePath"="system32\DRIVERS\DKbFltr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache]
    "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dot3svc]
    "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DPS]
    "ServiceDll"="%SystemRoot%\system32\dps.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drmkaud]
    "ImagePath"="system32\drivers\drmkaud.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DXGKrnl]
    "ImagePath"="\SystemRoot\System32\drivers\dxgkrnl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\E1G60]
    "ImagePath"="system32\DRIVERS\E1G60I32.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EapHost]
    "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ecache]
    "ImagePath"="System32\drivers\ecache.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eDataSecurity Service]
    "ImagePath"="\"c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\elxstor]
    "ImagePath"="\SystemRoot\system32\drivers\elxstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EmdCache]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EMDMgmt]
    "ServiceDll"="%systemroot%\system32\emdmgmt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ErrDev]
    "ImagePath"="\SystemRoot\system32\drivers\errdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ESENT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ETService]
    "ImagePath"="c:\program files\Acer\Empowering Technology\Service\ETService.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog]
    "ServiceDll"="%SystemRoot%\System32\wevtsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventSystem]
    "ServiceDll"="%systemroot%\system32\es.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fdc]
    "ImagePath"="system32\DRIVERS\fdc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fdPHost]
    "ServiceDll"="%SystemRoot%\system32\fdPHost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FDResPub]
    "ServiceDll"="%SystemRoot%\system32\fdrespub.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FileInfo]
    "ImagePath"="system32\drivers\fileinfo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Filetrace]
    "ImagePath"="system32\drivers\filetrace.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\flpydisk]
    "ImagePath"="system32\DRIVERS\flpydisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FltMgr]
    "ImagePath"="system32\drivers\fltmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FontCache]
    "ServiceDll"="%SystemRoot%\system32\FntCache.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FontCache3.0.0.0]
    "ImagePath"="%systemroot%\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Fs_Rec]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gagp30kx]
    "ImagePath"="\SystemRoot\system32\drivers\gagp30kx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GEARAspiWDM]
    "ImagePath"="system32\DRIVERS\GEARAspiWDM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gpsvc]
    "ServiceDll"="%SystemRoot%\System32\gpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gupdate]
    "ImagePath"="\"c:\program files\Google\Update\GoogleUpdate.exe\" /svc"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gupdatem]
    "ImagePath"="\"c:\program files\Google\Update\GoogleUpdate.exe\" /medsvc"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HdAudAddService]
    "ImagePath"="system32\drivers\HdAudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HDAudBus]
    "ImagePath"="system32\DRIVERS\HDAudBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidBth]
    "ImagePath"="\SystemRoot\system32\drivers\hidbth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidIr]
    "ImagePath"="\SystemRoot\system32\drivers\hidir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hidserv]
    "ServiceDll"="%SystemRoot%\System32\hidserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidUsb]
    "ImagePath"="system32\DRIVERS\hidusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hkmsvc]
    "ServiceDLL"="%SystemRoot%\system32\kmsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HpCISSs]
    "ImagePath"="\SystemRoot\system32\drivers\hpcisss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HSFHWAZL]
    "ImagePath"="system32\DRIVERS\VSTAZL3.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HSF_DPV]
    "ImagePath"="system32\DRIVERS\HSX_DPV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HSXHWAZL]
    "ImagePath"="system32\DRIVERS\HSXHWAZL.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HTTP]
    "ImagePath"="system32\drivers\HTTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i2omp]
    "ImagePath"="\SystemRoot\system32\drivers\i2omp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i8042prt]
    "ImagePath"="system32\DRIVERS\i8042prt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iaStorV]
    "ImagePath"="\SystemRoot\system32\drivers\iastorv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\idsvc]
    "ImagePath"="\"%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iirsp]
    "ImagePath"="\SystemRoot\system32\drivers\iirsp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IKEEXT]
    "ServiceDll"="%SystemRoot%\System32\ikeext.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\inetaccs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\int15]
    "ImagePath"="\??\c:\windows\system32\drivers\int15.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IntcAzAudAddService]
    "ImagePath"="system32\drivers\RTKVHDA.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\intelide]
    "ImagePath"="\SystemRoot\system32\drivers\intelide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\intelppm]
    "ImagePath"="system32\DRIVERS\intelppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPBusEnum]
    "ServiceDll"="%SystemRoot%\system32\ipbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IpFilterDriver]
    "ImagePath"="system32\DRIVERS\ipfltdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iphlpsvc]
    "ServiceDll"="%SystemRoot%\System32\iphlpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IpInIp]
    "ImagePath"="system32\DRIVERS\ipinip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPMIDRV]
    "ImagePath"="\SystemRoot\system32\drivers\ipmidrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPNAT]
    "ImagePath"="system32\DRIVERS\ipnat.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iPod Service]
    "ImagePath"="\"c:\program files\iPod\bin\iPodService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\irda]
    "ImagePath"="system32\DRIVERS\irda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IRENUM]
    "ImagePath"="system32\drivers\irenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Irmon]
    "ServiceDll"="%SystemRoot%\System32\irmon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\isapnp]
    "ImagePath"="\SystemRoot\system32\drivers\isapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iScsiPrt]
    "ImagePath"="system32\DRIVERS\msiscsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iteatapi]
    "ImagePath"="\SystemRoot\system32\drivers\iteatapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iteraid]
    "ImagePath"="\SystemRoot\system32\drivers\iteraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kbdclass]
    "ImagePath"="system32\DRIVERS\kbdclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kbdhid]
    "ImagePath"="system32\DRIVERS\kbdhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KeyIso]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KSecDD]
    "ImagePath"="System32\Drivers\ksecdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KtmRm]
    "ServiceDll"="%systemroot%\system32\msdtckrm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanServer]
    "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation]
    "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ldap]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LightScribeService]
    "ImagePath"="\"c:\program files\Common Files\LightScribe\LSSrvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lltdio]
    "ImagePath"="system32\DRIVERS\lltdio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lltdsvc]
    "ServiceDll"="%SystemRoot%\System32\lltdsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lmhosts]
    "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lsa]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LSI_FC]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_fc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LSI_SAS]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_sas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LSI_SCSI]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_scsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\luafv]
    "ImagePath"="\SystemRoot\system32\drivers\luafv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMProtector]
    "ImagePath"="\??\c:\windows\system32\drivers\mbam.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMScheduler]
    "ImagePath"="\"c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMService]
    "ImagePath"="\"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mdmxsdk]
    "ImagePath"="system32\DRIVERS\mdmxsdk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\megasas]
    "ImagePath"="\SystemRoot\system32\drivers\megasas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MegaSR]
    "ImagePath"="\SystemRoot\system32\drivers\megasr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MMCSS]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MobilityService]
    "ImagePath"="c:\acer\Mobility Center\MobilityService.exe -p"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Modem]
    "ImagePath"="system32\drivers\modem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\monitor]
    "ImagePath"="system32\DRIVERS\monitor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouclass]
    "ImagePath"="system32\DRIVERS\mouclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouhid]
    "ImagePath"="system32\DRIVERS\mouhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MountMgr]
    "ImagePath"="System32\drivers\mountmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpio]
    "ImagePath"="\SystemRoot\system32\drivers\mpio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpsdrv]
    "ImagePath"="System32\drivers\mpsdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpsSvc]
    "ServiceDll"="%SystemRoot%\system32\mpssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mraid35x]
    "ImagePath"="\SystemRoot\system32\drivers\mraid35x.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxDAV]
    "ImagePath"="\SystemRoot\system32\drivers\mrxdav.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mrxsmb]
    "ImagePath"="system32\DRIVERS\mrxsmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mrxsmb10]
    "ImagePath"="system32\DRIVERS\mrxsmb10.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mrxsmb20]
    "ImagePath"="system32\DRIVERS\mrxsmb20.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msahci]
    "ImagePath"="system32\drivers\msahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msdsm]
    "ImagePath"="\SystemRoot\system32\drivers\msdsm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC]
    "ImagePath"="%SystemRoot%\System32\msdtc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Msfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msisadrv]
    "ImagePath"="system32\drivers\msisadrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSiSCSI]
    "ServiceDll"="%systemroot%\system32\iscsiexe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msiserver]
    "ImagePath"="%systemroot%\system32\msiexec.exe /V"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSKSSRV]
    "ImagePath"="system32\drivers\MSKSSRV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSPCLOCK]
    "ImagePath"="system32\drivers\MSPCLOCK.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSPQM]
    "ImagePath"="system32\drivers\MSPQM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MsRPC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSSCNTRS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mssmbios]
    "ImagePath"="system32\DRIVERS\mssmbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTEE]
    "ImagePath"="system32\drivers\MSTEE.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mup]
    "ImagePath"="System32\Drivers\mup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\napagent]
    "ServiceDLL"="%SystemRoot%\system32\qagentRT.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NativeWifiP]
    "ImagePath"="system32\DRIVERS\nwifi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NDIS]
    "ImagePath"="system32\drivers\ndis.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NdisTapi]
    "ImagePath"="system32\DRIVERS\ndistapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndisuio]
    "ImagePath"="system32\DRIVERS\ndisuio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NdisWan]
    "ImagePath"="system32\DRIVERS\ndiswan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NDProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBIOS]
    "ImagePath"="system32\DRIVERS\netbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netbt]
    "ImagePath"="System32\DRIVERS\netbt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netlogon]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netman]
    "ServiceDll"="%SystemRoot%\System32\netman.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netprofm]
    "ServiceDll"="%SystemRoot%\System32\netprofm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetTcpPortSharing]
    "ImagePath"="\"%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nfrd960]
    "ImagePath"="\SystemRoot\system32\drivers\nfrd960.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NlaSvc]
    "ServiceDll"="%SystemRoot%\System32\nlasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nmwcd]
    "ImagePath"="system32\drivers\ccdcmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nmwcdc]
    "ImagePath"="system32\drivers\ccdcmbo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Npfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NSCIRDA]
    "ImagePath"="system32\DRIVERS\nscirda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nsi]
    "ServiceDll"="%systemroot%\system32\nsisvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nsiproxy]
    "ImagePath"="system32\drivers\nsiproxy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTDS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ntfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTIBackupSvc]
    "ImagePath"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTIDrvr]
    "ImagePath"="system32\DRIVERS\NTIDrvr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTIPPKernel]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTISchedulerSvc]
    "ImagePath"="c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ntrigdigi]
    "ImagePath"="\SystemRoot\system32\drivers\ntrigdigi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Null]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nvraid]
    "ImagePath"="\SystemRoot\system32\drivers\nvraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nvstor]
    "ImagePath"="\SystemRoot\system32\drivers\nvstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nv_agp]
    "ImagePath"="\SystemRoot\system32\drivers\nv_agp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NwlnkFlt]
    "ImagePath"="system32\DRIVERS\nwlnkflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NwlnkFwd]
    "ImagePath"="system32\DRIVERS\nwlnkfwd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\odserv]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ohci1394]
    "ImagePath"="system32\DRIVERS\ohci1394.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ose]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pimsvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2psvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Parport]
    "ImagePath"="\SystemRoot\system32\drivers\parport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr]
    "ImagePath"="System32\drivers\partmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Parvdm]
    "ImagePath"="\SystemRoot\system32\drivers\parvdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PcaSvc]
    "ServiceDll"="%SystemRoot%\System32\pcasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pccsmcfd]
    "ImagePath"="system32\DRIVERS\pccsmcfd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pci]
    "ImagePath"="system32\drivers\pci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pciide]
    "ImagePath"="\SystemRoot\system32\drivers\pciide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pcmcia]
    "ImagePath"="\SystemRoot\system32\DRIVERS\pcmcia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PEAUTH]
    "ImagePath"="system32\drivers\peauth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfDisk]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfNet]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfOS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfProc]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pla]
    "ServiceDll"="%systemroot%\system32\pla.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PlugPlay]
    "ServiceDll"="%SystemRoot%\system32\umpnpmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PNRPAutoReg]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PNRPsvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PolicyAgent]
    "ServiceDll"="%SystemRoot%\System32\ipsecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PortProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PptpMiniport]
    "ImagePath"="system32\DRIVERS\raspptp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Processor]
    "ImagePath"="system32\DRIVERS\processr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ProfSvc]
    "ServiceDll"="%systemroot%\system32\profsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ProtectedStorage]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSched]
    "ImagePath"="system32\DRIVERS\pacer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSDFilter]
    "ImagePath"="system32\DRIVERS\psdfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSDNServ]
    "ImagePath"="system32\DRIVERS\PSDNServ.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\psdvdisk]
