TSPY_LYDRA.SMM
TrojanSpy:Win32/Lydra.AC (Microsoft); Spy-Lydra.gen.e (McAfee); Infostealer (Symantec); Trojan-Spy.Win32.Lydra.ds (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It disables Task Manager, Registry Editor, and Folder Options.
TECHNICAL DETAILS
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware drops the following copies of itself into the affected system:
- %Windows%\winsys.exe
- %Windows%\lsassv.exe
- %Windows%\msrpc.exe
- %Windows%\calc.exe
- %Windows%\regedit.exe
- %System%\calc.exe
- %System%\regedit.exe
- %User Profile%\Àâòîçàãðóçêà\AdobeGammaLoader.scr
- %Windows%\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\AdobeGammaLoader.scr
(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
Autostart Technique
This spyware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
winsys = "%Windows%\winsys.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
winsys = "%Windows%\winsys.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lsassv = "%Windows%\lsassv.exe"
It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\winsys
Other System Modifications
This spyware adds the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
It adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Internet Spades.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "73"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Minesweeper.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "74"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Pinball.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "75"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Solitaire.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "76"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Spider Solitaire.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "77"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\MSN.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "78"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Common Startup%\AdobeGammaLoader.scr"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "79"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Common Startup%\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Windows Messenger.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Windows Movie Maker.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\WinPcap\Uninstall WinPcap 4.1.2.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\WinPcap\WinPcap Web Site.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Set Program Access and Defaults.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Windows Catalog.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Windows Update.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "81"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "82"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Internet Explorer\brndlog.bak"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "83"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Internet Explorer\brndlog.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "84"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Cookies\index.dat"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "85"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Media Player\CurrentDatabase_59R.wmdb"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "86"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "87"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "88"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "89"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\History.IE5\index.dat"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\09RWHJQN\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\BVLBNMKH\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\index.dat"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\ZDGZNKA5\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "91"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\ZSGKJKO6\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "92"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "93"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\NTUSER.DAT"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "94"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\SendTo\Compressed (zipped) Folder.ZFSendToTarget"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "95"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Desktop% (create shortcut).DeskLink"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "96"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "97"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\SendTo\Mail Recipient.MAPIMail"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "98"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "99"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Accessibility\Magnifier.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Accessibility\Narrator.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Accessibility\Utility Manager.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Command Prompt.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Entertainment\Windows Media Player.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Notepad.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Program Compatibility Wizard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Synchronize.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Tour Windows XP.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Windows Explorer.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Remote Assistance.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Startup%\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "aa"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Windows Media Player.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ab"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\amipro.sam"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ac"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\excel.xls"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ad"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\excel4.xls"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ae"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\lotus.wk4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "af"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\powerpnt.ppt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\presenta.shw"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\quattro.wb2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\sndrec.wav"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\winword.doc"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\winword2.doc"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\wordpfct.wpd"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Templates\wordpfct.wpg"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\FontCache3.0.0.0.dat"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Windows\UsrClass.dat"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ba"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Windows\UsrClass.dat.LOG"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "bb"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "bc"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "bd"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "be"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "bf"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\246FT6TD\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\9STOYKO4\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\NF72HY20\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Temporary Internet Files%\Content.IE5\PHOM4UYK\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\ntuser.dat.LOG"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\ntuser.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ca"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "cb"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "cc"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "cd"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ce"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "cf"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "da"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Desktop%.htt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "db"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "dc"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Quick Launch\Launch Internet Explorer Browser.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "dd"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Quick Launch\Show Desktop.scf"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "de"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\MMC\secpol"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "df"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Themes\Custom.theme"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\Links\Customize Links.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\Links\Free Hotmail.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\Links\Windows Marketplace.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\Links\Windows Media.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\Links\Windows.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\MSN.com.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Favorites%\Radio Station Guide.url"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\IconCache.db"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ea"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Internet Explorer\MSIMGSIZ.DAT"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "eb"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ec"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Application Data%\Microsoft\Wallpaper1.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ed"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ee"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ef"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\58e0ef.mst"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\AdobeARM.log"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\AdobeSFX.log"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\ASPNETSetup_00000.log"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\ASPNETSetup_00001.log"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "fa"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\ASPNETSetup_00002.log"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "fb"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_depcheck_NETFX_EXP_35.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "fc"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_dotnetfx35error.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "fd"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_dotnetfx35install.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "fe"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_dotNetFx40_Full_x86_x64_decompression_log.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "ff"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_MSXML6_MSI0686.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_netfx20MSI7F16.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
ThisEXE = "{malware path and file name}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
VerProg = "92"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
msrpc = "%Windows%\msrpc.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
DependOnService = "RpcSs"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
Description = "This service manages TCP/IP packets at Internet"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
DisplayName = "TCPIP route manager"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
Group = "PlugPlay"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
ObjectName = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
ImagePath = "%Windows%\winsys.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
