TROJ_AGENT_012425.TOMB

December 10, 2012

ALIASES:

TrojanDropper:Win32/VB.IJ (Microsoft); Generic Dropper!1cq (McAfee); Trojan.Gen (Symantec); Trojan.Win32.Genome.tbbp (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Trojan.Generic.6010005 (FSecure)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

TECHNICAL DETAILS

File Size: 679,424 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 26 Nov 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

%Windows%\intell
%Windows%\ztop
%Windows%\dell
%User Profile%\Application Data\WinRAR

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnceEx\
windows
Entry1 = "%Windows%\web\printers\123.bat"

Other System Modifications

This Trojan deletes the following files:

%Temporary Internet Files%\desktop.ini
%Temporary Internet Files%\Content.IE5\desktop.ini
%Temporary Internet Files%\Content.IE5\index.dat
%Temporary Internet Files%\Content.IE5\2TPM8950\10_1_~1.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\16_1_~1.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~1.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~2.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~3.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~4.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\BOTTOM~1.PNG
%Temporary Internet Files%\Content.IE5\2TPM8950\BOX01_~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\BOX02_~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\BOX08_~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\desktop.ini
%Temporary Internet Files%\Content.IE5\2TPM8950\HEADER~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\JQUERY~1.JS
%Temporary Internet Files%\Content.IE5\2TPM8950\REPORT~1.PNG
%Temporary Internet Files%\Content.IE5\2TPM8950\TABLE_~1.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\10_1_~1.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~1.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~2.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~3.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~4.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\BOX07_~1.GIF
%Temporary Internet Files%\Content.IE5\4H9MXTT9\CALEND~1.JS
%Temporary Internet Files%\Content.IE5\4H9MXTT9\desktop.ini
%Temporary Internet Files%\Content.IE5\4H9MXTT9\DROPDO~1.JPG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\FOOTER~1.GIF
%Temporary Internet Files%\Content.IE5\4H9MXTT9\HEADER~1.JPG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\IMPORT~1.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\TABLE_~2.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\TABLE_~1.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\TRANSP~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\10_1_~1.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~1.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~2.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~3.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~4.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BACKGR~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BOX03_~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BOX04_~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BOX06_~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\CONFIG~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\desktop.ini
%Temporary Internet Files%\Content.IE5\SMCZPN4M\EDIT_I~1.PNG
%Temporary Internet Files%\Content.IE5\SMCZPN4M\JQUERY~1.JS
%Temporary Internet Files%\Content.IE5\SMCZPN4M\SANDBO~1.CSS
%Temporary Internet Files%\Content.IE5\SMCZPN4M\TOP_RI~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~1.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~2.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~3.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~4.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\1923A7~1.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\BOTTOM~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\BOX09_~1.GIF
%Temporary Internet Files%\Content.IE5\X9QQH2D9\DELETE~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\desktop.ini
%Temporary Internet Files%\Content.IE5\X9QQH2D9\JQUERY~1.JS
%Temporary Internet Files%\Content.IE5\X9QQH2D9\OVERLI~1.JS
%Temporary Internet Files%\Content.IE5\X9QQH2D9\SUNBEL~1.JPG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\TABLE_~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\TOP_LE~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\USERS_~1.PNG

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7.)

It deletes the following folders:

%System Root%\yjbf
d:\yjbf
e:\yjbf
f:\yjbf
g:\yjbf
h:\yjbf
%System Root%\ghost
d:\ghost
e:\ghost
f:\ghost
g:\ghost
h:\ghost
%System Root%\ghost..
d:\ghost..
e:\ghost..
f:\ghost..
g:\ghost..
h:\ghost..
%System Root%\ghost...
d:\ghost...
e:\ghost...
f:\ghost...
g:\ghost...
h:\ghost...
%System Root%\ghost....
d:\ghost....
e:\ghost....
f:\ghost....
g:\ghost....
h:\ghost....
%System Root%\~1
d:\~1
e:\~1
f:\~1
g:\~1
h:\~1

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnceEx\
windows

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\WgaLogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
AppMgmt

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{c6dc5466-785a-11d2-84d0-00c04fb169f7}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\
{00000000-0000-0000-0000-000000000000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\Loopback-GPLink-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\Loopback-GPO-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\
{00000000-0000-0000-0000-000000000000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\
{c6dc5466-785a-11d2-84d0-00c04fb169f7}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Loopback-GPLink-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Loopback-GPO-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\
{00000000-0000-0000-0000-000000000000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\Loopback-GPLink-List

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\Loopback-GPO-List

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{03db7c79-b75d-4114-8b91-8930e4dc132a}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{36bf1176-fd10-4acd-9bea-ef3f266e657c}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{40adb95d-5c05-4173-89b6-4b417b0f4e83}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{49cb8438-005d-4b50-a957-0e0987bb27ca}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{4c37f673-7019-4273-9296-25d8cfad8a0f}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{5367b703-1c3e-46b0-8793-867bddcbcf0c}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{71cd9643-417d-49d4-9ed5-c548bb555333}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{a5dccdde-eb53-4429-80c3-83d7da897f71}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{f83b4590-4544-4119-8557-d87b34780148}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{191cd7fa-f240-4a17-8986-94d480a6c8ca}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{7272edfb-af9f-4ddf-b65b-e4282f2deefc}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{8868b733-4b3a-48f8-9136-aa6d05d4fc83}