    "ImagePath"="system32\DRIVERS\PSDVdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ql2300]
    "ImagePath"="\SystemRoot\system32\drivers\ql2300.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ql40xx]
    "ImagePath"="\SystemRoot\system32\drivers\ql40xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QWAVE]
    "ServiceDll"="%windir%\system32\qwave.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QWAVEdrv]
    "ImagePath"="\SystemRoot\system32\drivers\qwavedrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasAcd]
    "ImagePath"="System32\DRIVERS\rasacd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasAuto]
    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Rasl2tp]
    "ImagePath"="system32\DRIVERS\rasl2tp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasMan]
    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasPppoe]
    "ImagePath"="system32\DRIVERS\raspppoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasSstp]
    "ImagePath"="system32\DRIVERS\rassstp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdbss]
    "ImagePath"="system32\DRIVERS\rdbss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPCDD]
    "ImagePath"="System32\DRIVERS\RDPCDD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdpdr]
    "ImagePath"="\SystemRoot\system32\drivers\rdpdr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPENCDD]
    "ImagePath"="system32\drivers\rdpencdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPWD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Realtek USB 2.0 Card Reader]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess]
    "ServiceDLL"="%SystemRoot%\System32\mprdim.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteRegistry]
    "ServiceDll"="%SystemRoot%\system32\regsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcLocator]
    "ImagePath"="%SystemRoot%\system32\locator.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs]
    "ServiceDll"="%SystemRoot%\System32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rspndr]
    "ImagePath"="system32\DRIVERS\rspndr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RTSTOR]
    "ImagePath"="system32\drivers\RTSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SamSs]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sbp2port]
    "ImagePath"="\SystemRoot\system32\drivers\sbp2port.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SCardSvr]
    "ServiceDll"="%SystemRoot%\System32\SCardSvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule]
    "ServiceDll"="%systemroot%\system32\schedsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SCPolicySvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sdbus]
    "ImagePath"="system32\DRIVERS\sdbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SDRSVC]
    "ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\secdrv]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\seclogon]
    "ServiceDll"="%windir%\system32\seclogon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SENS]
    "ServiceDll"="%SystemRoot%\system32\sens.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serenum]
    "ImagePath"="\SystemRoot\system32\drivers\serenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serial]
    "ImagePath"="\SystemRoot\system32\drivers\serial.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sermouse]
    "ImagePath"="\SystemRoot\system32\drivers\sermouse.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceLayer]
    "ImagePath"="\"c:\program files\PC Connectivity Solution\ServiceLayer.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SessionEnv]
    "ServiceDLL"="%SystemRoot%\system32\sessenv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sffdisk]
    "ImagePath"="\SystemRoot\system32\drivers\sffdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sffp_mmc]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_mmc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sffp_sd]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_sd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sfloppy]
    "ImagePath"="system32\DRIVERS\sfloppy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess]
    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ShellHWDetection]
    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sisagp]
    "ImagePath"="\SystemRoot\system32\drivers\sisagp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SiSRaid2]
    "ImagePath"="\SystemRoot\system32\drivers\sisraid2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SiSRaid4]
    "ImagePath"="\SystemRoot\system32\drivers\sisraid4.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\slsvc]
    "ImagePath"="%SystemRoot%\system32\SLsvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SLUINotify]
    "ServiceDll"="%SystemRoot%\system32\SLUINotify.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Smb]
    "ImagePath"="system32\DRIVERS\smb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMPTRAP]
    "ImagePath"="%SystemRoot%\System32\snmptrap.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\spldr]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler]
    "ImagePath"="%SystemRoot%\System32\spoolsv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srv]
    "ImagePath"="System32\DRIVERS\srv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srv2]
    "ImagePath"="System32\DRIVERS\srv2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srvnet]
    "ImagePath"="System32\DRIVERS\srvnet.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadbus]
    "ImagePath"="system32\DRIVERS\ssadbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadmdfl]
    "ImagePath"="system32\DRIVERS\ssadmdfl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadmdm]
    "ImagePath"="system32\DRIVERS\ssadmdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadserd]
    "ImagePath"="system32\DRIVERS\ssadserd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSDPSRV]
    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SstpSvc]
    "ServiceDll"="%SystemRoot%\system32\sstpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stisvc]
    "ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\swenum]
    "ImagePath"="system32\DRIVERS\swenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\swprv]
    "ServiceDll"="%Systemroot%\System32\swprv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symc8xx]
    "ImagePath"="\SystemRoot\system32\drivers\symc8xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sym_hi]
    "ImagePath"="\SystemRoot\system32\drivers\sym_hi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sym_u3]
    "ImagePath"="\SystemRoot\system32\drivers\sym_u3.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SynTP]
    "ImagePath"="system32\DRIVERS\SynTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SysMain]
    "ServiceDll"="%systemroot%\system32\sysmain.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TabletInputService]
    "ServiceDll"="%SystemRoot%\System32\TabSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TapiSrv]
    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBS]
    "ServiceDll"="%SystemRoot%\System32\tbssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip]
    "ImagePath"="System32\drivers\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6]
    "ImagePath"="system32\DRIVERS\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tcpipreg]
    "ImagePath"="System32\drivers\tcpipreg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDPIPE]
    "ImagePath"="system32\drivers\tdpipe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDTCP]
    "ImagePath"="system32\drivers\tdtcp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdx]
    "ImagePath"="system32\DRIVERS\tdx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermDD]
    "ImagePath"="system32\DRIVERS\termdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService]
    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Themes]
    "ServiceDll"="%SystemRoot%\system32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\THREADORDER]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks]
    "ServiceDll"="%SystemRoot%\System32\trkwks.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustedInstaller]
    "ImagePath"="%SystemRoot%\servicing\TrustedInstaller.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TSDDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tssecsrv]
    "ImagePath"="System32\DRIVERS\tssecsrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tunmp]
    "ImagePath"="system32\DRIVERS\tunmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tunnel]
    "ImagePath"="system32\DRIVERS\tunnel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uagp35]
    "ImagePath"="\SystemRoot\system32\drivers\uagp35.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UBHelper]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\udfs]
    "ImagePath"="system32\DRIVERS\udfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UGatherer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UGTHRSVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UI0Detect]
    "ImagePath"="%SystemRoot%\system32\UI0Detect.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uliagpkx]
    "ImagePath"="\SystemRoot\system32\drivers\uliagpkx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uliahci]
    "ImagePath"="\SystemRoot\system32\drivers\uliahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UlSata]
    "ImagePath"="\SystemRoot\system32\drivers\ulsata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ulsata2]
    "ImagePath"="\SystemRoot\system32\drivers\ulsata2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\umbus]
    "ImagePath"="system32\DRIVERS\umbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\upnphost]
    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\upperdev]
    "ImagePath"="system32\DRIVERS\usbser_lowerflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usb]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBAAPL]
    "ImagePath"="System32\Drivers\usbaapl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbccgp]
    "ImagePath"="system32\DRIVERS\usbccgp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbcir]
    "ImagePath"="\SystemRoot\system32\drivers\usbcir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbehci]
    "ImagePath"="system32\DRIVERS\usbehci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbfilter]
    "ImagePath"="system32\DRIVERS\usbfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbhub]
    "ImagePath"="system32\DRIVERS\usbhub.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbohci]
    "ImagePath"="system32\DRIVERS\usbohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbprint]
    "ImagePath"="system32\DRIVERS\usbprint.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbser]
    "ImagePath"="system32\DRIVERS\usbser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UsbserFilt]
    "ImagePath"="system32\DRIVERS\usbser_lowerfltj.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR]
    "ImagePath"="system32\DRIVERS\USBSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbuhci]
    "ImagePath"="system32\DRIVERS\usbuhci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbvideo]
    "ImagePath"="System32\Drivers\usbvideo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UxSms]
    "ServiceDll"="%SystemRoot%\System32\uxsms.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vds]
    "ImagePath"="%SystemRoot%\System32\vds.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vga]
    "ImagePath"="system32\DRIVERS\vgapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VgaSave]
    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\viaagp]
    "ImagePath"="\SystemRoot\system32\drivers\viaagp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ViaC7]
    "ImagePath"="\SystemRoot\system32\drivers\viac7.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\viaide]
    "ImagePath"="\SystemRoot\system32\drivers\viaide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\volmgr]
    "ImagePath"="system32\drivers\volmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\volmgrx]
    "ImagePath"="System32\drivers\volmgrx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\volsnap]
    "ImagePath"="system32\drivers\volsnap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vsmraid]
    "ImagePath"="\SystemRoot\system32\drivers\vsmraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS]
    "ImagePath"="%systemroot%\system32\vssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vToolbarUpdater13.2.0]
    "ImagePath"="c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time]
    "ServiceDll"="%systemroot%\system32\w32time.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W3SVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WacomPen]
    "ImagePath"="\SystemRoot\system32\drivers\wacompen.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wanarp]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wanarpv6]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wcncsvc]
    "ServiceDll"="%SystemRoot%\System32\wcncsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WcsPlugInService]
    "ServiceDll"="%SystemRoot%\System32\WcsPlugInService.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wd]
    "ImagePath"="\SystemRoot\system32\drivers\wd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wdf01000]
    "ImagePath"="system32\drivers\Wdf01000.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdiServiceHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdiSystemHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient]
    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wecsvc]
    "ServiceDll"="%SystemRoot%\system32\wecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wercplsupport]
    "ServiceDll"="%SystemRoot%\System32\wercplsupport.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc]
    "ServiceDll"="%SystemRoot%\System32\WerSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winachsf]
    "ImagePath"="system32\DRIVERS\HSX_CNXT.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend]
    "ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinHttpAutoProxySvc]
    "ServiceDll"="winhttp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmgmt]
    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinRM]
    "ServiceDll"="%SystemRoot%\system32\WsmSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlansvc]
    "ServiceDll"="%SystemRoot%\System32\wlansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmiAcpi]
    "ImagePath"="system32\DRIVERS\wmiacpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wmiApSrv]
    "ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSvc]
    "ImagePath"="\"%ProgramFiles%\Windows Media Player\wmpnetwk.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WPCSvc]
    "ServiceDll"="%SystemRoot%\System32\wpcsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WPDBusEnum]
    "ServiceDll"="%SystemRoot%\system32\wpdbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WpdUsb]
    "ImagePath"="system32\DRIVERS\wpdusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WPFFontCache_v0400]
    "ImagePath"="c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ws2ifsl]
    "ImagePath"="\SystemRoot\system32\drivers\ws2ifsl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WSearch]
    "ImagePath"="%systemroot%\system32\SearchIndexer.exe /Embedding"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WSearchIdxPi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv]
    "ServiceDll"="%systemroot%\system32\wuaueng.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WudfPf]
    "ImagePath"="system32\drivers\WudfPf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WUDFRd]
    "ImagePath"="system32\DRIVERS\WUDFRd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wudfsvc]
    "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\XAudio]
    "ImagePath"="system32\DRIVERS\xaudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\XAudioService]
    "ImagePath"="%SystemRoot%\system32\DRIVERS\xaudio.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xmlprov]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{580CFBD5-DEEF-445C-AA1D-2C41A2412BF5}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{AAF7D1EC-25F8-482E-B66D-42E0FF000732}]
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-2348374830-1884495636-3650376586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**ˆ]
    @Class="Shell"
    .
    [HKEY_USERS\S-1-5-21-2348374830-1884495636-3650376586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**ˆ\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2348374830-1884495636-3650376586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**ˆ]
    "0"=hex:66,69,6c,65,3a,2f,2f,2f,43,3a,2f,55,73,65,72,73,2f,41,6b,79,2f,44,65,
    73,6b,74,6f,70,2f,41,6b,79,2f,4d,75,73,69,63,2f,4d,75,73,69,63,2f,45,6e,67,\
    "MRUListEx"=hex:01,00,00,00,00,00,00,00,ff,ff,ff,ff
    "1"=hex:66,69,6c,65,3a,2f,2f,2f,43,3a,2f,55,73,65,72,73,2f,41,6b,79,2f,44,65,
    73,6b,74,6f,70,2f,41,6b,79,2f,4d,75,73,69,63,2f,4d,75,73,69,63,2f,45,6e,67,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'Explorer.exe'(3144)
    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
    c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
    c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
    c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
    c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\progra~1\AVG\AVG2013\avgrsx.exe
    c:\program files\AVG\AVG2013\avgcsrvx.exe
    c:\windows\system32\Ati2evxx.exe
    c:\windows\system32\Ati2evxx.exe
    c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\AVG\AVG2013\avgidsagent.exe
    c:\program files\AVG\AVG2013\avgwdsvc.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
    c:\acer\Mobility Center\MobilityService.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\AVG\AVG2013\avgnsx.exe
    c:\windows\servicing\TrustedInstaller.exe
    .
    **************************************************************************
    .
    Completion time: 2012-11-25 19:06:37 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-11-25 19:06
    ComboFix2.txt 2012-11-24 21:13
    ComboFix3.txt 2012-11-24 00:43
    .
    Pre-Run: 61,523,505,152 bytes free
    Post-Run: 61,500,100,608 bytes free
    .
    - - End Of File - - C089949D8487D6D62DCCB31110935DF9
     