ErrorControl = "1"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
PlugPlayServiceType = "3"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
Start = "2"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\winsys
Type = "12"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:enabled:system update"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%System Root%\AUTOEXEC.BAT"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%System Root%\boot.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%System Root%\CONFIG.SYS"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Security\directories.acrodata"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\ABCPY.INI"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\AcroRead.msi"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "7"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\Data1.cab"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "8"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\setup.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "9"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\Setup.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Desktop%.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "{random characters}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Media Player\DefaultStore_59R.bin"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Media Player\UserMigratedStore_59R.bin"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Pbk\rasphone.pbk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Pbk\sharedaccess.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\airplane.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "11"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\astronaut.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "12"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\ball.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "13"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\beach.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "14"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\butterfly.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "15"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\car.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "16"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\cat.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "17"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\chess.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "18"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\dirt bike.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "19"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\dog.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\drip.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\duck.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\fish.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\frog.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\guitar.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "1f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\horses.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\kick.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "21"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\lift-off.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "22"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\palm tree.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "23"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\pink flower.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "24"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\red flower.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "25"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\skater.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "26"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Default Pictures\snowflake.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "27"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\User Account Pictures\guest.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "28"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\User Account Pictures\Wilbert.bmp"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "29"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Sample Music\New Stories (Highway Blues).wma"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst1.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "2f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst10.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst11.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "31"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst12.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "32"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst13.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "33"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst14.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "34"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst15.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "35"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst2.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "36"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst3.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "37"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst4.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "38"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst5.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "39"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst6.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst7.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst8.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\0008044E\Plylst9.wpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Sample Pictures\Blue hills.jpg"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "3f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Sample Pictures\Sunset.jpg"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "41"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Sample Pictures\Water lilies.jpg"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "42"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\Sample Pictures\Winter.jpg"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "43"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "44"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\DRM\drmv2.lic"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "45"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Profile%\DRM\drmv2.sst"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "46"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "47"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Accessibility\Accessibility Wizard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "48"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Accessibility\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "49"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Calculator.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\HyperTerminal.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\Network Connections.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\Network Setup Wizard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\New Connection Wizard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "4f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\Remote Desktop Connection.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "51"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "52"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Entertainment\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "53"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Entertainment\Sound Recorder.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "54"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Entertainment\Volume Control.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "55"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\Paint.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "56"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Backup.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "57"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Character Map.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "58"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "59"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Disk Cleanup.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Disk Defragmenter.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Scheduled Tasks.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\Security Center.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\System Information.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "5f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\System Tools\System Restore.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Accessories\WordPad.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "61"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Component Services.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "62"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Computer Management.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "63"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Data Sources (ODBC).lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "64"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "65"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Event Viewer.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "66"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Local Security Policy.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "67"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Performance.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "68"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Administrative Tools\Services.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "69"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Adobe Reader X.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6a"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6b"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\desktop.ini"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6c"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Freecell.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6d"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Hearts.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6e"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Internet Backgammon.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "6f"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Internet Checkers.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Internet Hearts.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "71"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%Start Menu%\Programs\Games\Internet Reversi.lnk"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FNum = "72"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_netfx20UI7F16.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_NET_Framework20_Setup06A7.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_NET_Framework30_Setup0775.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_NET_Framework35_MSI07B9.txt"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
FLast = "%User Temp%\dd_RGB9RAST_x86.msi0683.txt"
It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
winsys = "%Windows%\winsys.exe"
Dropping Routine
This spyware drops the following files:
- %Windows%\pool32.dll
- %Windows%\ole32w.dll
- %Windows%\iecomn.dll
- %Windows%\viaud.dll
- %Windows%\calc2.exe
- %Windows%\regedit2.exe
- %System%\calc2.exe
- %System%\regedit2.exe
- %User Startup%\AdobeGammaLoader.scr
- %Common Startup%\AdobeGammaLoader.scr
- %Windows%\unrar.dll
(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.. %Common Startup% is the system's shared Startup folder, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003.)