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{d2c34ab2-529a-46b2-b293-fc853fce72ea}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\WgaLogon
windows = "windows"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
Version = "2525"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
DSPath = "LocalGPO"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
FileSysPath = "%System%\GroupPolicy\Machine"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
DisplayName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
Extensions = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
Link = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
GPOName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
GPOLink = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
lParam = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
Version = "2525"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
DSPath = "LocalGPO"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
FileSysPath = "%System%\GroupPolicy\Machine"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
DisplayName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
Extensions = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
Link = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
GPOName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
GPOLink = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
lParam = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group1 = "S-1-1-0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group2 = "S-1-5-32-544"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group3 = "S-1-5-32-545"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group4 = "S-1-5-4"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group5 = "S-1-5-11"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Group6 = "S-1-2-0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
Count = "7"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group1 = "S-1-1-0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group2 = "S-1-5-21-1644491937-1757981266-1801674531-1006"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group3 = "S-1-5-32-544"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group4 = "S-1-5-32-545"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group5 = "S-1-5-4"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group6 = "S-1-5-11"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Group7 = "S-1-2-0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
Count = "8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group1 = "S-1-1-0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group2 = "S-1-5-32-546"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group3 = "S-1-5-32-544"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group4 = "S-1-5-32-545"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group5 = "S-1-5-14"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group6 = "S-1-5-4"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Group7 = "S-1-2-0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
Count = "8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003
ForceForegroundLogging = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003
SlowLink = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003
PrevRefreshMode = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003
PrevRefreshReason = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003
NextRefreshMode = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003
NextRefreshReason = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\
{00000000-0000-0000-0000-000000000000}
StartTimeLo = "9de9656"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\
{00000000-0000-0000-0000-000000000000}
Status = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\
0
Enabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\
0
NoOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\
0
DsPath = "LocalGPO"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\
0
SOM = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
Version = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
WQLFilterPass = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
AccessDenied = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
GPO-Disabled = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
GPOID = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
SOM = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\
0
DisplayName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500
ForceForegroundLogging = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500
SlowLink = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500
PrevRefreshMode = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500
PrevRefreshReason = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500
NextRefreshMode = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500
NextRefreshReason = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\
{00000000-0000-0000-0000-000000000000}
StartTimeLo = "3b4e74d8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\
{00000000-0000-0000-0000-000000000000}
Status = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\
0
Enabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\
0
NoOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\
0
DsPath = "LocalGPO"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\
0
SOM = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
Version = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
WQLFilterPass = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
AccessDenied = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
GPO-Disabled = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
GPOID = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
SOM = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\
0
DisplayName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501
ForceForegroundLogging = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501
SlowLink = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501
PrevRefreshMode = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501
PrevRefreshReason = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501
NextRefreshMode = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501
NextRefreshReason = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\
{00000000-0000-0000-0000-000000000000}
StartTimeLo = "b44914"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\
{00000000-0000-0000-0000-000000000000}
Status = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\
0
Enabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\
0
NoOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\
0
DsPath = "LocalGPO"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\
0
SOM = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
Version = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
WQLFilterPass = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
AccessDenied = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
GPO-Disabled = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
GPOID = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
SOM = "Local"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\
0
DisplayName = "Local Group Policy"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{03db7c79-b75d-4114-8b91-8930e4dc132a}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{03db7c79-b75d-4114-8b91-8930e4dc132a}
ItemData = "%Program Files%\360\360Safe\firstaid"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}
ItemData = "%Program Files%\360\360Safe\deepscan\DSMain.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{36bf1176-fd10-4acd-9bea-ef3f266e657c}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{36bf1176-fd10-4acd-9bea-ef3f266e657c}
ItemData = "%Program Files%\Kingsoft\Kingsoft Antivirus\procmgrex.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}
ItemData = "D:\Program Files\360\360Safe\deepscan\DSMain.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}
ItemData = "D:\Program Files\360\SuperKiller"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{40adb95d-5c05-4173-89b6-4b417b0f4e83}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{40adb95d-5c05-4173-89b6-4b417b0f4e83}
ItemData = "%Program Files%\360\360Safe\360diagnose.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{49cb8438-005d-4b50-a957-0e0987bb27ca}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{49cb8438-005d-4b50-a957-0e0987bb27ca}
ItemData = "%Program Files%\360\360Safe\SoftMgr\advutils.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{4c37f673-7019-4273-9296-25d8cfad8a0f}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{4c37f673-7019-4273-9296-25d8cfad8a0f}
ItemData = "%User Profile%\??\SuperKiller.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{5367b703-1c3e-46b0-8793-867bddcbcf0c}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{5367b703-1c3e-46b0-8793-867bddcbcf0c}
ItemData = "D:\Program Files\360\360Safe\360diagnose.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{71cd9643-417d-49d4-9ed5-c548bb555333}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{71cd9643-417d-49d4-9ed5-c548bb555333}
ItemData = "D:\Program Files\360\360Safe\SoftMgr\advutils.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{a5dccdde-eb53-4429-80c3-83d7da897f71}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{a5dccdde-eb53-4429-80c3-83d7da897f71}
ItemData = "D:\Program Files\Kingsoft\Kingsoft Antivirus\procmgrex.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}
ItemData = "D:\Program Files\360\360Safe\firstaid"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{f83b4590-4544-4119-8557-d87b34780148}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{f83b4590-4544-4119-8557-d87b34780148}
ItemData = "%Program Files%\360\SuperKiller"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}
ItemData = "%User Profile%\??\360compkill"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{191cd7fa-f240-4a17-8986-94d480a6c8ca}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{191cd7fa-f240-4a17-8986-94d480a6c8ca}
ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
ItemData = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{d2c34ab2-529a-46b2-b293-fc853fce72ea}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\262144\Paths\
{d2c34ab2-529a-46b2-b293-fc853fce72ea}
ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM
%System%\advapi32.dll[MofResourceName] = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM
%System%\DRIVERS\ACPI.sys[ACPIMOFResource] = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM
%System%\DRIVERS\mssmbios.sys[MofResource] = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM
%System%\DRIVERS\intelppm.sys[PROCESSORWMI] = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM
%System%\DRIVERS\ipnat.sys[IPNATMofResource] = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WDM
%System%\Drivers\HTTP.sys[UlMofResource] = "{random characters}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
GroupMembership
Group0 = "S-1-5-32-544"

(Note: The default value data of the said registry entry is S-1-5-32-544.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
GroupMembership
Group1 = "S-1-1-0"

(Note: The default value data of the said registry entry is S-1-1-0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
GroupMembership
Group2 = "S-1-5-11"

(Note: The default value data of the said registry entry is S-1-5-11.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
GroupMembership
Count = "3"

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
ForceForegroundLogging = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
SlowLink = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
PrevRefreshMode = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
PrevRefreshReason = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
NextRefreshMode = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine
NextRefreshReason = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{00000000-0000-0000-0000-000000000000}
StartTimeLo = "33415ba"

(Note: The default value data of the said registry entry is 66bcb466.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{00000000-0000-0000-0000-000000000000}
StartTimeHi = "1cbf6cb"

(Note: The default value data of the said registry entry is 1ccbfca.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{00000000-0000-0000-0000-000000000000}
EndTimeLo = "339bf466"

(Note: The default value data of the said registry entry is 66bcb466.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{00000000-0000-0000-0000-000000000000}
EndTimeHi = "1cbf6cb"

(Note: The default value data of the said registry entry is 1ccbfca.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{00000000-0000-0000-0000-000000000000}
Status = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\Extension-List\
{00000000-0000-0000-0000-000000000000}
LoggingStatus = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
Enabled = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
NoOverride = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
DsPath = "LocalGPO"

(Note: The default value data of the said registry entry is LocalGPO.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPLink-List\
0
SOM = "Local"

(Note: The default value data of the said registry entry is Local.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
Version = "2525"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
WQLFilterPass = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
AccessDenied = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
GPO-Disabled = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
Options = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
GPOID = "Local Group Policy"

(Note: The default value data of the said registry entry is Local Group Policy.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
SOM = "Local"

(Note: The default value data of the said registry entry is Local.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Group Policy\
State\Machine\GPO-List\
0
DisplayName = "Local Group Policy"

(Note: The default value data of the said registry entry is Local Group Policy.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
AuthenticodeEnabled = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
DefaultLevel = "4"

(Note: The default value data of the said registry entry is 40000.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
TransparentEnabled = "1"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
PolicyScope = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers
ExecutableTypes = "{random characters}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{349d35ab-37b5-462f-9b89-edd5fbde1328}
Description = "Stop the download of this file"

(Note: The default value data of the said registry entry is Stop the download of this file.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{349d35ab-37b5-462f-9b89-edd5fbde1328}
FriendlyName = "Mdac11.cab"

(Note: The default value data of the said registry entry is Mdac11.cab.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{349d35ab-37b5-462f-9b89-edd5fbde1328}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{349d35ab-37b5-462f-9b89-edd5fbde1328}
HashAlg = "83"

(Note: The default value data of the said registry entry is 8003.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{349d35ab-37b5-462f-9b89-edd5fbde1328}
ItemData = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
Description = "Stop the download of this file"

(Note: The default value data of the said registry entry is Stop the download of this file.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
FriendlyName = "mdac20.cab"

(Note: The default value data of the said registry entry is mdac20.cab.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
HashAlg = "83"

(Note: The default value data of the said registry entry is 8003.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
ItemData = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
Description = "Stop the download of this file"

(Note: The default value data of the said registry entry is Stop the download of this file.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
FriendlyName = "mdac20_a.cab"

(Note: The default value data of the said registry entry is mdac20_a.cab.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
HashAlg = "83"

(Note: The default value data of the said registry entry is 8003.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
ItemData = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{94e3e076-8f53-42a5-8411-085bcc18a68d}
Description = "Stop the download of this file"

(Note: The default value data of the said registry entry is Stop the download of this file.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{94e3e076-8f53-42a5-8411-085bcc18a68d}
FriendlyName = "_msadc10.cab"

(Note: The default value data of the said registry entry is _msadc10.cab.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{94e3e076-8f53-42a5-8411-085bcc18a68d}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{94e3e076-8f53-42a5-8411-085bcc18a68d}
HashAlg = "83"

(Note: The default value data of the said registry entry is 8003.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{94e3e076-8f53-42a5-8411-085bcc18a68d}
ItemData = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
Description = "Stop the download of this file"

(Note: The default value data of the said registry entry is Stop the download of this file.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
FriendlyName = "msadc11.cab"

(Note: The default value data of the said registry entry is msadc11.cab.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
HashAlg = "83"

(Note: The default value data of the said registry entry is 8003.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Hashes\
{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
ItemData = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{dda3f824-d8cb-441b-834d-be2efd2c1a33}
SaferFlags = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\Safer\
CodeIdentifiers\0\Paths\
{dda3f824-d8cb-441b-834d-be2efd2c1a33}
ItemData = "{random characters}"

(Note: The default value data of the said registry entry is {random values}.)