    FloydPalmer, Nov 25, 2012
    #22
  4. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    ComboFix 12-11-23.02 - Aky 25/11/2012 18:49:03.4.2 - x86
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.2814.1908 [GMT 0:00]
    Running from: c:\users\Aky\Desktop\etavaresCF.exe
    Command switches used :: C:\CFScript.txt
    AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Aky\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-10-25 to 2012-11-25 )))))))))))))))))))))))))))))))
    .
    .
    2012-11-25 18:58 . 2012-11-25 18:58 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-11-24 21:13 . 2012-11-25 19:02 -------- d-----w- c:\users\Aky\AppData\Local\temp
    2012-11-24 00:15 . 2012-11-24 00:44 -------- d-----w- C:\etavaresCF
    2012-11-18 20:57 . 2012-11-18 20:57 -------- d-----w- C:\_OTL
    2012-11-17 21:49 . 2012-11-17 21:49 -------- d-----w- c:\program files\ERUNT
    2012-11-16 01:19 . 2012-09-25 16:19 75776 ----a-w- c:\windows\system32\synceng.dll
    2012-11-16 01:12 . 2012-10-12 14:29 2047488 ----a-w- c:\windows\system32\win32k.sys
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-11-08 20:26 . 2012-09-04 15:01 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2012-10-22 13:02 . 2012-10-22 13:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
    2012-10-15 03:48 . 2012-10-15 03:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys
    2012-10-05 03:32 . 2012-10-05 03:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2012-10-02 02:30 . 2012-10-02 02:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2012-09-29 18:54 . 2011-04-23 20:49 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-09-21 02:46 . 2012-09-21 02:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2012-09-21 02:46 . 2012-09-21 02:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys
    2012-09-21 02:45 . 2012-09-21 02:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
    2012-09-14 02:05 . 2012-09-14 02:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
    2012-09-13 13:28 . 2012-10-10 20:57 2048 ----a-w- c:\windows\system32\tzres.dll
    2012-08-29 11:27 . 2012-10-10 20:56 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2012-08-29 11:27 . 2012-10-10 20:56 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-01-12 22:55 . 2011-04-23 20:00 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
    2012-11-08 20:26 1796552 ----a-w- c:\program files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll" [2012-11-08 1796552]
    .
    [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
    [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
    [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
    .
    c:\users\Aky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    Orion.lnk - c:\program files\Convesoft\Orion\Messenger.exe [N/A]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-22 16:29]
    .
    2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-22 16:29]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page =
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0411&m=aspire_5535
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.0.1
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll
    FF - ProfilePath - c:\users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoomail.com/
    FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid=%7B0a71d742-943a-41f3-8505-07e337de002e%7D&mid=9392a15da3f947d19832d1543433a099-1b62730cc3bb4bcb36306e4f0b52005d1a2cf034&ds=AVG&v=12.2.5.34&lang=en&pr=fr&d=2012-09-29%2020%3A34%3A59&sap=ku&q=
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-11-25 19:01
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.NETFramework]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ACPI]
    "ImagePath"="system32\drivers\acpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AdobeARMservice]
    "ImagePath"="\"c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adp94xx]
    "ImagePath"="\SystemRoot\system32\drivers\adp94xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adpahci]
    "ImagePath"="\SystemRoot\system32\drivers\adpahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adpu160m]
    "ImagePath"="\SystemRoot\system32\drivers\adpu160m.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adpu320]
    "ImagePath"="\SystemRoot\system32\drivers\adpu320.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\adsi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AeLookupSvc]
    "ServiceDll"="%SystemRoot%\System32\aelupsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AFD]
    "ImagePath"="\SystemRoot\system32\drivers\afd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\agp440]
    "ImagePath"="\SystemRoot\system32\drivers\agp440.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ahcix86s]
    "ImagePath"="system32\DRIVERS\ahcix86s.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aic78xx]
    "ImagePath"="\SystemRoot\system32\drivers\djsvs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ALG]
    "ImagePath"="%SystemRoot%\System32\alg.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aliide]
    "ImagePath"="\SystemRoot\system32\drivers\aliide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amdagp]
    "ImagePath"="\SystemRoot\system32\drivers\amdagp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amdide]
    "ImagePath"="\SystemRoot\system32\drivers\amdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AmdK7]
    "ImagePath"="\SystemRoot\system32\drivers\amdk7.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AmdK8]
    "ImagePath"="\SystemRoot\system32\drivers\amdk8.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\androidusb]
    "ImagePath"="System32\Drivers\ssadadb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Appinfo]
    "ServiceDll"="%SystemRoot%\System32\appinfo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Apple Mobile Device]
    "ImagePath"="\"c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppMgmt]
    "ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\arc]
    "ImagePath"="\SystemRoot\system32\drivers\arc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\arcsas]
    "ImagePath"="\SystemRoot\system32\drivers\arcsas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AsyncMac]
    "ImagePath"="system32\DRIVERS\asyncmac.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi]
    "ImagePath"="system32\drivers\atapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\athr]
    "ImagePath"="system32\DRIVERS\athr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ati External Event Utility]
    "ImagePath"="%SystemRoot%\system32\Ati2evxx.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Atierecord]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atikmdag]
    "ImagePath"="system32\DRIVERS\atikmdag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AtiPcie]
    "ImagePath"="system32\DRIVERS\AtiPcie.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AudioEndpointBuilder]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Audiosrv]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avg]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVG Security Toolbar Service]
    "ImagePath"="c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSAgent]
    "ImagePath"="\"c:\program files\AVG\AVG2013\avgidsagent.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdriverx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSHX]
    "ImagePath"="system32\DRIVERS\avgidshx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSShim]
    "ImagePath"="system32\DRIVERS\avgidsshimx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgldx86]
    "ImagePath"="system32\DRIVERS\avgldx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avglogx]
    "ImagePath"="system32\DRIVERS\avglogx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgmfx86]
    "ImagePath"="system32\DRIVERS\avgmfx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgrkx86]
    "ImagePath"="system32\DRIVERS\avgrkx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgtdix]
    "ImagePath"="system32\DRIVERS\avgtdix.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avgtp]
    "ImagePath"="\??\c:\windows\system32\drivers\avgtpx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\avgwd]
    "ImagePath"="\"c:\program files\AVG\AVG2013\avgwdsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\b57nd60x]
    "ImagePath"="system32\DRIVERS\b57nd60x.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BattC]
    "MofImagePath"="system32\drivers\battc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Beep]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BFE]
    "ServiceDll"="%SystemRoot%\System32\bfe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]
    "ServiceDll"="%systemroot%\system32\qmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\blbdrive]
    "ImagePath"="\SystemRoot\system32\drivers\blbdrive.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bonjour Service]
    "ImagePath"="\"c:\program files\Bonjour\mDNSResponder.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bowser]
    "ImagePath"="system32\DRIVERS\bowser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrFiltLo]
    "ImagePath"="\SystemRoot\system32\drivers\brfiltlo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrFiltUp]
    "ImagePath"="\SystemRoot\system32\drivers\brfiltup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Browser]
    "ServiceDll"="%SystemRoot%\System32\browser.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Brserid]
    "ImagePath"="\SystemRoot\system32\drivers\brserid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrSerWdm]
    "ImagePath"="\SystemRoot\system32\drivers\brserwdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrUsbMdm]
    "ImagePath"="\SystemRoot\system32\drivers\brusbmdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BrUsbSer]
    "ImagePath"="\SystemRoot\system32\drivers\brusbser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHMODEM]
    "ImagePath"="\SystemRoot\system32\drivers\bthmodem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BUNAgentSvc]
    "ImagePath"="\"c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BVRPMPR5]
    "ImagePath"="\??\c:\windows\system32\drivers\BVRPMPR5.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\catchme]
    "ImagePath"="\??\c:\users\Aky\AppData\Local\Temp\catchme.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdfs]
    "ImagePath"="system32\DRIVERS\cdfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cdrom]
    "ImagePath"="system32\DRIVERS\cdrom.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CertPropSvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\circlass]
    "ImagePath"="\SystemRoot\system32\drivers\circlass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CLFS]
    "ImagePath"="System32\CLFS.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CLHNService]
    "ImagePath"="c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\clr_optimization_v2.0.50727_32]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\clr_optimization_v4.0.30319_32]
    "ImagePath"="c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CmBatt]
    "ImagePath"="system32\DRIVERS\CmBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdide]
    "ImagePath"="\SystemRoot\system32\drivers\cmdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Compbatt]
    "ImagePath"="system32\DRIVERS\compbatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\COMSysApp]
    "ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crcdisk]
    "ImagePath"="system32\drivers\crcdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Crusoe]
    "ImagePath"="\SystemRoot\system32\drivers\crusoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CryptSvc]
    "ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CSC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DCLocator]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DcomLaunch]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DfsC]
    "ImagePath"="System32\Drivers\dfsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DFSR]
    "ImagePath"="%SystemRoot%\system32\DFSR.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp]
    "ServiceDll"="%SystemRoot%\system32\dhcpcsvc.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk]
    "ImagePath"="system32\drivers\disk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DKbFltr]
    "ImagePath"="system32\DRIVERS\DKbFltr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache]
    "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dot3svc]
    "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DPS]
    "ServiceDll"="%SystemRoot%\system32\dps.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drmkaud]
    "ImagePath"="system32\drivers\drmkaud.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DXGKrnl]
    "ImagePath"="\SystemRoot\System32\drivers\dxgkrnl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\E1G60]
    "ImagePath"="system32\DRIVERS\E1G60I32.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EapHost]
    "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ecache]
    "ImagePath"="System32\drivers\ecache.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\eDataSecurity Service]
    "ImagePath"="\"c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\elxstor]
    "ImagePath"="\SystemRoot\system32\drivers\elxstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EmdCache]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EMDMgmt]
    "ServiceDll"="%systemroot%\system32\emdmgmt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ErrDev]
    "ImagePath"="\SystemRoot\system32\drivers\errdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ESENT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ETService]
    "ImagePath"="c:\program files\Acer\Empowering Technology\Service\ETService.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog]
    "ServiceDll"="%SystemRoot%\System32\wevtsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventSystem]
    "ServiceDll"="%systemroot%\system32\es.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fdc]
    "ImagePath"="system32\DRIVERS\fdc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fdPHost]
    "ServiceDll"="%SystemRoot%\system32\fdPHost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FDResPub]
    "ServiceDll"="%SystemRoot%\system32\fdrespub.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FileInfo]
    "ImagePath"="system32\drivers\fileinfo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Filetrace]
    "ImagePath"="system32\drivers\filetrace.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\flpydisk]
    "ImagePath"="system32\DRIVERS\flpydisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FltMgr]
    "ImagePath"="system32\drivers\fltmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FontCache]
    "ServiceDll"="%SystemRoot%\system32\FntCache.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FontCache3.0.0.0]
    "ImagePath"="%systemroot%\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Fs_Rec]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gagp30kx]
    "ImagePath"="\SystemRoot\system32\drivers\gagp30kx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GEARAspiWDM]
    "ImagePath"="system32\DRIVERS\GEARAspiWDM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gpsvc]
    "ServiceDll"="%SystemRoot%\System32\gpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gupdate]
    "ImagePath"="\"c:\program files\Google\Update\GoogleUpdate.exe\" /svc"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gupdatem]
    "ImagePath"="\"c:\program files\Google\Update\GoogleUpdate.exe\" /medsvc"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HdAudAddService]
    "ImagePath"="system32\drivers\HdAudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HDAudBus]
    "ImagePath"="system32\DRIVERS\HDAudBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidBth]
    "ImagePath"="\SystemRoot\system32\drivers\hidbth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidIr]
    "ImagePath"="\SystemRoot\system32\drivers\hidir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hidserv]
    "ServiceDll"="%SystemRoot%\System32\hidserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidUsb]
    "ImagePath"="system32\DRIVERS\hidusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hkmsvc]
    "ServiceDLL"="%SystemRoot%\system32\kmsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HpCISSs]
