..\Software\Microsoft\Windows\CurrentVersion\Run\\"windows system recover!"\"%root%\input\437_packed.win32.krap.t_20091130\af5fb40b.exe" |
..\Software\Microsoft\Windows\CurrentVersion\RunServices\\"updatewin"\"%win.sys32%\amcompatr.exe" |
..\Software\Microsoft\Windows\CurrentVersion\Run\\"updatewin"\"%win.sys32%\amcompatr.exe" |
..\Software\Microsoft\Windows\CurrentVersion\Run\\"windows system recover!"\"%das.au.ls%\temp\svchost.exe" |
..\System\CurrentControlSet\Services\SharedAccess\Parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List\"\??\%WIN.SYS32%\winlogon.exe"\"\??\%WIN.SYS32%\winlogon.exe:*:Enabled:rundll32" |
..\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Commander\(Default) |
..\Software\Microsoft\Windows\CurrentVersion\Run\\"servicelayer"\"%WIN%\servicelayer.exe" |
..\Software\Microsoft\Windows\CurrentVersion\Run\\"lsass"\"%WIN%\lsass.exe" |
..\Software\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7}\(Default) |
..\Software\Microsoft\Windows\CurrentVersion\Explorer\{19A28541-44B6-3A8F-7617-A6F225019B12}\(Default) |