Dropping Routine

This Trojan drops the following files:

%Windows%\web\printers\125.bat
%System Root%\11a.bat
%Windows%\web\printers\md5.txt
%Windows%\ztop\svchost.exe
%Windows%\dell\lsess.exe
%Windows%\web\printers\1.reg
%Windows%\web\printers\3.reg
%Windows%\web\printers\5.reg
%Windows%\web\printers\4.reg
%Windows%\web\printers\123.bat
%Windows%\web\printers\124.bat
%Windows%\web\printers\360s.txt
%Windows%\web\printers\abc.vbs
%Windows%\web\printers\bb.vbs
%Windows%\web\printers\gl.txt
%Windows%\web\printers\jin.vbs
%Windows%\web\printers\jinshan.vbs
%Windows%\web\printers\k.bat
%Windows%\web\printers\QQlog.exe
%Windows%\web\printers\svc.bat
%Windows%\web\printers\SVCH0ST.EXE
%Windows%\web\printers\SVCH0ST.ini
%Windows%\dell\lsess.txt

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan deletes itself after execution.

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine: 9.300

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
- windows

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
- WgaLogon

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
- AppMgmt

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
- History

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
- {35378EAC-683F-11D2-A89A-00C04FBBCFA2}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
- {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
- S-1-5-21-1644491937-1757981266-1801674531-1003

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003
- GroupMembership

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
- S-1-5-21-1644491937-1757981266-1801674531-500

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500
- GroupMembership

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
- S-1-5-21-1644491937-1757981266-1801674531-501

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501
- GroupMembership

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List
- {c6dc5466-785a-11d2-84d0-00c04fb169f7}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State
- S-1-5-21-1644491937-1757981266-1801674531-1003

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- Extension-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List
- {00000000-0000-0000-0000-000000000000}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- GPLink-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- GPO-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- Loopback-GPLink-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- Loopback-GPO-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State
- S-1-5-21-1644491937-1757981266-1801674531-500

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- Extension-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List
- {00000000-0000-0000-0000-000000000000}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List
- {c6dc5466-785a-11d2-84d0-00c04fb169f7}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- GPLink-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- GPO-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- Loopback-GPLink-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- Loopback-GPO-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State
- S-1-5-21-1644491937-1757981266-1801674531-501

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- Extension-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List
- {00000000-0000-0000-0000-000000000000}

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- GPLink-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- GPO-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List
- 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- Loopback-GPLink-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- Loopback-GPO-List

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {03db7c79-b75d-4114-8b91-8930e4dc132a}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {36bf1176-fd10-4acd-9bea-ef3f266e657c}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {3cd4718e-e91e-463d-8ea7-2c6d41e5c283}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {40adb95d-5c05-4173-89b6-4b417b0f4e83}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {49cb8438-005d-4b50-a957-0e0987bb27ca}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {4c37f673-7019-4273-9296-25d8cfad8a0f}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {5367b703-1c3e-46b0-8793-867bddcbcf0c}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {71cd9643-417d-49d4-9ed5-c548bb555333}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {a5dccdde-eb53-4429-80c3-83d7da897f71}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {e37cdf1c-d301-4aa5-b828-1fc92be6db7f}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {f83b4590-4544-4119-8557-d87b34780148}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
- {fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- 262144

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144
- Paths

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
- {191cd7fa-f240-4a17-8986-94d480a6c8ca}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
- {7272edfb-af9f-4ddf-b65b-e4282f2deefc}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
- {8868b733-4b3a-48f8-9136-aa6d05d4fc83}

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
- {d2c34ab2-529a-46b2-b293-fc853fce72ea}

To delete the registry key this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>RunOnceEx
Still in the left panel, locate and delete the key:
windows
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>Notify
Still in the left panel, locate and delete the key:
WgaLogon
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy
Still in the left panel, locate and delete the key:
AppMgmt
Again Still in the left panel, locate and delete the key:
History
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>History
Still in the left panel, locate and delete the key:
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
Again Still in the left panel, locate and delete the key:
{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
Again Still in the left panel, locate and delete the key:
S-1-5-21-1644491937-1757981266-1801674531-1003
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>S-1-5-21-1644491937-1757981266-1801674531-1003
Still in the left panel, locate and delete the key:
GroupMembership
Again Still in the left panel, locate and delete the key:
S-1-5-21-1644491937-1757981266-1801674531-500
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>S-1-5-21-1644491937-1757981266-1801674531-500
Still in the left panel, locate and delete the key:
GroupMembership
Again Still in the left panel, locate and delete the key:
S-1-5-21-1644491937-1757981266-1801674531-501
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>S-1-5-21-1644491937-1757981266-1801674531-501
Still in the left panel, locate and delete the key:
GroupMembership
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>Machine>Extension-List
Still in the left panel, locate and delete the key:
{c6dc5466-785a-11d2-84d0-00c04fb169f7}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State
Still in the left panel, locate and delete the key:
S-1-5-21-1644491937-1757981266-1801674531-1003
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-1003
Still in the left panel, locate and delete the key:
Extension-List
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-1003>Extension-List
Still in the left panel, locate and delete the key:
{00000000-0000-0000-0000-000000000000}
Again Still in the left panel, locate and delete the key:
GPLink-List
Again Still in the left panel, locate and delete the key:
GPO-List
Again Still in the left panel, locate and delete the key:
Loopback-GPLink-List
Again Still in the left panel, locate and delete the key:
Loopback-GPO-List
Again Still in the left panel, locate and delete the key:
S-1-5-21-1644491937-1757981266-1801674531-500
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-500
Still in the left panel, locate and delete the key:
Extension-List
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-500>Extension-List
Still in the left panel, locate and delete the key:
{00000000-0000-0000-0000-000000000000}
Again Still in the left panel, locate and delete the key:
{c6dc5466-785a-11d2-84d0-00c04fb169f7}
Again Still in the left panel, locate and delete the key:
GPLink-List
Again Still in the left panel, locate and delete the key:
GPO-List
Again Still in the left panel, locate and delete the key:
Loopback-GPLink-List
Again Still in the left panel, locate and delete the key:
Loopback-GPO-List
Again Still in the left panel, locate and delete the key:
S-1-5-21-1644491937-1757981266-1801674531-501
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-501
Still in the left panel, locate and delete the key:
Extension-List
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-501>Extension-List
Still in the left panel, locate and delete the key:
{00000000-0000-0000-0000-000000000000}
Again Still in the left panel, locate and delete the key:
GPLink-List
Again Still in the left panel, locate and delete the key:
GPO-List
Again Still in the left panel, locate and delete the key:
Loopback-GPLink-List
Again Still in the left panel, locate and delete the key:
Loopback-GPO-List
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths
Still in the left panel, locate and delete the key:
{03db7c79-b75d-4114-8b91-8930e4dc132a}
Again Still in the left panel, locate and delete the key:
{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}
Again Still in the left panel, locate and delete the key:
{36bf1176-fd10-4acd-9bea-ef3f266e657c}
Again Still in the left panel, locate and delete the key:
{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}
Again Still in the left panel, locate and delete the key:
{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}
Again Still in the left panel, locate and delete the key:
{40adb95d-5c05-4173-89b6-4b417b0f4e83}
Again Still in the left panel, locate and delete the key:
{49cb8438-005d-4b50-a957-0e0987bb27ca}
Again Still in the left panel, locate and delete the key:
{4c37f673-7019-4273-9296-25d8cfad8a0f}
Again Still in the left panel, locate and delete the key:
{5367b703-1c3e-46b0-8793-867bddcbcf0c}
Again Still in the left panel, locate and delete the key:
{71cd9643-417d-49d4-9ed5-c548bb555333}
Again Still in the left panel, locate and delete the key:
{a5dccdde-eb53-4429-80c3-83d7da897f71}
Again Still in the left panel, locate and delete the key:
{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}
Again Still in the left panel, locate and delete the key:
{f83b4590-4544-4119-8557-d87b34780148}
Again Still in the left panel, locate and delete the key:
{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers
Still in the left panel, locate and delete the key:
262144
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>262144
Still in the left panel, locate and delete the key:
Paths
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>262144>Paths
Still in the left panel, locate and delete the key:
{191cd7fa-f240-4a17-8986-94d480a6c8ca}
Again Still in the left panel, locate and delete the key:
{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
Again Still in the left panel, locate and delete the key:
{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
Again Still in the left panel, locate and delete the key:
{d2c34ab2-529a-46b2-b293-fc853fce72ea}
Close Registry Editor.