    "ImagePath"="\SystemRoot\system32\drivers\hpcisss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HSFHWAZL]
    "ImagePath"="system32\DRIVERS\VSTAZL3.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HSF_DPV]
    "ImagePath"="system32\DRIVERS\HSX_DPV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HSXHWAZL]
    "ImagePath"="system32\DRIVERS\HSXHWAZL.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HTTP]
    "ImagePath"="system32\drivers\HTTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i2omp]
    "ImagePath"="\SystemRoot\system32\drivers\i2omp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i8042prt]
    "ImagePath"="system32\DRIVERS\i8042prt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iaStorV]
    "ImagePath"="\SystemRoot\system32\drivers\iastorv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\idsvc]
    "ImagePath"="\"%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iirsp]
    "ImagePath"="\SystemRoot\system32\drivers\iirsp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IKEEXT]
    "ServiceDll"="%SystemRoot%\System32\ikeext.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\inetaccs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\int15]
    "ImagePath"="\??\c:\windows\system32\drivers\int15.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IntcAzAudAddService]
    "ImagePath"="system32\drivers\RTKVHDA.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\intelide]
    "ImagePath"="\SystemRoot\system32\drivers\intelide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\intelppm]
    "ImagePath"="system32\DRIVERS\intelppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPBusEnum]
    "ServiceDll"="%SystemRoot%\system32\ipbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IpFilterDriver]
    "ImagePath"="system32\DRIVERS\ipfltdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iphlpsvc]
    "ServiceDll"="%SystemRoot%\System32\iphlpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IpInIp]
    "ImagePath"="system32\DRIVERS\ipinip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPMIDRV]
    "ImagePath"="\SystemRoot\system32\drivers\ipmidrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IPNAT]
    "ImagePath"="system32\DRIVERS\ipnat.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iPod Service]
    "ImagePath"="\"c:\program files\iPod\bin\iPodService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\irda]
    "ImagePath"="system32\DRIVERS\irda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\IRENUM]
    "ImagePath"="system32\drivers\irenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Irmon]
    "ServiceDll"="%SystemRoot%\System32\irmon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\isapnp]
    "ImagePath"="\SystemRoot\system32\drivers\isapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iScsiPrt]
    "ImagePath"="system32\DRIVERS\msiscsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iteatapi]
    "ImagePath"="\SystemRoot\system32\drivers\iteatapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\iteraid]
    "ImagePath"="\SystemRoot\system32\drivers\iteraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kbdclass]
    "ImagePath"="system32\DRIVERS\kbdclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kbdhid]
    "ImagePath"="system32\DRIVERS\kbdhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KeyIso]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KSecDD]
    "ImagePath"="System32\Drivers\ksecdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KtmRm]
    "ServiceDll"="%systemroot%\system32\msdtckrm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanServer]
    "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation]
    "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ldap]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LightScribeService]
    "ImagePath"="\"c:\program files\Common Files\LightScribe\LSSrvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lltdio]
    "ImagePath"="system32\DRIVERS\lltdio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lltdsvc]
    "ServiceDll"="%SystemRoot%\System32\lltdsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lmhosts]
    "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lsa]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LSI_FC]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_fc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LSI_SAS]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_sas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LSI_SCSI]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_scsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\luafv]
    "ImagePath"="\SystemRoot\system32\drivers\luafv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMProtector]
    "ImagePath"="\??\c:\windows\system32\drivers\mbam.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMScheduler]
    "ImagePath"="\"c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMService]
    "ImagePath"="\"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mdmxsdk]
    "ImagePath"="system32\DRIVERS\mdmxsdk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\megasas]
    "ImagePath"="\SystemRoot\system32\drivers\megasas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MegaSR]
    "ImagePath"="\SystemRoot\system32\drivers\megasr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MMCSS]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MobilityService]
    "ImagePath"="c:\acer\Mobility Center\MobilityService.exe -p"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Modem]
    "ImagePath"="system32\drivers\modem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\monitor]
    "ImagePath"="system32\DRIVERS\monitor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouclass]
    "ImagePath"="system32\DRIVERS\mouclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouhid]
    "ImagePath"="system32\DRIVERS\mouhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MountMgr]
    "ImagePath"="System32\drivers\mountmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpio]
    "ImagePath"="\SystemRoot\system32\drivers\mpio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpsdrv]
    "ImagePath"="System32\drivers\mpsdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MpsSvc]
    "ServiceDll"="%SystemRoot%\system32\mpssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mraid35x]
    "ImagePath"="\SystemRoot\system32\drivers\mraid35x.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MRxDAV]
    "ImagePath"="\SystemRoot\system32\drivers\mrxdav.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mrxsmb]
    "ImagePath"="system32\DRIVERS\mrxsmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mrxsmb10]
    "ImagePath"="system32\DRIVERS\mrxsmb10.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mrxsmb20]
    "ImagePath"="system32\DRIVERS\mrxsmb20.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msahci]
    "ImagePath"="system32\drivers\msahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msdsm]
    "ImagePath"="\SystemRoot\system32\drivers\msdsm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC]
    "ImagePath"="%SystemRoot%\System32\msdtc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Msfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msisadrv]
    "ImagePath"="system32\drivers\msisadrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSiSCSI]
    "ServiceDll"="%systemroot%\system32\iscsiexe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\msiserver]
    "ImagePath"="%systemroot%\system32\msiexec.exe /V"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSKSSRV]
    "ImagePath"="system32\drivers\MSKSSRV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSPCLOCK]
    "ImagePath"="system32\drivers\MSPCLOCK.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSPQM]
    "ImagePath"="system32\drivers\MSPQM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MsRPC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSSCNTRS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mssmbios]
    "ImagePath"="system32\DRIVERS\mssmbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTEE]
    "ImagePath"="system32\drivers\MSTEE.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mup]
    "ImagePath"="System32\Drivers\mup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\napagent]
    "ServiceDLL"="%SystemRoot%\system32\qagentRT.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NativeWifiP]
    "ImagePath"="system32\DRIVERS\nwifi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NDIS]
    "ImagePath"="system32\drivers\ndis.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NdisTapi]
    "ImagePath"="system32\DRIVERS\ndistapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndisuio]
    "ImagePath"="system32\DRIVERS\ndisuio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NdisWan]
    "ImagePath"="system32\DRIVERS\ndiswan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NDProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBIOS]
    "ImagePath"="system32\DRIVERS\netbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netbt]
    "ImagePath"="System32\DRIVERS\netbt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netlogon]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netman]
    "ServiceDll"="%SystemRoot%\System32\netman.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netprofm]
    "ServiceDll"="%SystemRoot%\System32\netprofm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetTcpPortSharing]
    "ImagePath"="\"%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nfrd960]
    "ImagePath"="\SystemRoot\system32\drivers\nfrd960.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NlaSvc]
    "ServiceDll"="%SystemRoot%\System32\nlasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nmwcd]
    "ImagePath"="system32\drivers\ccdcmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nmwcdc]
    "ImagePath"="system32\drivers\ccdcmbo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Npfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NSCIRDA]
    "ImagePath"="system32\DRIVERS\nscirda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nsi]
    "ServiceDll"="%systemroot%\system32\nsisvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nsiproxy]
    "ImagePath"="system32\drivers\nsiproxy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTDS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ntfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTIBackupSvc]
    "ImagePath"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTIDrvr]
    "ImagePath"="system32\DRIVERS\NTIDrvr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTIPPKernel]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NTISchedulerSvc]
    "ImagePath"="c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ntrigdigi]
    "ImagePath"="\SystemRoot\system32\drivers\ntrigdigi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Null]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nvraid]
    "ImagePath"="\SystemRoot\system32\drivers\nvraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nvstor]
    "ImagePath"="\SystemRoot\system32\drivers\nvstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nv_agp]
    "ImagePath"="\SystemRoot\system32\drivers\nv_agp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NwlnkFlt]
    "ImagePath"="system32\DRIVERS\nwlnkflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NwlnkFwd]
    "ImagePath"="system32\DRIVERS\nwlnkfwd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\odserv]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ohci1394]
    "ImagePath"="system32\DRIVERS\ohci1394.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ose]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2pimsvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\p2psvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Parport]
    "ImagePath"="\SystemRoot\system32\drivers\parport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr]
    "ImagePath"="System32\drivers\partmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Parvdm]
    "ImagePath"="\SystemRoot\system32\drivers\parvdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PcaSvc]
    "ServiceDll"="%SystemRoot%\System32\pcasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pccsmcfd]
    "ImagePath"="system32\DRIVERS\pccsmcfd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pci]
    "ImagePath"="system32\drivers\pci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pciide]
    "ImagePath"="\SystemRoot\system32\drivers\pciide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pcmcia]
    "ImagePath"="\SystemRoot\system32\DRIVERS\pcmcia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PEAUTH]
    "ImagePath"="system32\drivers\peauth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfDisk]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfNet]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfOS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfProc]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pla]
    "ServiceDll"="%systemroot%\system32\pla.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PlugPlay]
    "ServiceDll"="%SystemRoot%\system32\umpnpmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PNRPAutoReg]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PNRPsvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PolicyAgent]
    "ServiceDll"="%SystemRoot%\System32\ipsecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PortProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PptpMiniport]
    "ImagePath"="system32\DRIVERS\raspptp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Processor]
    "ImagePath"="system32\DRIVERS\processr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ProfSvc]
    "ServiceDll"="%systemroot%\system32\profsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ProtectedStorage]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSched]
    "ImagePath"="system32\DRIVERS\pacer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSDFilter]
    "ImagePath"="system32\DRIVERS\psdfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSDNServ]
    "ImagePath"="system32\DRIVERS\PSDNServ.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\psdvdisk]
    "ImagePath"="system32\DRIVERS\PSDVdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ql2300]
    "ImagePath"="\SystemRoot\system32\drivers\ql2300.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ql40xx]
    "ImagePath"="\SystemRoot\system32\drivers\ql40xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QWAVE]
    "ServiceDll"="%windir%\system32\qwave.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\QWAVEdrv]
    "ImagePath"="\SystemRoot\system32\drivers\qwavedrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasAcd]
    "ImagePath"="System32\DRIVERS\rasacd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasAuto]
    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Rasl2tp]
    "ImagePath"="system32\DRIVERS\rasl2tp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasMan]
    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasPppoe]
    "ImagePath"="system32\DRIVERS\raspppoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasSstp]
    "ImagePath"="system32\DRIVERS\rassstp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdbss]
    "ImagePath"="system32\DRIVERS\rdbss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPCDD]
    "ImagePath"="System32\DRIVERS\RDPCDD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rdpdr]
    "ImagePath"="\SystemRoot\system32\drivers\rdpdr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPENCDD]
    "ImagePath"="system32\drivers\rdpencdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPWD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Realtek USB 2.0 Card Reader]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess]
    "ServiceDLL"="%SystemRoot%\System32\mprdim.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteRegistry]
    "ServiceDll"="%SystemRoot%\system32\regsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcLocator]
    "ImagePath"="%SystemRoot%\system32\locator.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RpcSs]
    "ServiceDll"="%SystemRoot%\System32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rspndr]
    "ImagePath"="system32\DRIVERS\rspndr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RTSTOR]
