WORM_AUTORUN.ZYC

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

Windowsをセーフモードで再起動します。

手順 3

このレジストリキーを削除します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
  • System

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • Svc

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • wscript.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • cscript.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • MSASCui.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • attrib.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • SSCVIHOST.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • blastclnnn.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • blastclnn.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • New Folder.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • scsaver.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • autorunme.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • ise32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • reg32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • ansavgd

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nprosec.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npc_login.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npc_tray.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npcsvc32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nuaa.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npflgutl.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npfports.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npfrules.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npfsvc32.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npfuser.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • npfwiz.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Nbrowser.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Njeeves.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nvcsched.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nvoy.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • Nvcoa.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • rtpsvc.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nod32krn.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nod32kui.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • egui.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • EHttpSrv.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • ekrn.exe

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
  • nod32.exe

手順 4

このレジストリ値を削除します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • CWS07D108? = "%User Profile%\Java\?shimgvw?.exe"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • jre? = "%User Profile%\Java\?Jview?.exe"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • ShowSuperHidden = "0"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • EnableLUA = "0"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
  • EnableLUA = "0"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • AntiVirusOverride = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • AntiVirusDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • FirewallDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • FirewallOverride = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • UpdatesDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • UacDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
  • FirstRunDisabled = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • AntiVirusOverride = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • AntiVirusDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • FirewallDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • FirewallOverride = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • UpdatesDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • UacDisableNotify = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • FirstRunDisabled = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
  • Debugger = "rundll32.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe
  • Debugger = "rundll32.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe
  • Debugger = "rundll32.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe
  • Debugger = "rundll32.exe"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSCVIHOST.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blastclnnn.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blastclnn.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\New Folder.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scsaver.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorunme.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ise32.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg32.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansavgd
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprosec.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npc_login.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npc_tray.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npcsvc32.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nuaa.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npflgutl.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfports.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfrules.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfsvc32.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfuser.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfwiz.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nbrowser.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsched.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvoy.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoa.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtpsvc.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe
  • Debugger = "cmd.exe /c del /f /q "

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe
  • Debugger = "cmd.exe /c del /f /q "

手順 5

変更されたレジストリ値を修正します。

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
  • From: UncheckedValue = "0"
    To: UncheckedValue = ""1""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
  • DefaultValue = "0"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
  • CheckedValue = "0"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • SuperHidden = "0"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
  • From: DefaultValue = "1"
    To: DefaultValue = ""1""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
  • UncheckedValue = "1"

• In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • From: HideFileExt = "1"
    To: HideFileExt = ""1""

• In HKEY_CURRENT_USER\Control Panel\Desktop
  • From: AutoEndTasks = "1"
    To: AutoEndTasks = ""0""

• In HKEY_CURRENT_USER\Control Panel\Desktop
  • From: HungAppTimeout = "400"
    To: HungAppTimeout = ""5000""

• In HKEY_CURRENT_USER\Control Panel\Desktop
  • From: WaitToKillAppTimeout = "400"
    To: WaitToKillAppTimeout = ""20000""

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control
  • From: WaitToKillServiceTimeout = "2000"
    To: WaitToKillServiceTimeout = ""20000""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
  • DisableSR = "1"

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi
  • From: LogSessionName = "stdout"
    To: LogSessionName = ""{random values}""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi
  • From: Active = "1"
    To: Active = ""1""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi
  • From: ControlFlags = "1"
    To: ControlFlags = ""1""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc
  • From: Guid = "8107d8e9-e323-49f5-bba2-abc35c243dca"
    To: Guid = ""8107d8e9-e323-49f5-bba2-abc35c243dca""

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc
  • From: BitNames = "{random characters}"
    To: BitNames = "" ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort""

手順 6

以下のファイルを検索し削除します。

• %User Temp%\aut1.tmp
• %User Temp%\flprrvi
• %Desktop%.ini
• %User Temp%\aut9.tmp
• %User Temp%\rxjxqtg
• %User Temp%\autD.tmp
• %User Temp%\ypuvttc
• %Application Data%\Microsoft\CD Burning\RÈCYCLER\Desktop.ini
• %Application Data%\Microsoft\CD Burning\autorun.inf
• %Temp%\rpegyowv.TMP
• %Application Data%\Microsoft\CD Burning\RÈCYCLER\thumbs.db

手順 7

以下のフォルダを検索し削除します。

• %User Profile%\Application Data\Java
• %Application Data%\Microsoft\CD Burning\RÈCYCLER

手順 8

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「WORM_AUTORUN.ZYC」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 9

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

• In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace
  • {7A9D77BD-5403-11d2-8785-2E0420524153}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • AppMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Base

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Boot Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Boot file system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • CryptSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • DcomLaunch

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmadmin

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmboot.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmio.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmload.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmserver

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • EventLog

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • File system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • HelpSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Netlogon

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • PCI Configuration

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • PlugPlay

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • PNP Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Primary disk

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • RpcSs

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • SCSI Class

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • sermouse.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • sr.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • SRService

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • System Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • vga.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • vgasave.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • WinMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {36FC9E60-C465-11CF-8056-444553540000}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E965-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E967-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E969-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E96A-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E96B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E96F-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E977-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E97B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E97D-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E980-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {71A27CDD-812A-11D0-BEC7-08002BE2092F}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
  • Minimal

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • AFD

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • AppMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Base

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Boot Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Boot file system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Browser

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • CryptSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • DcomLaunch

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Dhcp

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmadmin

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmboot.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmio.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmload.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmserver

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • DnsCache

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • EventLog

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • File system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • HelpSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • ip6fw.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • ipnat.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • LanmanServer

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • LanmanWorkstation

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • LmHosts

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Messenger

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NDIS

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NDIS Wrapper

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Ndisuio

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetBIOS

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetBIOSGroup

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetBT

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetDDEGroup

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Netlogon

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetMan

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
  • Network

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetworkProvider

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NtLmSsp

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PCI Configuration

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PlugPlay

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PNP Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PNP_TDI

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Primary disk

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdpcdd.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdpdd.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdpwd.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdsessmgr

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • RpcSs

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • SCSI Class

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • sermouse.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • SharedAccess

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • sr.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • SRService

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Streams Drivers

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • System Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Tcpip

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • TDI

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • tdpipe.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • tdtcp.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • termservice

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • vga.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • vgasave.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • WinMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • WZCSVC

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {36FC9E60-C465-11CF-8056-444553540000}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E965-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E967-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E969-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E96A-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E96B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E96F-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E972-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E973-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E974-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E975-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E977-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E97B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E97D-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E980-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {71A27CDD-812A-11D0-BEC7-08002BE2092F}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
  • Network

• In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
  • SafeBoot