Step 4

Delete this registry value

[ Learn More ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\windows
- Entry1 = "%Windows%\web\printers\123.bat"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon
- windows = "windows"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- Options = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- Version = "2525"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- DSPath = "LocalGPO"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- FileSysPath = "%System%\GroupPolicy\Machine"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- DisplayName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- Extensions = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- Link = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- GPOName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- GPOLink = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0
- lParam = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- Options = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- Version = "2525"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- DSPath = "LocalGPO"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- FileSysPath = "%System%\GroupPolicy\Machine"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- DisplayName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- Extensions = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- Link = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- GPOName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- GPOLink = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}\0
- lParam = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group1 = "S-1-1-0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group2 = "S-1-5-32-544"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group3 = "S-1-5-32-545"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group4 = "S-1-5-4"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group5 = "S-1-5-11"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Group6 = "S-1-2-0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-1003\GroupMembership
- Count = "7"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group1 = "S-1-1-0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group2 = "S-1-5-21-1644491937-1757981266-1801674531-1006"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group3 = "S-1-5-32-544"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group4 = "S-1-5-32-545"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group5 = "S-1-5-4"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group6 = "S-1-5-11"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Group7 = "S-1-2-0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-500\GroupMembership
- Count = "8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group1 = "S-1-1-0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group2 = "S-1-5-32-546"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group3 = "S-1-5-32-544"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group4 = "S-1-5-32-545"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group5 = "S-1-5-14"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group6 = "S-1-5-4"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Group7 = "S-1-2-0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\S-1-5-21-1644491937-1757981266-1801674531-501\GroupMembership
- Count = "8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- ForceForegroundLogging = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- SlowLink = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- PrevRefreshMode = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- PrevRefreshReason = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- NextRefreshMode = "2"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003
- NextRefreshReason = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\{00000000-0000-0000-0000-000000000000}
- StartTimeLo = "9de9656"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\{00000000-0000-0000-0000-000000000000}
- StartTimeHi = "1cb55a9"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\{00000000-0000-0000-0000-000000000000}
- EndTimeLo = "9e24ffd"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\{00000000-0000-0000-0000-000000000000}
- EndTimeHi = "1cb55a9"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\{00000000-0000-0000-0000-000000000000}
- Status = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\Extension-List\{00000000-0000-0000-0000-000000000000}
- LoggingStatus = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\0
- Enabled = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\0
- NoOverride = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\0
- DsPath = "LocalGPO"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPLink-List\0
- SOM = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- Version = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- WQLFilterPass = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- AccessDenied = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- GPO-Disabled = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- Options = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- GPOID = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- SOM = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-1003\GPO-List\0
- DisplayName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- ForceForegroundLogging = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- SlowLink = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- PrevRefreshMode = "2"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- PrevRefreshReason = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- NextRefreshMode = "2"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500
- NextRefreshReason = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\{00000000-0000-0000-0000-000000000000}
- StartTimeLo = "3b4e74d8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\{00000000-0000-0000-0000-000000000000}
- StartTimeHi = "1cbf6bf"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\{00000000-0000-0000-0000-000000000000}
- EndTimeLo = "3b4e74d8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\{00000000-0000-0000-0000-000000000000}
- EndTimeHi = "1cbf6bf"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\{00000000-0000-0000-0000-000000000000}
- Status = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\Extension-List\{00000000-0000-0000-0000-000000000000}
- LoggingStatus = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\0
- Enabled = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\0
- NoOverride = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\0
- DsPath = "LocalGPO"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPLink-List\0
- SOM = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- Version = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- WQLFilterPass = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- AccessDenied = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- GPO-Disabled = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- Options = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- GPOID = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- SOM = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-500\GPO-List\0
- DisplayName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- ForceForegroundLogging = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- SlowLink = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- PrevRefreshMode = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- PrevRefreshReason = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- NextRefreshMode = "2"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501
- NextRefreshReason = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\{00000000-0000-0000-0000-000000000000}
- StartTimeLo = "b44914"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\{00000000-0000-0000-0000-000000000000}
- StartTimeHi = "1cbeaa9"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\{00000000-0000-0000-0000-000000000000}
- EndTimeLo = "b44914"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\{00000000-0000-0000-0000-000000000000}
- EndTimeHi = "1cbeaa9"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\{00000000-0000-0000-0000-000000000000}
- Status = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\Extension-List\{00000000-0000-0000-0000-000000000000}
- LoggingStatus = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\0
- Enabled = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\0
- NoOverride = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\0
- DsPath = "LocalGPO"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPLink-List\0
- SOM = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- Version = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- WQLFilterPass = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- AccessDenied = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- GPO-Disabled = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- Options = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- GPOID = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- SOM = "Local"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-1644491937-1757981266-1801674531-501\GPO-List\0
- DisplayName = "Local Group Policy"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{03db7c79-b75d-4114-8b91-8930e4dc132a}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{03db7c79-b75d-4114-8b91-8930e4dc132a}
- ItemData = "%Program Files%\360\360Safe\firstaid"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}
- ItemData = "%Program Files%\360\360Safe\deepscan\DSMain.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{36bf1176-fd10-4acd-9bea-ef3f266e657c}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{36bf1176-fd10-4acd-9bea-ef3f266e657c}
- ItemData = "%Program Files%\Kingsoft\Kingsoft Antivirus\procmgrex.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}
- ItemData = "D:\Program Files\360\360Safe\deepscan\DSMain.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}
- ItemData = "D:\Program Files\360\SuperKiller"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{40adb95d-5c05-4173-89b6-4b417b0f4e83}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{40adb95d-5c05-4173-89b6-4b417b0f4e83}
- ItemData = "%Program Files%\360\360Safe\360diagnose.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{49cb8438-005d-4b50-a957-0e0987bb27ca}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{49cb8438-005d-4b50-a957-0e0987bb27ca}
- ItemData = "%Program Files%\360\360Safe\SoftMgr\advutils.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4c37f673-7019-4273-9296-25d8cfad8a0f}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{4c37f673-7019-4273-9296-25d8cfad8a0f}
- ItemData = "%User Profile%\??\SuperKiller.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{5367b703-1c3e-46b0-8793-867bddcbcf0c}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{5367b703-1c3e-46b0-8793-867bddcbcf0c}
- ItemData = "D:\Program Files\360\360Safe\360diagnose.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{71cd9643-417d-49d4-9ed5-c548bb555333}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{71cd9643-417d-49d4-9ed5-c548bb555333}
- ItemData = "D:\Program Files\360\360Safe\SoftMgr\advutils.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{a5dccdde-eb53-4429-80c3-83d7da897f71}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{a5dccdde-eb53-4429-80c3-83d7da897f71}
- ItemData = "D:\Program Files\Kingsoft\Kingsoft Antivirus\procmgrex.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}
- ItemData = "D:\Program Files\360\360Safe\firstaid"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{f83b4590-4544-4119-8557-d87b34780148}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{f83b4590-4544-4119-8557-d87b34780148}
- ItemData = "%Program Files%\360\SuperKiller"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}
- ItemData = "%User Profile%\??\360compkill"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}
- ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
- ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
- ItemData = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}
- ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM
- %System%\advapi32.dll[MofResourceName] = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM
- %System%\DRIVERS\ACPI.sys[ACPIMOFResource] = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM
- %System%\DRIVERS\mssmbios.sys[MofResource] = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM
- %System%\DRIVERS\intelppm.sys[PROCESSORWMI] = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM
- %System%\DRIVERS\ipnat.sys[IPNATMofResource] = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WDM
- %System%\Drivers\HTTP.sys[UlMofResource] = "{random characters}"