    "ImagePath"="system32\drivers\RTSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SamSs]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sbp2port]
    "ImagePath"="\SystemRoot\system32\drivers\sbp2port.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SCardSvr]
    "ServiceDll"="%SystemRoot%\System32\SCardSvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule]
    "ServiceDll"="%systemroot%\system32\schedsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SCPolicySvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sdbus]
    "ImagePath"="system32\DRIVERS\sdbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SDRSVC]
    "ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\secdrv]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\seclogon]
    "ServiceDll"="%windir%\system32\seclogon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SENS]
    "ServiceDll"="%SystemRoot%\system32\sens.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serenum]
    "ImagePath"="\SystemRoot\system32\drivers\serenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serial]
    "ImagePath"="\SystemRoot\system32\drivers\serial.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sermouse]
    "ImagePath"="\SystemRoot\system32\drivers\sermouse.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceLayer]
    "ImagePath"="\"c:\program files\PC Connectivity Solution\ServiceLayer.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SessionEnv]
    "ServiceDLL"="%SystemRoot%\system32\sessenv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sffdisk]
    "ImagePath"="\SystemRoot\system32\drivers\sffdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sffp_mmc]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_mmc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sffp_sd]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_sd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sfloppy]
    "ImagePath"="system32\DRIVERS\sfloppy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess]
    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ShellHWDetection]
    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sisagp]
    "ImagePath"="\SystemRoot\system32\drivers\sisagp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SiSRaid2]
    "ImagePath"="\SystemRoot\system32\drivers\sisraid2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SiSRaid4]
    "ImagePath"="\SystemRoot\system32\drivers\sisraid4.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\slsvc]
    "ImagePath"="%SystemRoot%\system32\SLsvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SLUINotify]
    "ServiceDll"="%SystemRoot%\system32\SLUINotify.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Smb]
    "ImagePath"="system32\DRIVERS\smb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SNMPTRAP]
    "ImagePath"="%SystemRoot%\System32\snmptrap.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\spldr]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler]
    "ImagePath"="%SystemRoot%\System32\spoolsv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srv]
    "ImagePath"="System32\DRIVERS\srv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srv2]
    "ImagePath"="System32\DRIVERS\srv2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srvnet]
    "ImagePath"="System32\DRIVERS\srvnet.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadbus]
    "ImagePath"="system32\DRIVERS\ssadbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadmdfl]
    "ImagePath"="system32\DRIVERS\ssadmdfl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadmdm]
    "ImagePath"="system32\DRIVERS\ssadmdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ssadserd]
    "ImagePath"="system32\DRIVERS\ssadserd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SSDPSRV]
    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SstpSvc]
    "ServiceDll"="%SystemRoot%\system32\sstpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stisvc]
    "ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\swenum]
    "ImagePath"="system32\DRIVERS\swenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\swprv]
    "ServiceDll"="%Systemroot%\System32\swprv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Symc8xx]
    "ImagePath"="\SystemRoot\system32\drivers\symc8xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sym_hi]
    "ImagePath"="\SystemRoot\system32\drivers\sym_hi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sym_u3]
    "ImagePath"="\SystemRoot\system32\drivers\sym_u3.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SynTP]
    "ImagePath"="system32\DRIVERS\SynTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SysMain]
    "ServiceDll"="%systemroot%\system32\sysmain.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TabletInputService]
    "ServiceDll"="%SystemRoot%\System32\TabSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TapiSrv]
    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBS]
    "ServiceDll"="%SystemRoot%\System32\tbssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip]
    "ImagePath"="System32\drivers\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6]
    "ImagePath"="system32\DRIVERS\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tcpipreg]
    "ImagePath"="System32\drivers\tcpipreg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDPIPE]
    "ImagePath"="system32\drivers\tdpipe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDTCP]
    "ImagePath"="system32\drivers\tdtcp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdx]
    "ImagePath"="system32\DRIVERS\tdx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermDD]
    "ImagePath"="system32\DRIVERS\termdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService]
    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Themes]
    "ServiceDll"="%SystemRoot%\system32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\THREADORDER]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks]
    "ServiceDll"="%SystemRoot%\System32\trkwks.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustedInstaller]
    "ImagePath"="%SystemRoot%\servicing\TrustedInstaller.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TSDDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tssecsrv]
    "ImagePath"="System32\DRIVERS\tssecsrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tunmp]
    "ImagePath"="system32\DRIVERS\tunmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tunnel]
    "ImagePath"="system32\DRIVERS\tunnel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uagp35]
    "ImagePath"="\SystemRoot\system32\drivers\uagp35.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UBHelper]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\udfs]
    "ImagePath"="system32\DRIVERS\udfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UGatherer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UGTHRSVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UI0Detect]
    "ImagePath"="%SystemRoot%\system32\UI0Detect.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uliagpkx]
    "ImagePath"="\SystemRoot\system32\drivers\uliagpkx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uliahci]
    "ImagePath"="\SystemRoot\system32\drivers\uliahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UlSata]
    "ImagePath"="\SystemRoot\system32\drivers\ulsata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ulsata2]
    "ImagePath"="\SystemRoot\system32\drivers\ulsata2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\umbus]
    "ImagePath"="system32\DRIVERS\umbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\upnphost]
    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\upperdev]
    "ImagePath"="system32\DRIVERS\usbser_lowerflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usb]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBAAPL]
    "ImagePath"="System32\Drivers\usbaapl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbccgp]
    "ImagePath"="system32\DRIVERS\usbccgp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbcir]
    "ImagePath"="\SystemRoot\system32\drivers\usbcir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbehci]
    "ImagePath"="system32\DRIVERS\usbehci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbfilter]
    "ImagePath"="system32\DRIVERS\usbfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbhub]
    "ImagePath"="system32\DRIVERS\usbhub.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbohci]
    "ImagePath"="system32\DRIVERS\usbohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbprint]
    "ImagePath"="system32\DRIVERS\usbprint.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbser]
    "ImagePath"="system32\DRIVERS\usbser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UsbserFilt]
    "ImagePath"="system32\DRIVERS\usbser_lowerfltj.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR]
    "ImagePath"="system32\DRIVERS\USBSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbuhci]
    "ImagePath"="system32\DRIVERS\usbuhci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbvideo]
    "ImagePath"="System32\Drivers\usbvideo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UxSms]
    "ServiceDll"="%SystemRoot%\System32\uxsms.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vds]
    "ImagePath"="%SystemRoot%\System32\vds.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vga]
    "ImagePath"="system32\DRIVERS\vgapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VgaSave]
    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\viaagp]
    "ImagePath"="\SystemRoot\system32\drivers\viaagp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ViaC7]
    "ImagePath"="\SystemRoot\system32\drivers\viac7.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\viaide]
    "ImagePath"="\SystemRoot\system32\drivers\viaide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\volmgr]
    "ImagePath"="system32\drivers\volmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\volmgrx]
    "ImagePath"="System32\drivers\volmgrx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\volsnap]
    "ImagePath"="system32\drivers\volsnap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vsmraid]
    "ImagePath"="\SystemRoot\system32\drivers\vsmraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS]
    "ImagePath"="%systemroot%\system32\vssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vToolbarUpdater13.2.0]
    "ImagePath"="c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time]
    "ServiceDll"="%systemroot%\system32\w32time.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W3SVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WacomPen]
    "ImagePath"="\SystemRoot\system32\drivers\wacompen.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wanarp]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wanarpv6]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wcncsvc]
    "ServiceDll"="%SystemRoot%\System32\wcncsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WcsPlugInService]
    "ServiceDll"="%SystemRoot%\System32\WcsPlugInService.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wd]
    "ImagePath"="\SystemRoot\system32\drivers\wd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wdf01000]
    "ImagePath"="system32\drivers\Wdf01000.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdiServiceHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdiSystemHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient]
    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wecsvc]
    "ServiceDll"="%SystemRoot%\system32\wecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wercplsupport]
    "ServiceDll"="%SystemRoot%\System32\wercplsupport.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc]
    "ServiceDll"="%SystemRoot%\System32\WerSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winachsf]
    "ImagePath"="system32\DRIVERS\HSX_CNXT.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend]
    "ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinHttpAutoProxySvc]
    "ServiceDll"="winhttp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmgmt]
    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinRM]
    "ServiceDll"="%SystemRoot%\system32\WsmSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wlansvc]
    "ServiceDll"="%SystemRoot%\System32\wlansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmiAcpi]
    "ImagePath"="system32\DRIVERS\wmiacpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wmiApSrv]
    "ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WMPNetworkSvc]
    "ImagePath"="\"%ProgramFiles%\Windows Media Player\wmpnetwk.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WPCSvc]
    "ServiceDll"="%SystemRoot%\System32\wpcsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WPDBusEnum]
    "ServiceDll"="%SystemRoot%\system32\wpdbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WpdUsb]
    "ImagePath"="system32\DRIVERS\wpdusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WPFFontCache_v0400]
    "ImagePath"="c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ws2ifsl]
    "ImagePath"="\SystemRoot\system32\drivers\ws2ifsl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WSearch]
    "ImagePath"="%systemroot%\system32\SearchIndexer.exe /Embedding"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WSearchIdxPi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv]
    "ServiceDll"="%systemroot%\system32\wuaueng.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WudfPf]
    "ImagePath"="system32\drivers\WudfPf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WUDFRd]
    "ImagePath"="system32\DRIVERS\WUDFRd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wudfsvc]
    "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\XAudio]
    "ImagePath"="system32\DRIVERS\xaudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\XAudioService]
    "ImagePath"="%SystemRoot%\system32\DRIVERS\xaudio.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xmlprov]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{580CFBD5-DEEF-445C-AA1D-2C41A2412BF5}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{AAF7D1EC-25F8-482E-B66D-42E0FF000732}]
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-2348374830-1884495636-3650376586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**ˆ]
    @Class="Shell"
    .
    [HKEY_USERS\S-1-5-21-2348374830-1884495636-3650376586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**ˆ\OpenWithList]
    @Class="Shell"
    "a"="vlc.exe"
    "MRUList"="a"
    .
    [HKEY_USERS\S-1-5-21-2348374830-1884495636-3650376586-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**ˆ]
    "0"=hex:66,69,6c,65,3a,2f,2f,2f,43,3a,2f,55,73,65,72,73,2f,41,6b,79,2f,44,65,
    73,6b,74,6f,70,2f,41,6b,79,2f,4d,75,73,69,63,2f,4d,75,73,69,63,2f,45,6e,67,\
    "MRUListEx"=hex:01,00,00,00,00,00,00,00,ff,ff,ff,ff
    "1"=hex:66,69,6c,65,3a,2f,2f,2f,43,3a,2f,55,73,65,72,73,2f,41,6b,79,2f,44,65,
    73,6b,74,6f,70,2f,41,6b,79,2f,4d,75,73,69,63,2f,4d,75,73,69,63,2f,45,6e,67,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'Explorer.exe'(3144)
    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
    c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
    c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
    c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
    c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\progra~1\AVG\AVG2013\avgrsx.exe
    c:\program files\AVG\AVG2013\avgcsrvx.exe
    c:\windows\system32\Ati2evxx.exe
    c:\windows\system32\Ati2evxx.exe
    c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\AVG\AVG2013\avgidsagent.exe
    c:\program files\AVG\AVG2013\avgwdsvc.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
    c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
    c:\acer\Mobility Center\MobilityService.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\AVG\AVG2013\avgnsx.exe
    c:\windows\servicing\TrustedInstaller.exe
    .
    **************************************************************************
    .
    Completion time: 2012-11-25 19:06:37 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-11-25 19:06
    ComboFix2.txt 2012-11-24 21:13
    ComboFix3.txt 2012-11-24 00:43
    .
    Pre-Run: 61,523,505,152 bytes free
    Post-Run: 61,500,100,608 bytes free
    .
    - - End Of File - - C089949D8487D6D62DCCB31110935DF9
     