This report is generated via an automated analysis system.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Restart in Safe Mode
Step 3
Enable Registry Editor, Task Manager, and Folder options
Step 4
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- winsys
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
- {65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Run
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
- RunServices
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Run
Step 5
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- winsys = "%Windows%\winsys.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
- winsys = "%Windows%\winsys.exe"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- lsassv = "%Windows%\lsassv.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- ThisEXE = "{malware path and file name}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- VerProg = "92"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- msrpc = "%Windows%\msrpc.exe"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- DependOnService = "RpcSs"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- Description = "This service manages TCP/IP packets at Internet"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- DisplayName = "TCPIP route manager"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- Group = "PlugPlay"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- ObjectName = "LocalSystem"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- ImagePath = "%Windows%\winsys.exe"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- ErrorControl = "1"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- PlugPlayServiceType = "3"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- Start = "2"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsys
- Type = "12"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- {malware path and file name} = "{malware path and file name}:*:enabled:system update"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%System Root%\AUTOEXEC.BAT"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%System Root%\boot.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%System Root%\CONFIG.SYS"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Security\directories.acrodata"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\ABCPY.INI"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\AcroRead.msi"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\Data1.cab"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\setup.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\Setup.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Desktop%.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "{random characters}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Media Player\DefaultStore_59R.bin"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Media Player\UserMigratedStore_59R.bin"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Pbk\rasphone.pbk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Pbk\sharedaccess.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\airplane.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "11"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\astronaut.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "12"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\ball.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "13"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\beach.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "14"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\butterfly.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "15"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\car.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "16"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\cat.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "17"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\chess.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "18"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\dirt bike.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "19"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\dog.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\drip.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\duck.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\fish.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\frog.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\guitar.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "1f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\horses.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\kick.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "21"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\lift-off.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "22"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\palm tree.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "23"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\pink flower.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "24"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\red flower.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "25"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\skater.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "26"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Default Pictures\snowflake.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "27"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\User Account Pictures\guest.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "28"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\User Account Pictures\Wilbert.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "29"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Sample Music\New Stories (Highway Blues).wma"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst1.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "2f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst10.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst11.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "31"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst12.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "32"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst13.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "33"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst14.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "34"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst15.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "35"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst2.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "36"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst3.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "37"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst4.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "38"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst5.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "39"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst6.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst7.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst8.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\0008044E\Plylst9.wpl"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Sample Pictures\Blue hills.jpg"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "3f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Sample Pictures\Sunset.jpg"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "41"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Sample Pictures\Water lilies.jpg"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "42"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Sample Pictures\Winter.jpg"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "43"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "44"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\DRM\drmv2.lic"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "45"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\DRM\drmv2.sst"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "46"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "47"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Accessibility\Accessibility Wizard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "48"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Accessibility\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "49"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Calculator.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\HyperTerminal.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\Network Connections.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\Network Setup Wizard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\New Connection Wizard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "4f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\Remote Desktop Connection.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "51"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "52"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Entertainment\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "53"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Entertainment\Sound Recorder.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "54"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Entertainment\Volume Control.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "55"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Paint.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "56"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Backup.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "57"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Character Map.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "58"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "59"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Disk Cleanup.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Disk Defragmenter.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Scheduled Tasks.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\Security Center.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\System Information.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "5f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\System Tools\System Restore.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\WordPad.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "61"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Component Services.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "62"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Computer Management.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "63"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Data Sources (ODBC).lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "64"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "65"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Event Viewer.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "66"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Local Security Policy.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "67"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Performance.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "68"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Administrative Tools\Services.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "69"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Adobe Reader X.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Freecell.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Hearts.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Internet Backgammon.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "6f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Internet Checkers.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Internet Hearts.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "71"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Internet Reversi.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "72"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Internet Spades.