To delete the registry value this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>RunOnceEx>windows
In the right panel, locate and delete the entry:
Entry1 = "%Windows%\web\printers\123.bat"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>Notify>WgaLogon
In the right panel, locate and delete the entry:
windows = "windows"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>History>{35378EAC-683F-11D2-A89A-00C04FBBCFA2}>0
In the right panel, locate and delete the entry:
Options = "0"
Again In the right panel, locate and delete the entry:
Version = "2525"
Again In the right panel, locate and delete the entry:
DSPath = "LocalGPO"
Again In the right panel, locate and delete the entry:
FileSysPath = "%System%\GroupPolicy\Machine"
Again In the right panel, locate and delete the entry:
DisplayName = "Local Group Policy"
Again In the right panel, locate and delete the entry:
Extensions = "{random characters}"
Again In the right panel, locate and delete the entry:
Link = "Local"
Again In the right panel, locate and delete the entry:
GPOName = "Local Group Policy"
Again In the right panel, locate and delete the entry:
GPOLink = "1"
Again In the right panel, locate and delete the entry:
lParam = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>History>{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}>0
In the right panel, locate and delete the entry:
Options = "0"
Again In the right panel, locate and delete the entry:
Version = "2525"
Again In the right panel, locate and delete the entry:
DSPath = "LocalGPO"
Again In the right panel, locate and delete the entry:
FileSysPath = "%System%\GroupPolicy\Machine"
Again In the right panel, locate and delete the entry:
DisplayName = "Local Group Policy"
Again In the right panel, locate and delete the entry:
Extensions = "{random characters}"
Again In the right panel, locate and delete the entry:
Link = "Local"
Again In the right panel, locate and delete the entry:
GPOName = "Local Group Policy"
Again In the right panel, locate and delete the entry:
GPOLink = "1"
Again In the right panel, locate and delete the entry:
lParam = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>S-1-5-21-1644491937-1757981266-1801674531-1003>GroupMembership
In the right panel, locate and delete the entry:
Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"
Again In the right panel, locate and delete the entry:
Group1 = "S-1-1-0"
Again In the right panel, locate and delete the entry:
Group2 = "S-1-5-32-544"
Again In the right panel, locate and delete the entry:
Group3 = "S-1-5-32-545"
Again In the right panel, locate and delete the entry:
Group4 = "S-1-5-4"
Again In the right panel, locate and delete the entry:
Group5 = "S-1-5-11"
Again In the right panel, locate and delete the entry:
Group6 = "S-1-2-0"
Again In the right panel, locate and delete the entry:
Count = "7"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>S-1-5-21-1644491937-1757981266-1801674531-500>GroupMembership
In the right panel, locate and delete the entry:
Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"
Again In the right panel, locate and delete the entry:
Group1 = "S-1-1-0"
Again In the right panel, locate and delete the entry:
Group2 = "S-1-5-21-1644491937-1757981266-1801674531-1006"
Again In the right panel, locate and delete the entry:
Group3 = "S-1-5-32-544"
Again In the right panel, locate and delete the entry:
Group4 = "S-1-5-32-545"
Again In the right panel, locate and delete the entry:
Group5 = "S-1-5-4"
Again In the right panel, locate and delete the entry:
Group6 = "S-1-5-11"
Again In the right panel, locate and delete the entry:
Group7 = "S-1-2-0"
Again In the right panel, locate and delete the entry:
Count = "8"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>S-1-5-21-1644491937-1757981266-1801674531-501>GroupMembership
In the right panel, locate and delete the entry:
Group0 = "S-1-5-21-1644491937-1757981266-1801674531-513"
Again In the right panel, locate and delete the entry:
Group1 = "S-1-1-0"
Again In the right panel, locate and delete the entry:
Group2 = "S-1-5-32-546"
Again In the right panel, locate and delete the entry:
Group3 = "S-1-5-32-544"
Again In the right panel, locate and delete the entry:
Group4 = "S-1-5-32-545"
Again In the right panel, locate and delete the entry:
Group5 = "S-1-5-14"
Again In the right panel, locate and delete the entry:
Group6 = "S-1-5-4"
Again In the right panel, locate and delete the entry:
Group7 = "S-1-2-0"
Again In the right panel, locate and delete the entry:
Count = "8"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-1003
In the right panel, locate and delete the entry:
ForceForegroundLogging = "0"
Again In the right panel, locate and delete the entry:
SlowLink = "0"
Again In the right panel, locate and delete the entry:
PrevRefreshMode = "1"
Again In the right panel, locate and delete the entry:
PrevRefreshReason = "1"
Again In the right panel, locate and delete the entry:
NextRefreshMode = "2"
Again In the right panel, locate and delete the entry:
NextRefreshReason = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-1003>Extension-List>{00000000-0000-0000-0000-000000000000}
In the right panel, locate and delete the entry:
StartTimeLo = "9de9656"
Again In the right panel, locate and delete the entry:
StartTimeHi = "1cb55a9"
Again In the right panel, locate and delete the entry:
EndTimeLo = "9e24ffd"
Again In the right panel, locate and delete the entry:
EndTimeHi = "1cb55a9"
Again In the right panel, locate and delete the entry:
Status = "0"
Again In the right panel, locate and delete the entry:
LoggingStatus = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-1003>GPLink-List>0
In the right panel, locate and delete the entry:
Enabled = "1"
Again In the right panel, locate and delete the entry:
NoOverride = "0"
Again In the right panel, locate and delete the entry:
DsPath = "LocalGPO"
Again In the right panel, locate and delete the entry:
SOM = "Local"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-1003>GPO-List>0
In the right panel, locate and delete the entry:
Version = "0"
Again In the right panel, locate and delete the entry:
WQLFilterPass = "1"
Again In the right panel, locate and delete the entry:
AccessDenied = "0"
Again In the right panel, locate and delete the entry:
GPO-Disabled = "0"
Again In the right panel, locate and delete the entry:
Options = "0"
Again In the right panel, locate and delete the entry:
GPOID = "Local Group Policy"
Again In the right panel, locate and delete the entry:
SOM = "Local"
Again In the right panel, locate and delete the entry:
DisplayName = "Local Group Policy"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-500
In the right panel, locate and delete the entry:
ForceForegroundLogging = "0"
Again In the right panel, locate and delete the entry:
SlowLink = "0"
Again In the right panel, locate and delete the entry:
PrevRefreshMode = "2"
Again In the right panel, locate and delete the entry:
PrevRefreshReason = "0"
Again In the right panel, locate and delete the entry:
NextRefreshMode = "2"
Again In the right panel, locate and delete the entry:
NextRefreshReason = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-500>Extension-List>{00000000-0000-0000-0000-000000000000}
In the right panel, locate and delete the entry:
StartTimeLo = "3b4e74d8"
Again In the right panel, locate and delete the entry:
StartTimeHi = "1cbf6bf"
Again In the right panel, locate and delete the entry:
EndTimeLo = "3b4e74d8"
Again In the right panel, locate and delete the entry:
EndTimeHi = "1cbf6bf"
Again In the right panel, locate and delete the entry:
Status = "0"
Again In the right panel, locate and delete the entry:
LoggingStatus = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-500>GPLink-List>0
In the right panel, locate and delete the entry:
Enabled = "1"
Again In the right panel, locate and delete the entry:
NoOverride = "0"
Again In the right panel, locate and delete the entry:
DsPath = "LocalGPO"
Again In the right panel, locate and delete the entry:
SOM = "Local"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-500>GPO-List>0
In the right panel, locate and delete the entry:
Version = "0"
Again In the right panel, locate and delete the entry:
WQLFilterPass = "1"
Again In the right panel, locate and delete the entry:
AccessDenied = "0"
Again In the right panel, locate and delete the entry:
GPO-Disabled = "0"
Again In the right panel, locate and delete the entry:
Options = "0"
Again In the right panel, locate and delete the entry:
GPOID = "Local Group Policy"
Again In the right panel, locate and delete the entry:
SOM = "Local"
Again In the right panel, locate and delete the entry:
DisplayName = "Local Group Policy"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-501
In the right panel, locate and delete the entry:
ForceForegroundLogging = "0"
Again In the right panel, locate and delete the entry:
SlowLink = "0"
Again In the right panel, locate and delete the entry:
PrevRefreshMode = "1"
Again In the right panel, locate and delete the entry:
PrevRefreshReason = "1"
Again In the right panel, locate and delete the entry:
NextRefreshMode = "2"
Again In the right panel, locate and delete the entry:
NextRefreshReason = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-501>Extension-List>{00000000-0000-0000-0000-000000000000}
In the right panel, locate and delete the entry:
StartTimeLo = "b44914"
Again In the right panel, locate and delete the entry:
StartTimeHi = "1cbeaa9"
Again In the right panel, locate and delete the entry:
EndTimeLo = "b44914"
Again In the right panel, locate and delete the entry:
EndTimeHi = "1cbeaa9"
Again In the right panel, locate and delete the entry:
Status = "0"
Again In the right panel, locate and delete the entry:
LoggingStatus = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-501>GPLink-List>0
In the right panel, locate and delete the entry:
Enabled = "1"
Again In the right panel, locate and delete the entry:
NoOverride = "0"
Again In the right panel, locate and delete the entry:
DsPath = "LocalGPO"
Again In the right panel, locate and delete the entry:
SOM = "Local"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>S-1-5-21-1644491937-1757981266-1801674531-501>GPO-List>0
In the right panel, locate and delete the entry:
Version = "0"
Again In the right panel, locate and delete the entry:
WQLFilterPass = "1"
Again In the right panel, locate and delete the entry:
AccessDenied = "0"
Again In the right panel, locate and delete the entry:
GPO-Disabled = "0"
Again In the right panel, locate and delete the entry:
Options = "0"
Again In the right panel, locate and delete the entry:
GPOID = "Local Group Policy"
Again In the right panel, locate and delete the entry:
SOM = "Local"
Again In the right panel, locate and delete the entry:
DisplayName = "Local Group Policy"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{03db7c79-b75d-4114-8b91-8930e4dc132a}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%Program Files%\360\360Safe\firstaid"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{2efaa7a7-ae99-4ad5-b13c-30fd3fe6e3c3}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%Program Files%\360\360Safe\deepscan\DSMain.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{36bf1176-fd10-4acd-9bea-ef3f266e657c}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%Program Files%\Kingsoft\Kingsoft Antivirus\procmgrex.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{3cd4718e-e91e-463d-8ea7-2c6d41e5c283}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "D:\Program Files\360\360Safe\deepscan\DSMain.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{3f611ddf-99e9-4b9a-9e5a-f6e5bb33924f}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "D:\Program Files\360\SuperKiller"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{40adb95d-5c05-4173-89b6-4b417b0f4e83}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%Program Files%\360\360Safe\360diagnose.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{49cb8438-005d-4b50-a957-0e0987bb27ca}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%Program Files%\360\360Safe\SoftMgr\advutils.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{4c37f673-7019-4273-9296-25d8cfad8a0f}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%User Profile%\??\SuperKiller.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{5367b703-1c3e-46b0-8793-867bddcbcf0c}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "D:\Program Files\360\360Safe\360diagnose.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{71cd9643-417d-49d4-9ed5-c548bb555333}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "D:\Program Files\360\360Safe\SoftMgr\advutils.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{a5dccdde-eb53-4429-80c3-83d7da897f71}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "D:\Program Files\Kingsoft\Kingsoft Antivirus\procmgrex.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{e37cdf1c-d301-4aa5-b828-1fc92be6db7f}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "D:\Program Files\360\360Safe\firstaid"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{f83b4590-4544-4119-8557-d87b34780148}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%Program Files%\360\SuperKiller"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{fff4e57f-30bc-45ef-bbaa-1f1de2c959f9}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%User Profile%\??\360compkill"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>262144>Paths>{191cd7fa-f240-4a17-8986-94d480a6c8ca}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>262144>Paths>{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>262144>Paths>{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "{random characters}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>262144>Paths>{d2c34ab2-529a-46b2-b293-fc853fce72ea}
In the right panel, locate and delete the entry:
SaferFlags = "0"
Again In the right panel, locate and delete the entry:
ItemData = "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>WBEM>WDM
In the right panel, locate and delete the entry:
%System%\advapi32.dll[MofResourceName] = "{random characters}"
Again In the right panel, locate and delete the entry:
%System%\DRIVERS\ACPI.sys[ACPIMOFResource] = "{random characters}"
Again In the right panel, locate and delete the entry:
%System%\DRIVERS\mssmbios.sys[MofResource] = "{random characters}"
Again In the right panel, locate and delete the entry:
%System%\DRIVERS\intelppm.sys[PROCESSORWMI] = "{random characters}"
Again In the right panel, locate and delete the entry:
%System%\DRIVERS\ipnat.sys[IPNATMofResource] = "{random characters}"
Again In the right panel, locate and delete the entry:
%System%\Drivers\HTTP.sys[UlMofResource] = "{random characters}"
Close Registry Editor.