    FloydPalmer, Nov 25, 2012
    #23
  5. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    Talk about patience, 2 plus hours for this report! lol

    C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll Win32/Adware.Yontoo.B application cleaned by deleting - quarantined
    C:\System Volume Information\SystemRestore\FRStaging\Users\Aky\AppData\Local\Temp\Toolbar_Phpnuke.exe Win32/Toolbar.Babylon application cleaned by deleting - quarantined
    C:\System Volume Information\SystemRestore\FRStaging\Users\Aky\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe Win32/Toolbar.Babylon application cleaned by deleting - quarantined
    C:\System Volume Information\SystemRestore\FRStaging\Users\Aky\AppData\Local\Temp\miaC519.tmp\data\OFFLINE\D038292B\DBD9B16A\Launcher.exe Win32/RegistryBooster application cleaned by deleting - quarantined
    C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\extensions\plugin@yontoo.com\content\overlay.js Win32/Adware.Yontoo application cleaned by deleting - quarantined
    C:\Users\Aky\Downloads\FinalMediaPlayer2011Setup.exe a variant of Win32/InstallIQ application cleaned by deleting - quarantined
    C:\Users\Aky\Downloads\installer_intervideo_windvd.exe multiple threats cleaned by deleting - quarantined
     
    FloydPalmer, Nov 25, 2012
    #24
  6. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    2 hours isn't too bad believe it or not! Nothing too major there. How is your computer running at this point?
     