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "73"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Minesweeper.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "74"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Pinball.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "75"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Solitaire.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "76"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Games\Spider Solitaire.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "77"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\MSN.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "78"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Common Startup%\AdobeGammaLoader.scr"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "79"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Common Startup%\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Windows Messenger.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Windows Movie Maker.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\WinPcap\Uninstall WinPcap 4.1.2.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\WinPcap\WinPcap Web Site.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Set Program Access and Defaults.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "7f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Windows Catalog.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Windows Update.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "81"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "82"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Internet Explorer\brndlog.bak"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "83"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Internet Explorer\brndlog.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "84"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Cookies\index.dat"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "85"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Media Player\CurrentDatabase_59R.wmdb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "86"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "87"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.XML"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "88"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "89"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\History.IE5\index.dat"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\09RWHJQN\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\BVLBNMKH\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "8f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\index.dat"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\ZDGZNKA5\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "91"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\ZSGKJKO6\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "92"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "93"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\NTUSER.DAT"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "94"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\SendTo\Compressed (zipped) Folder.ZFSendToTarget"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "95"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Desktop% (create shortcut).DeskLink"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "96"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "97"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\SendTo\Mail Recipient.MAPIMail"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "98"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "99"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9a"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Accessibility\Magnifier.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9b"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Accessibility\Narrator.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9c"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9d"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Accessibility\Utility Manager.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9e"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Command Prompt.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "9f"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Entertainment\Windows Media Player.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Notepad.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Program Compatibility Wizard.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Synchronize.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Tour Windows XP.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Accessories\Windows Explorer.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Remote Assistance.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "a9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Startup%\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "aa"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Start Menu%\Programs\Windows Media Player.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ab"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\amipro.sam"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ac"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\excel.xls"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ad"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\excel4.xls"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ae"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\lotus.wk4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "af"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\powerpnt.ppt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\presenta.shw"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\quattro.wb2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\sndrec.wav"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\winword.doc"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\winword2.doc"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\wordpfct.wpd"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Templates\wordpfct.wpg"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\FontCache3.0.0.0.dat"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "b9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Windows\UsrClass.dat"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ba"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Windows\UsrClass.dat.LOG"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "bb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "bc"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "bd"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "be"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "bf"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\246FT6TD\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\9STOYKO4\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\NF72HY20\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Temporary Internet Files%\Content.IE5\PHOM4UYK\desktop.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\ntuser.dat.LOG"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\ntuser.ini"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "c9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ca"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "cb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "cc"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "cd"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ce"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "cf"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "d9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "da"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Desktop%.htt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "db"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "dc"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Quick Launch\Launch Internet Explorer Browser.lnk"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "dd"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Quick Launch\Show Desktop.scf"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "de"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\MMC\secpol"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "df"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Profile%\Themes\Custom.theme"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\Links\Customize Links.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\Links\Free Hotmail.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\Links\Windows Marketplace.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\Links\Windows Media.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\Links\Windows.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\MSN.com.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Favorites%\Radio Station Guide.url"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "e9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\IconCache.db"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ea"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Internet Explorer\MSIMGSIZ.DAT"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "eb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ec"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%Application Data%\Microsoft\Wallpaper1.bmp"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ed"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ee"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ef"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f2"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f3"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f5"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\58e0ef.mst"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f6"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\AdobeARM.log"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f7"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\AdobeSFX.log"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f8"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\ASPNETSetup_00000.log"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "f9"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\ASPNETSetup_00001.log"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "fa"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\ASPNETSetup_00002.log"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "fb"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_depcheck_NETFX_EXP_35.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "fc"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_dotnetfx35error.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "fd"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_dotnetfx35install.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "fe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_dotNetFx40_Full_x86_x64_decompression_log.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FNum = "ff"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_MSXML6_MSI0686.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_netfx20MSI7F16.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_netfx20UI7F16.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_NET_Framework20_Setup06A7.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_NET_Framework30_Setup0775.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_NET_Framework35_MSI07B9.txt"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}
- FLast = "%User Temp%\dd_RGB9RAST_x86.msi0683.txt"
Step 6
Search and delete these components
- %Windows%\pool32.dll
- %Windows%\ole32w.dll
- %Windows%\iecomn.dll
- %Windows%\viaud.dll
- %Windows%\calc2.exe
- %Windows%\regedit2.exe
- %System%\calc2.exe
- %System%\regedit2.exe
- %User Startup%\AdobeGammaLoader.scr
- %Common Startup%\AdobeGammaLoader.scr
- %Windows%\unrar.dll
Step 7
Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_LYDRA.SMM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.