Step 5

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership
- From: Group0 = "S-1-5-32-544"
  To: Group0 = ""S-1-5-32-544""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership
- From: Group1 = "S-1-1-0"
  To: Group1 = ""S-1-1-0""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership
- From: Group2 = "S-1-5-11"
  To: Group2 = ""S-1-5-11""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\GroupMembership
- From: Count = "3"
  To: Count = ""3""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine
- ForceForegroundLogging = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine
- SlowLink = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine
- From: PrevRefreshMode = "2"
  To: PrevRefreshMode = ""2""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine
- PrevRefreshReason = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine
- From: NextRefreshMode = "2"
  To: NextRefreshMode = ""2""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine
- NextRefreshReason = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
- From: StartTimeLo = "33415ba"
  To: StartTimeLo = ""66bcb466""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
- From: StartTimeHi = "1cbf6cb"
  To: StartTimeHi = ""1ccbfca""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
- From: EndTimeLo = "339bf466"
  To: EndTimeLo = ""66bcb466""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
- From: EndTimeHi = "1cbf6cb"
  To: EndTimeHi = ""1ccbfca""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
- Status = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
- LoggingStatus = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPLink-List\0
- From: Enabled = "1"
  To: Enabled = ""1""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPLink-List\0
- NoOverride = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPLink-List\0
- From: DsPath = "LocalGPO"
  To: DsPath = ""LocalGPO""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPLink-List\0
- From: SOM = "Local"
  To: SOM = ""Local""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- Version = "2525"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- From: WQLFilterPass = "1"
  To: WQLFilterPass = ""1""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- AccessDenied = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- GPO-Disabled = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- Options = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- From: GPOID = "Local Group Policy"
  To: GPOID = ""Local Group Policy""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- From: SOM = "Local"
  To: SOM = ""Local""