    etavares, Nov 26, 2012
    #25
  7. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    At the moment, it's running OK. The ititali tab hasn't popped up so far and good omen is that the forums I visit, some had an ad attached to certain words (such as Motoring, Video Games) but they don't appear. My internet connection is a tad temperamental, difficult to assess if that is down to ad-ware or just my router.

    So the ititali tab, was that already pre-existing on the system? I assumed I'd contracted it from some dodgy site or something..?

    And finally, just for my own knowledge, would you be able to explain what we've done throughout the process?

    Thanks bud :)
     
    FloydPalmer, Nov 27, 2012
    #26
  8. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    Hi FloydPalmer,

    We removed some orphaned entries (leftover registry items) and we also removed the Babylon toolbar which is adware and is the likely cause of the issues you had. Then the online scan finished up and got a few remaining items.

    Let's run adwcleaner to see if there's anything left that can explain your internet issues. Is this a wired or wireless connection?

    Download AdwCleaner here:
    http://www.bleepingcomputer.com/download/adwcleaner/dl/125/

    Save it to your desktop. Double-click to run it. Click Search and post the resulting log in your reply.

    -etavares
     
    etavares, Nov 27, 2012
    #27
  9. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    I have a wireless connection. I'm based in our loft, so I moved my laptop to the next floor below to see if it was the distance to the router that was the issue and it did pick up speed but I've hardly had issues of internet working slow in the loft.