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0
- From: DisplayName = "Local Group Policy"
  To: DisplayName = ""Local Group Policy""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- AuthenticodeEnabled = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- From: DefaultLevel = "4"
  To: DefaultLevel = ""40000""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- From: TransparentEnabled = "1"
  To: TransparentEnabled = ""1""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- PolicyScope = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- From: ExecutableTypes = "{random characters}"
  To: ExecutableTypes = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
- From: Description = "Stop the download of this file"
  To: Description = ""Stop the download of this file""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
- From: FriendlyName = "Mdac11.cab"
  To: FriendlyName = ""Mdac11.cab""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
- From: HashAlg = "83"
  To: HashAlg = ""8003""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}
- From: ItemData = "{random values}"
  To: ItemData = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
- From: Description = "Stop the download of this file"
  To: Description = ""Stop the download of this file""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
- From: FriendlyName = "mdac20.cab"
  To: FriendlyName = ""mdac20.cab""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
- From: HashAlg = "83"
  To: HashAlg = ""8003""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
- From: ItemData = "{random values}"
  To: ItemData = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
- From: Description = "Stop the download of this file"
  To: Description = ""Stop the download of this file""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
- From: FriendlyName = "mdac20_a.cab"
  To: FriendlyName = ""mdac20_a.cab""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
- From: HashAlg = "83"
  To: HashAlg = ""8003""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
- From: ItemData = "{random values}"
  To: ItemData = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
- From: Description = "Stop the download of this file"
  To: Description = ""Stop the download of this file""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
- From: FriendlyName = "_msadc10.cab"
  To: FriendlyName = ""_msadc10.cab""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
- From: HashAlg = "83"
  To: HashAlg = ""8003""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}
- From: ItemData = "{random values}"
  To: ItemData = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
- From: Description = "Stop the download of this file"
  To: Description = ""Stop the download of this file""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
- From: FriendlyName = "msadc11.cab"
  To: FriendlyName = ""msadc11.cab""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
- From: HashAlg = "83"
  To: HashAlg = ""8003""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
- From: ItemData = "{random values}"
  To: ItemData = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}
- SaferFlags = "0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}
- From: ItemData = "{random characters}"
  To: ItemData = ""{random values}""

To restore registry values this malware/grayware modified:

Open Registry Editor. To do this:
- On Windows 2000, XP, and Server 2003:
  Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
- On Windows Vista and 7:
  Click the Start button, type REGEDIT in the Search input field then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>GroupMembership
In the right panel, locate the registry value:
Group0 = "S-1-5-32-544"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Group0 = "S-1-5-32-544"
Again In the right panel, locate the registry value:
Group1 = "S-1-1-0"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Group1 = "S-1-1-0"
Again In the right panel, locate the registry value:
Group2 = "S-1-5-11"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Group2 = "S-1-5-11"
Again In the right panel, locate the registry value:
Count = "3"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Count = "3"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>Machine
In the right panel, locate the registry value:
ForceForegroundLogging = "0"
Again In the right panel, locate the registry value:
SlowLink = "0"
Again In the right panel, locate the registry value:
PrevRefreshMode = "2"
Right-click on the value name and choose Modify. Change the value data of this entry to:
PrevRefreshMode = "2"
Again In the right panel, locate the registry value:
PrevRefreshReason = "0"
Again In the right panel, locate the registry value:
NextRefreshMode = "2"
Right-click on the value name and choose Modify. Change the value data of this entry to:
NextRefreshMode = "2"
Again In the right panel, locate the registry value:
NextRefreshReason = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>Machine>Extension-List>{00000000-0000-0000-0000-000000000000}
In the right panel, locate the registry value:
StartTimeLo = "33415ba"
Right-click on the value name and choose Modify. Change the value data of this entry to:
StartTimeLo = "66bcb466"
Again In the right panel, locate the registry value:
StartTimeHi = "1cbf6cb"
Right-click on the value name and choose Modify. Change the value data of this entry to:
StartTimeHi = "1ccbfca"
Again In the right panel, locate the registry value:
EndTimeLo = "339bf466"
Right-click on the value name and choose Modify. Change the value data of this entry to:
EndTimeLo = "66bcb466"
Again In the right panel, locate the registry value:
EndTimeHi = "1cbf6cb"
Right-click on the value name and choose Modify. Change the value data of this entry to:
EndTimeHi = "1ccbfca"
Again In the right panel, locate the registry value:
Status = "0"
Again In the right panel, locate the registry value:
LoggingStatus = "0"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>Machine>GPLink-List>0
In the right panel, locate the registry value:
Enabled = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Enabled = "1"
Again In the right panel, locate the registry value:
NoOverride = "0"
Again In the right panel, locate the registry value:
DsPath = "LocalGPO"
Right-click on the value name and choose Modify. Change the value data of this entry to:
DsPath = "LocalGPO"
Again In the right panel, locate the registry value:
SOM = "Local"
Right-click on the value name and choose Modify. Change the value data of this entry to:
SOM = "Local"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Group Policy>State>Machine>GPO-List>0
In the right panel, locate the registry value:
Version = "2525"
Again In the right panel, locate the registry value:
WQLFilterPass = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
WQLFilterPass = "1"
Again In the right panel, locate the registry value:
AccessDenied = "0"
Again In the right panel, locate the registry value:
GPO-Disabled = "0"
Again In the right panel, locate the registry value:
Options = "0"
Again In the right panel, locate the registry value:
GPOID = "Local Group Policy"
Right-click on the value name and choose Modify. Change the value data of this entry to:
GPOID = "Local Group Policy"
Again In the right panel, locate the registry value:
SOM = "Local"
Right-click on the value name and choose Modify. Change the value data of this entry to:
SOM = "Local"
Again In the right panel, locate the registry value:
DisplayName = "Local Group Policy"
Right-click on the value name and choose Modify. Change the value data of this entry to:
DisplayName = "Local Group Policy"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers
In the right panel, locate the registry value:
AuthenticodeEnabled = "0"
Again In the right panel, locate the registry value:
DefaultLevel = "4"
Right-click on the value name and choose Modify. Change the value data of this entry to:
DefaultLevel = "40000"
Again In the right panel, locate the registry value:
TransparentEnabled = "1"
Right-click on the value name and choose Modify. Change the value data of this entry to:
TransparentEnabled = "1"
Again In the right panel, locate the registry value:
PolicyScope = "0"
Again In the right panel, locate the registry value:
ExecutableTypes = "{random characters}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ExecutableTypes = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Hashes>{349d35ab-37b5-462f-9b89-edd5fbde1328}
In the right panel, locate the registry value:
Description = "Stop the download of this file"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Description = "Stop the download of this file"
Again In the right panel, locate the registry value:
FriendlyName = "Mdac11.cab"
Right-click on the value name and choose Modify. Change the value data of this entry to:
FriendlyName = "Mdac11.cab"
Again In the right panel, locate the registry value:
SaferFlags = "0"
Again In the right panel, locate the registry value:
HashAlg = "83"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HashAlg = "8003"
Again In the right panel, locate the registry value:
ItemData = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ItemData = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Hashes>{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}
In the right panel, locate the registry value:
Description = "Stop the download of this file"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Description = "Stop the download of this file"
Again In the right panel, locate the registry value:
FriendlyName = "mdac20.cab"
Right-click on the value name and choose Modify. Change the value data of this entry to:
FriendlyName = "mdac20.cab"
Again In the right panel, locate the registry value:
SaferFlags = "0"
Again In the right panel, locate the registry value:
HashAlg = "83"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HashAlg = "8003"
Again In the right panel, locate the registry value:
ItemData = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ItemData = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Hashes>{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}
In the right panel, locate the registry value:
Description = "Stop the download of this file"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Description = "Stop the download of this file"
Again In the right panel, locate the registry value:
FriendlyName = "mdac20_a.cab"
Right-click on the value name and choose Modify. Change the value data of this entry to:
FriendlyName = "mdac20_a.cab"
Again In the right panel, locate the registry value:
SaferFlags = "0"
Again In the right panel, locate the registry value:
HashAlg = "83"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HashAlg = "8003"
Again In the right panel, locate the registry value:
ItemData = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ItemData = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Hashes>{94e3e076-8f53-42a5-8411-085bcc18a68d}
In the right panel, locate the registry value:
Description = "Stop the download of this file"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Description = "Stop the download of this file"
Again In the right panel, locate the registry value:
FriendlyName = "_msadc10.cab"
Right-click on the value name and choose Modify. Change the value data of this entry to:
FriendlyName = "_msadc10.cab"
Again In the right panel, locate the registry value:
SaferFlags = "0"
Again In the right panel, locate the registry value:
HashAlg = "83"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HashAlg = "8003"
Again In the right panel, locate the registry value:
ItemData = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ItemData = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Hashes>{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}
In the right panel, locate the registry value:
Description = "Stop the download of this file"
Right-click on the value name and choose Modify. Change the value data of this entry to:
Description = "Stop the download of this file"
Again In the right panel, locate the registry value:
FriendlyName = "msadc11.cab"
Right-click on the value name and choose Modify. Change the value data of this entry to:
FriendlyName = "msadc11.cab"
Again In the right panel, locate the registry value:
SaferFlags = "0"
Again In the right panel, locate the registry value:
HashAlg = "83"
Right-click on the value name and choose Modify. Change the value data of this entry to:
HashAlg = "8003"
Again In the right panel, locate the registry value:
ItemData = "{random values}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ItemData = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>Safer>CodeIdentifiers>0>Paths>{dda3f824-d8cb-441b-834d-be2efd2c1a33}
In the right panel, locate the registry value:
SaferFlags = "0"
Again In the right panel, locate the registry value:
ItemData = "{random characters}"
Right-click on the value name and choose Modify. Change the value data of this entry to:
ItemData = "{random values}"
Close Registry Editor.