    # AdwCleaner v2.009 - Logfile created 11/28/2012 at 17:34:03
    # Updated 24/11/2012 by Xplode
    # Operating system : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
    # User : Aky - AKY-PC
    # Boot Mode : Normal
    # Running from : C:\Users\Aky\Desktop\AdwCleaner.exe
    # Option [Search]


    ***** [Services] *****


    ***** [Files / Folders] *****

    File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
    File Found : C:\user.js
    Folder Found : C:\Program Files\AVG Secure Search
    Folder Found : C:\Program Files\Common Files\AVG Secure Search
    Folder Found : C:\Program Files\Yontoo Layers Client
    Folder Found : C:\ProgramData\AVG Secure Search
    Folder Found : C:\ProgramData\Babylon
    Folder Found : C:\ProgramData\Tarma Installer
    Folder Found : C:\Users\Aky\AppData\Local\AVG Secure Search
    Folder Found : C:\Users\Aky\AppData\Local\Babylon
    Folder Found : C:\Users\Aky\AppData\LocalLow\AVG Secure Search
    Folder Found : C:\Users\Aky\AppData\LocalLow\BabylonToolbar
    Folder Found : C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\extensions\plugin@yontoo.com

    ***** [Registry] *****

    Key Found : HKCU\Software\AVG Secure Search
    Key Found : HKCU\Software\Conduit
    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
    Key Found : HKLM\Software\AVG Secure Search
    Key Found : HKLM\Software\Babylon
    Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
    Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
    Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
    Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
    Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
    Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
    Key Found : HKLM\SOFTWARE\Classes\Prod.cap
    Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
    Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
    Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
    Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
    Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
    Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
    Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
    Key Found : HKLM\Software\Conduit
    Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
    Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
    Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Registry is clean.

    -\\ Mozilla Firefox v9.0.1 (en-GB)

    Profile name : default
    File : C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\prefs.js

    Found : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\13.2.0.5");
    Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
    Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");
    Found : user_pref("extensions.BabylonToolbar_i.newTab", true);
    Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID= 112050&babsrc=[...]
    Found : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid=%7B0a71d742-943a-41f3-8505-07e337de002e[...]

    *************************

    AdwCleaner[R1].txt - [4171 octets] - [28/11/2012 17:34:03]

    ########## EOF - C:\AdwCleaner[R1].txt - [4231 octets] ##########
     
    FloydPalmer, Nov 28, 2012
    #28
  10. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    OK, there's still some leftovers. Run adwCleaner again, Scan, then click Delete and it will remove these items. Please post that log.

    In regards to the wireless, can you try connecting on a different network? Any issues on that network?

    -etavares
     
    etavares, Nov 28, 2012
    #29
  11. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    I don't have another network to connect to. I might give it a day or so having now done this recent scan and see if the deletion improves anything.

    # AdwCleaner v2.009 - Logfile created 11/29/2012 at 01:53:56
    # Updated 24/11/2012 by Xplode
    # Operating system : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
    # User : Aky - AKY-PC
    # Boot Mode : Normal
    # Running from : C:\Users\Aky\Desktop\AdwCleaner.exe
    # Option [Delete]


    ***** [Services] *****


    ***** [Files / Folders] *****

    Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search
    Deleted on reboot : C:\ProgramData\AVG Secure Search
    File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
    File Deleted : C:\user.js
    Folder Deleted : C:\Program Files\AVG Secure Search
    Folder Deleted : C:\Program Files\Yontoo Layers Client
    Folder Deleted : C:\ProgramData\Babylon
    Folder Deleted : C:\ProgramData\Tarma Installer
    Folder Deleted : C:\Users\Aky\AppData\Local\AVG Secure Search
    Folder Deleted : C:\Users\Aky\AppData\Local\Babylon
    Folder Deleted : C:\Users\Aky\AppData\LocalLow\AVG Secure Search
    Folder Deleted : C:\Users\Aky\AppData\LocalLow\BabylonToolbar
    Folder Deleted : C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\extensions\plugin@yontoo.com
    Folder Deleted : C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\extensions\staged

    ***** [Registry] *****

    Key Deleted : HKCU\Software\AVG Secure Search
    Key Deleted : HKCU\Software\Conduit
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
    Key Deleted : HKLM\Software\AVG Secure Search
    Key Deleted : HKLM\Software\Babylon
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
    Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
    Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
    Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
    Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
    Key Deleted : HKLM\Software\Conduit
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
    Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
    Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Registry is clean.

    -\\ Mozilla Firefox v9.0.1 (en-GB)

    Profile name : default
    File : C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\prefs.js

    C:\Users\Aky\AppData\Roaming\Mozilla\Firefox\Profiles\fyfoic31.default\user.js ... Deleted !

    Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\13.2.0.5");
    Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
    Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
    Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
    Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID= 112050&babsrc=[...]
    Deleted : user_pref("extensions.wips.stats.last_false_url", "isearch.avg.com");
    Deleted : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid=%7B0a71d742-943a-41f3-8505-07e337de002e[...]

    *************************

    AdwCleaner[R1].txt - [4300 octets] - [28/11/2012 17:34:03]
    AdwCleaner[R2].txt - [4544 octets] - [29/11/2012 01:53:41]
    AdwCleaner[S1].txt - [4683 octets] - [29/11/2012 01:53:56]

    ########## EOF - C:\AdwCleaner[S1].txt - [4743 octets] ##########
     
    FloydPalmer, Nov 28, 2012
    #30
  12. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    Looks good. While we're waiting, there was a McAfee remnant in your log. It looks like you used to use McAfee? Let's remove it:

    Download MCPR.exe via that direct link to McAfee and save it to your desktop.
    Right-click it and select Run as Administrator. Click Yes at the UAC prompt to allow it to run.
    Click Next twice.
    Provide the Captcha info and click Next.
    You should see a message saying Uninstall successful. Restart your computer after that.

    Let me know how that goes and how your internet connection is behaving.

    -etavares
     
    etavares, Nov 29, 2012
    #31
  13. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    Done that.

    I've tried a wired connection, and the internet speed was fine. Also used the wireless connection sat right next to my router. Brought my laptop up to my loft, and then it worked fine for 30mins and now its reverted to coming on intermittently. It can't be that it's too far from the router because its worked fine in the past.

    Thanks for all your help dude, job of ad-ware seems to have been done so muchas gracias!

    :D
     
    FloydPalmer, Nov 29, 2012
    #32
  14. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    Hello, FloydPalmer.

    Great, glad to hear it's working fine! :)

    Ok, good news. Your log appears clean. Let's clean up our mess. If your computer is running well; please do the steps listed below. At the end, I've also listed a few completely optional things you can do to further secure your computer. Safe surfing!



    Step 1

    Your Adobe Reader software is out of date and has known security holes. Please launch it, go to Help --> Check for Updates and let it update the main program if needed. Updates the languages and/or dictionaries is optional.



    Step 2



    Uninstall ComboFix and Clean Up
    Click Start > Run and type combofix /Uninstall click OK (Note the space between combofix and /Uninstall) See below:
    [​IMG]
    Please advise if this step is missed for any reason as it performs some important actions.

    Download and Run OTC

    We will now remove the tools we used during this fix using OTC.
    • Download OTC by OldTimer and save it to your desktop.
    • If that link doesn't work, try this one.
    • Double click [​IMG]icon to start the program. If you are using Vista, please right-click and choose run as administrator
    • Then Click the big [​IMG] button.
    • You will get a prompt saying "Begin Cleanup Process". Please select Yes.
    • Restart your computer when prompted.

    If you ran Defogger and disabled your emulator, please don't forget to run it again and reenable it. See the instructions here to do so.


    Optional Items

    Please take the time to read below to secure your machine and take the necessary steps to keep it that way.




    Protect yourself from malicious sites

    The HOSTS file can protect you from connecting to bad sites. See The Hosts File and what it can do for you for more background.




    Keep Windows Up to Date
    It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



    Update your AntiVirus Software

    It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. If you use a commercial antivirus program you must make sure you keep renewing your subscription. Otherwise, once your subscription runs out, you may not be able to update the programs virus definitions.


    Make sure your applications have all of their updates

    It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.






    Update all these programs regularly
    Make sure you update all your programs regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. You can use Secunia PSI to keep track of necessary updates. It can run in the background and constantly monitor your software; although I just run it once a week manually. It will alert you when an update is available for a variety of software. It is very useful.

    Follow this list and your potential for being infected again will reduce dramatically.

    Good luck!

    etavares
     
    etavares, Nov 30, 2012
    #33
  15. FloydPalmer

    FloydPalmer Registered Members

    Joined:
    Nov 16, 2012
    Messages:
    143
    Location:
    UK
    Operating System:
    Windows 7
    Thanks buddy for all your help! Everything seems in working order, just the internet speed but I won't bother you too much with that. I was abit apprehensive of doing all of this stuff myself but you really broke it down expertly and politely so thanks for your patience and support!

    Was the last step designed to erase everything? Combo fix has gone but AdCleaner, MCPR, TFC, and Erunt are still on the desktop. Just manually delete them or are they worth keeping in a folder for future use?
     
    FloydPalmer, Nov 30, 2012
    #34
  16. etavares

    etavares Malware Removal Specialist - Moderator

    Joined:
    Aug 6, 2011
    Messages:
    259
    Location:
    USA (GMT -5)
    Hi FloydPalmer,

    You're welcome! I'm glad we were able to get it back up and running.

    If you want, you can uninstall ERUNT from Add/Remove programs, and the rest you can just delete or keep. You can always download in the future. I would delete MCPR since McAfee is removed. AdwCleaner and TFC are up to you. ERUNT is a good tool to keep with XP, though. It saves a registry backup that you can restore from if the computer isn't booting. Just make sure you save this somewhere (not on your computer!) so you know how to user ERDNT (the restore tool inside ERUNT) in case your computer won't boot:
    http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

    Good luck!
    -etavares
     
    etavares, Dec 1, 2012
    #35
Page 2 of 2

Share This Page