Step 6

Search and delete these components

[ Learn More ]

There may be some components that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Windows%\web\printers\125.bat
%System Root%\11a.bat
%Windows%\web\printers\md5.txt
%Windows%\ztop\svchost.exe
%Windows%\dell\lsess.exe
%Windows%\web\printers\1.reg
%Windows%\web\printers\3.reg
%Windows%\web\printers\5.reg
%Windows%\web\printers\4.reg
%Windows%\web\printers\123.bat
%Windows%\web\printers\124.bat
%Windows%\web\printers\360s.txt
%Windows%\web\printers\abc.vbs
%Windows%\web\printers\bb.vbs
%Windows%\web\printers\gl.txt
%Windows%\web\printers\jin.vbs
%Windows%\web\printers\jinshan.vbs
%Windows%\web\printers\k.bat
%Windows%\web\printers\QQlog.exe
%Windows%\web\printers\svc.bat
%Windows%\web\printers\SVCH0ST.EXE
%Windows%\web\printers\SVCH0ST.ini
%Windows%\dell\lsess.txt

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

Right-click Start then click Search....
In the Named input box, type:
%Windows%\web\printers\125.bat
%System Root%\11a.bat
%Windows%\web\printers\md5.txt
%Windows%\ztop\svchost.exe
%Windows%\dell\lsess.exe
%Windows%\web\printers\1.reg
%Windows%\web\printers\3.reg
%Windows%\web\printers\5.reg
%Windows%\web\printers\4.reg
%Windows%\web\printers\123.bat
%Windows%\web\printers\124.bat
%Windows%\web\printers\360s.txt
%Windows%\web\printers\abc.vbs
%Windows%\web\printers\bb.vbs
%Windows%\web\printers\gl.txt
%Windows%\web\printers\jin.vbs
%Windows%\web\printers\jinshan.vbs
%Windows%\web\printers\k.bat
%Windows%\web\printers\QQlog.exe
%Windows%\web\printers\svc.bat
%Windows%\web\printers\SVCH0ST.EXE
%Windows%\web\printers\SVCH0ST.ini
%Windows%\dell\lsess.txt
In the Look In drop-down list, select My Computer then press Enter.
Once located, select the file then press SHIFT+DELETE to delete it.
Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

Click Start>Computer.
In the Search input box, type:
%Windows%\web\printers\125.bat
%System Root%\11a.bat
%Windows%\web\printers\md5.txt
%Windows%\ztop\svchost.exe
%Windows%\dell\lsess.exe
%Windows%\web\printers\1.reg
%Windows%\web\printers\3.reg
%Windows%\web\printers\5.reg
%Windows%\web\printers\4.reg
%Windows%\web\printers\123.bat
%Windows%\web\printers\124.bat
%Windows%\web\printers\360s.txt
%Windows%\web\printers\abc.vbs
%Windows%\web\printers\bb.vbs
%Windows%\web\printers\gl.txt
%Windows%\web\printers\jin.vbs
%Windows%\web\printers\jinshan.vbs
%Windows%\web\printers\k.bat
%Windows%\web\printers\QQlog.exe
%Windows%\web\printers\svc.bat
%Windows%\web\printers\SVCH0ST.EXE
%Windows%\web\printers\SVCH0ST.ini
%Windows%\dell\lsess.txt
In the Look In drop-down list, select My Computer then press Enter.
Once located, select the folder then press SHIFT+DELETE to delete it.
Repeat the said steps for all files listed.

*Note: Read the following Microsoft page if these steps do not work on Windows 7.

Step 7

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%Windows%\intell
%Windows%\ztop
%Windows%\dell
%User Profile%\Application Data\WinRAR

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_AGENT_012425.TOMB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 9

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%Temporary Internet Files%\desktop.ini
%Temporary Internet Files%\Content.IE5\desktop.ini
%Temporary Internet Files%\Content.IE5\index.dat
%Temporary Internet Files%\Content.IE5\2TPM8950\10_1_~1.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\16_1_~1.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~1.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~2.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~3.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\192168~4.HTM
%Temporary Internet Files%\Content.IE5\2TPM8950\BOTTOM~1.PNG
%Temporary Internet Files%\Content.IE5\2TPM8950\BOX01_~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\BOX02_~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\BOX08_~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\desktop.ini
%Temporary Internet Files%\Content.IE5\2TPM8950\HEADER~1.GIF
%Temporary Internet Files%\Content.IE5\2TPM8950\JQUERY~1.JS
%Temporary Internet Files%\Content.IE5\2TPM8950\REPORT~1.PNG
%Temporary Internet Files%\Content.IE5\2TPM8950\TABLE_~1.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\10_1_~1.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~1.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~2.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~3.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\192168~4.HTM
%Temporary Internet Files%\Content.IE5\4H9MXTT9\BOX07_~1.GIF
%Temporary Internet Files%\Content.IE5\4H9MXTT9\CALEND~1.JS
%Temporary Internet Files%\Content.IE5\4H9MXTT9\desktop.ini
%Temporary Internet Files%\Content.IE5\4H9MXTT9\DROPDO~1.JPG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\FOOTER~1.GIF
%Temporary Internet Files%\Content.IE5\4H9MXTT9\HEADER~1.JPG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\IMPORT~1.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\TABLE_~2.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\TABLE_~1.PNG
%Temporary Internet Files%\Content.IE5\4H9MXTT9\TRANSP~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\10_1_~1.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~1.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~2.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~3.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\192168~4.HTM
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BACKGR~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BOX03_~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BOX04_~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\BOX06_~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\CONFIG~1.GIF
%Temporary Internet Files%\Content.IE5\SMCZPN4M\desktop.ini
%Temporary Internet Files%\Content.IE5\SMCZPN4M\EDIT_I~1.PNG
%Temporary Internet Files%\Content.IE5\SMCZPN4M\JQUERY~1.JS
%Temporary Internet Files%\Content.IE5\SMCZPN4M\SANDBO~1.CSS
%Temporary Internet Files%\Content.IE5\SMCZPN4M\TOP_RI~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~1.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~2.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~3.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\192168~4.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\1923A7~1.HTM
%Temporary Internet Files%\Content.IE5\X9QQH2D9\BOTTOM~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\BOX09_~1.GIF
%Temporary Internet Files%\Content.IE5\X9QQH2D9\DELETE~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\desktop.ini
%Temporary Internet Files%\Content.IE5\X9QQH2D9\JQUERY~1.JS
%Temporary Internet Files%\Content.IE5\X9QQH2D9\OVERLI~1.JS
%Temporary Internet Files%\Content.IE5\X9QQH2D9\SUNBEL~1.JPG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\TABLE_~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\TOP_LE~1.PNG
%Temporary Internet Files%\Content.IE5\X9QQH2D9\USERS_~1.PNG

Did this description help? Tell us how we did.

TROJ_AGENT_012425.TOMB

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Trend Vision One™ - Proactive Security Starts Here.

Resources

Support

About Trend

Country Headquarters